Ecommerce Fraud Trends From Peak Season, and What They Mean for 2027

With each passing year, the people who work hard to keep ecommerce fraud from happening have to work even harder to keep up with the people who commit that fraud. Want to find out where the weak spots are? The Cyber Five is either your best opportunity to assess where you’re losing ground, or your best opportunity to demonstrate that you’re ahead of the game. 

With the rise of AI, it’s getting even harder to keep up, but we can still look back, see what happened last year, and find out how it can help with the year’s strategy. We’re going to take a look at 2025’s numbers from a number of sources, including our own.

We’ll walk through what we learned, what you can take away from those learnings to advise your own strategies, and how you can use what you learn during this year’s Cyber Five to make the decisions you need to start in Q1 of 2027. 

What the 2025 holiday shopping trends showed

US shoppers spent $257.8 billion online between Nov 1 and Dec 31, 2025, according to Adobe. That's 6.8% more than the year before. Judged on spend alone, it was a fairly ordinary holiday season.

Other numbers grew a lot faster. Adobe found that generative AI traffic to US retail sites rose 693.4%. Salesforce says AI and agents influenced 20% of global Cyber Week orders, about $67 billion in sales. On Cyber Monday, Accertify counted 24% more transactions than the year before, while total value rose only 6%. The average ticket fell 14.4%.

While spending looked normal, the story changed a little bit. Shoppers bought more often and spent less each time, and that means that your stack had to process every one of those transactions, along with a growing share of traffic from AI tools.

Our data showed the same thing. We compared Cyber Five 2025, Nov 27 to Dec 1, with a baseline of Nov 3 to 23. On an average Cyber Five day, Spreedly processed 23% more successful transactions than on a baseline day, but the dollar value of those transactions rose only 11%. The average ticket fell 10%. Black Friday was the biggest day, with successful transactions at 1.75 times the baseline.

Success rates held steady under that load, at about 77% compared with 75% to 76.5% for the baseline. Gateway fees, fraud screening calls and retries are usually charged per transaction. 

When the transaction count grows twice as fast as dollars, each dollar costs more to process. That holds even on a record sales day. The first signal below starts there.

Four ecommerce fraud trends that raised peak season costs, and how to spot them

You don't need a new tool to measure any of these. Pull them from this year's Cyber Five and set them next to a normal November week. For each one, we've included what we saw across transactions processed through Spreedly, or what fraud and bot vendors reported, so you have a benchmark.

1. Check cost per transaction, not just cost per dollar

At Black Friday's busiest hour, Spreedly processed nearly 470,000 payment attempts, about 130 a second. That's 2.6 times an average baseline hour. Each attempt carried its own gateway fee, and often a fraud screening fee too.

Order sizes went the other way. Our average ticket fell from $50.55 in the baseline to $45.45 across Cyber Five, and to $33.86 on Black Friday. A flat per-transaction fee takes a bigger bite out of a $34 order than a $51 one. 

To see if your costs rose the same way, add up your peak-week payment costs, including gateway fees, fraud screening and retries. Divide that total by your transaction count to get cost per transaction, and by dollars processed to get cost per dollar. Compare both with a normal week. If cost per dollar rose while cost per transaction stayed flat, smaller baskets did it. If both rose, look at retries and fraud tool calls.

2. Compare your decline reason mix with a normal week

More traffic means more declines in total, even when your success rate holds. What matters is whether they fail for the same reasons as any other week. If the mix holds steady, peak declines are just volume: more shoppers, the same insufficient funds and expired cards. If it shifts, something specific changed. Maybe a new traffic source, a provider having a bad day, or a fraud rule firing more than usual.

To compare your own decline mix, group your peak declines by reason and set the shares next to a normal week. You’ll need to map each gateway’s codes to shared categories first, since gateways word the same decline differently.

3. Count timeouts and unknown gateway responses

When you get a decline, you at least get an answer as to what it was that happened. The same thing isn’t true with a timeout, unfortunately. 

Across Spreedly, transactions marked "gateway processing result unknown," the state a timeout produces, ran 3.1 times the baseline daily rate during Cyber Five. They went from 0.04% to 0.11% of attempts, about 1 in 1,000. Pending transactions rose 2.2 times per day.

One in 1,000 might sound small, but on a day with 5 million attempts, it's about 5,500 orders where a shopper doesn't know if they paid and you don't know whether to ship. Each one turns into a retry, a possible duplicate charge, or a support ticket.

