Holiday retail scams: are your controls keeping up with AI speed?

TL;DR: Generative AI is letting attackers clone retail brands, launch targeted malicious ads, and run multi-surface consumer fraud campaigns in minutes, according to Doppel. Legacy brand protection and siloed email controls cannot keep pace with campaign speed, so defenders need infrastructure-level disruption, not isolated takedowns.

Editorial analysis by NHI Mgmt Group, based on content published by Doppel: “Retail’s Holiday Shadow: How AI-Native Impersonation Engines Target Peak Shopping”.

By the numbers:

• Generative AI has lowered the cost to attackers by 95%, according to Doppel.
• The industry average dwell time is 260 days to contain a social engineering breach, according to Doppel.

Key questions

Q: What breaks when retail fraud teams only remove individual phishing assets?

A: A single takedown leaves the attacker's broader campaign intact.

Q: Why do AI phishing attacks create more risk than traditional phishing?

A: AI lowers the cost, time, and skill needed to produce personalised lures, so attackers can run more campaigns and iterate faster.

Q: What are the signs that a retail impersonation campaign is spreading across channels?

A: The same brand lookalike appears in search ads, social posts, domains, SMS, and corporate inboxes, often with matching tracking artefacts or infrastructure reuse.

Practitioner guidance

• Build campaign-level correlation Group passive DNS, certificate transparency, ad network identifiers, phone numbers, and abuse submissions into one incident view so the full fraud ring is visible before takedown requests go out.
• Automate abuse intake Parse corporate abuse mailboxes programmatically so domain names, metadata, and lure content flow into detection and disruption workflows without manual triage delays.
• Feed external signals into inbox controls Use validated brand-abuse telemetry to block the same lookalike domains and sender infrastructure before they reach employees through business email compromise.

Bottom line: Generative AI has changed retail impersonation from isolated phishing into a multi-surface campaign problem that defenders cannot solve with single-asset takedowns.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →