A New Holiday Threat Emerges
Holiday shopping has always been a prime target for thieves. But this year, cybercriminals have a terrifying new tool in their arsenal. With Black Friday 2026 just around the corner, online payment giant PayPal has sounded the alarm on a highly sophisticated scam targeting digital gift card buyers. Fraudsters are now using fake “biometric verification” video checks to steal identities and hijack accounts.
It is a high-tech twist on an old trick. As shoppers scramble to find discounts, scammers are exploiting both holiday desperation and the rising popularity of digital gift cards.
How the ‘Deepfake’ Trap Is Sprung
The scam works with brutal simplicity. It usually starts with an ad on social media or a shady online marketplace. These ads offer steep, hard-to-resist discounts on digital gift cards for popular brands like Apple, Amazon, or Steam. Eager to save a buck, shoppers click through to complete the purchase.
But before they can check out, a pop-up appears. The page looks incredibly official. It claims that due to “high holiday fraud rates” or new regulatory compliance rules, the buyer must undergo a quick security check. It asks the victim to look into their webcam, turn their head, blink, or even read a short phrase aloud to prove they are a real person.
To the untrained eye, it feels exactly like a modern banking security check. In reality, it is a trap.
Why Scammers Want Your Face
“This is where the real danger lies,” says cybersecurity analyst Marcus Vance. “The scammers are not trying to verify your identity to protect your purchase. They are actively harvesting your biometric data.”
By capturing this high-quality, live video footage of your face from different angles, criminals can feed the data into advanced generative AI tools. These tools allow them to create highly convincing deepfakes. With these deepfakes, hackers can easily bypass actual facial recognition checks used by major banks, cryptocurrency exchanges, and credit card providers. Shoppers end up with a useless, fake gift card while handed over the keys to their entire financial life.
PayPal’s Urgent Warning
PayPal clarified its stance in an urgent security advisory. The company emphasized that it never requires users to perform live video verification on third-party websites to complete a gift card purchase. Genuine security checks happen strictly within the official, secure PayPal ecosystem, never on external, random checkout pages.
The payment provider is urging customers to be on high alert for several red flags. If a site redirects you to an unfamiliar domain, demands video authorization for a low-value transaction, or asks you to hold up your ID card next to your face, close the tab immediately.
Protecting Yourself During the Holiday Rush
How can you stay safe amid the chaotic rush of holiday deals? Security experts recommend keeping a few simple rules in mind:
- Ignore “too good to be true” deals: If a site is offering a $100 Amazon gift card for $50, it is almost certainly a scam. Stick to official retailers.
- Check the URL: Phishing sites are masters of mimicry. They often use slightly misspelled domain names to trick distracted buyers. Look for typos in the address bar.
- Never share live biometrics on retail sites: No standard retail site needs a video scan of your face to sell you a gift card. If they ask for one, walk away.
- Use credit cards: Whenever possible, use a credit card for online purchases. They offer much stronger fraud protection and dispute options than debit cards or direct bank transfers.
Black Friday is stressful enough without having your identity stolen. As artificial intelligence tools become cheaper and easier for criminals to use, the responsibility falls on shoppers to stay vigilant. This holiday season, a healthy dose of skepticism might just be the best discount you can get.
About the Author