To find your own unclear responses, count the transactions that timed out or came back with an unknown status during peak. Then look at what your system did with each one: retried the same gateway, sent it to a backup, or left it pending. If most of them came from one gateway, that gateway is a single point of failure, and it’s the first item on the checklist below.

4. Watch stored-card accounts for takeover and card testing

Obviously, fraud didn’t slow down for the holidays. What happened was it shifted toward saved accounts and bots. Sift saw account takeover rates over Black Friday and Cyber Monday run 24% higher than its average for the rest of 2025. DataDome found malicious bot requests up 135% in December compared with the year before. And on Cyber Monday, Kasada found that about 4% of checkouts came from bots.

Card testing fraud runs on the same bots. They push stolen card numbers through small authorizations to find the ones that work, then use the live cards somewhere else. It shows up as a burst of small, failed authorizations from a few sources.

Accounts with saved cards are worth more. A fraudster who takes over one skips card testing entirely and checks out with a stored credential that already works.

To check your own exposure, look at login failures, password resets and new-device checkouts on accounts with stored cards during peak. Then look at small-ticket authorization failures by source. 

Finally, ask whether your fraud provider sees the routing and token context for each transaction, or only the card. Spreedly passes that context to the fraud providers you connect, and the decisions stay with them. Our [fraud orchestration guide](LINK: Definitive Guide to Unified Fraud Orchestration) covers how that works.

How AI shopping agents will change payment fraud in 2027

When you’re a hammer, everything looks like a nail. The same principle applies to fraud stacks where an AI agent looks an awful lot like a bot that’s about to get whacked. It doesn't move a mouse or scroll a page. It often runs in a headless browser on cloud servers and fills a cart in seconds. Bot defenses are tuned to block exactly that.

Last season, agents mostly helped people shop. Salesforce counted a fifth of Cyber Week orders as influenced by AI, but influencing an order isn't the same as placing it. The next step is agents placing orders themselves, and shoppers are open to it.

In our State of Checkout consumer survey of 2,000 US adults, conducted by Talker Research in September 2026, 36% said they'd let AI complete a purchase without asking for their approval, at least for small purchases. Fear of fraud was the top barrier, named by 52%. And 42% said they haven't found an AI shopping provider they trust yet.

Look at how each of those lines up with the signals above. If agents start with small purchases, transaction counts climb and baskets shrink again, so your cost per transaction keeps rising. Agents check out with saved cards, the same stored credentials account takeover goes after. And every agent order that your bot rules misread becomes a decline, or a fraud loss.

That leaves two ways to get it wrong. Block all automation, and you turn away the shoppers who'd let an agent buy for them. Let it all through, and you give card testers and account takeover bots the same easy path.

Getting it right takes context at checkout. Is this agent acting for a known customer? Which credential is it using, and was that credential tokenized for this agent? Does your fraud provider see any of that, or only the card number? Most of that sits in your payment infrastructure, not your fraud rules. Our agentic commerce hub goes deeper on how agent checkout works.

Shoppers have already said fraud is what holds them back. The checklist below is where to start.

A 2027 payment infrastructure checklist

Code freeze comes back next fall. Q1 is when you still have the engineering time to change how payments run, so settle these five questions then. Each one comes from a signal above.

1. Can we route around a gateway that slows down mid-peak? Pull your timeout and unknown-status counts from this year's Cyber Five. If one gateway produced most of them, you need a backup path and a rule that moves traffic before shoppers feel it. Composer lets your team change those routing rules without writing new code.

2. Do we know our cost per transaction, not just per dollar? Finance usually tracks payment costs as a share of revenue. Add the per-transaction view, because smaller baskets and agent orders push that number up first. Build the 2027 budget on both.

3. Can our fraud providers see routing and token context? A fraud tool that only sees the card number has to guess. One that also knows the gateway, the token and the customer account behind a transaction has far more to go on. Find out what your current setup passes along today.

4. Are saved credentials tokenized and kept current? Stored cards are what account takeover goes after, and what agents will check out with. Network tokens and account updater services keep them valid when banks reissue cards. A token tied to your business is also worth less to a fraudster than a raw card number.

5. Can we tell an authorized agent from a bot at checkout? Start by finding out what your bot defenses do with agent traffic right now. Then decide which signals would let you approve a known agent, such as the customer's consent, an agent-specific token or an identity from the agent platform.

None of these needs you to rebuild your whole operation. Each and every one, however, needs an owner and an answer before next November.