In 2025, September was retail’s quietest month for brand impersonation. In 2026, it was the busiest. The seasonal pattern that security teams relied on to plan their coverage no longer holds.
For years, retail brand impersonation followed a rhythm that security and fraud teams could anticipate. Activity climbed through spring, peaked in summer alongside the major sale events, and dropped in September before rebuilding toward the holiday season. Our annual retail research documented that pattern clearly: August was the peak, driven by the concentration of promotional events in June and July, and September brought a sharp decline as the calendar quieted.
That pattern broke.
Allure’s detection through the first three quarters of 2026 tells a different story. Where the previous year hovered around 27 alerts per targeted brand during summer and then collapsed to 11.8 in September, 2026 held steady between 19 and 22 from March onward. September finished as the busiest month of the year at 21.5 alerts per brand, nearly double the prior year.
The sale calendar filled in the gaps
The structural explanation is not difficult to find. In 2026, Amazon scheduled five major sale events across the year: the Big Spring Sale in late March, Prime Day moved forward into June, a new Labor Day Deals event in late August and early September, Prime Big Deal Days in early October, and Black Friday Week in late November. Walmart and Target matched most of them with competing events of their own, often launching a day earlier to capture attention first.
Where Prime Day once served as a single mid-year spike, it has become one event in a continuous series. An eMarketer analyst noted that the move of Prime Day from July to June effectively pulls the entire summer retail calendar forward. For attackers, each event is a fresh pretext for fake storefronts, fraudulent ads, and impersonation campaigns timed to the window when consumers are actively searching for deals and expecting promotional communications from retailers they trust.
The numbers behind the shift
Retail brands were targeted at 2.5 times the cross-industry average for the second consecutive year. Three in four retail brands targeted by impersonation in 2025 were targeted again in 2026, and more than a third were hit in every single month of the monitoring period. These are not opportunistic campaigns spun up for one event and abandoned. They are sustained operations that adapt to each new promotional window.
The infrastructure is shifting too. Among newly registered retail impersonation domains, .shop overtook .com in both July and September 2026, rising from 7 percent of new registrations in January to 35 percent by September. The Interisle Phishing Landscape report confirms the broader pattern: .shop ranked eighth among all TLDs for phishing domains, with a phishing domain score nearly four times higher than .com. For retail specifically, the TLD has become the default choice for newly registered impersonation infrastructure, likely because .shop domains look plausible for online stores and cost less than established alternatives.
Meanwhile, confirmed retail breaches nearly doubled in the 2026 Verizon DBIR, rising from 419 to 806, with third parties involved in 68 percent of cases. The breach data and the impersonation data are telling the same story from different angles: retail’s external attack surface is expanding, and the traditional boundaries between busy season and quiet season no longer apply.
What this means heading into Q4
The holiday shopping season has always been the peak for retail fraud. Adobe forecasts $275.1 billion in U.S. online holiday sales from November through December, up 6.7 percent from last year. October is projected at $95.8 billion on its own, fueled by the Prime Big Deal Days event on October 6 and 7. Cyber Monday is expected to reach $15.1 billion.
But the 2026 data suggests that the buildup to the holiday peak started months ago. If September is no longer a quiet month, then the traditional approach of scaling up detection and takedown coverage in October and November may be starting too late. The impersonation infrastructure that will power holiday scams is not being built in November; it has been running continuously since March.
For retail brands planning their Q4 security posture, the most important finding may be the simplest one: the off-season they used to plan around no longer exists. The coverage model that worked when retail impersonation followed a predictable seasonal curve needs to account for a threat landscape that now runs year-round.
The Bottom Line
September 2025 was retail’s quietest month for brand impersonation. September 2026 was the busiest. The five-event sale calendar, the competitive matching by rival retailers, and the persistent targeting of the same brands month after month have collapsed the seasonal pattern that security teams used to rely on. Retail impersonation is no longer a seasonal problem with a seasonal solution. It is a continuous exposure that requires continuous coverage.
Key Takeaways
Retail brands were targeted by impersonation at 2.5 times the cross-industry average for the second consecutive year. Three in four retail brands targeted in 2025 were targeted again in 2026. September 2026 saw nearly twice the impersonation intensity of September 2025, reversing what had been the quietest month into the busiest. Confirmed retail breaches nearly doubled in the 2026 Verizon DBIR, rising from 419 to 806.
Year-round, as of 2026. The seasonal pattern that previously concentrated retail impersonation in summer and holiday periods has collapsed. Amazon now schedules five sale events per year, and Walmart and Target match most of them, creating a promotional calendar with no meaningful downtime. Allure’s detection data shows impersonation stayed elevated from March through September 2026 with no quiet month.
.shop is a top-level domain that has become the default for newly registered retail impersonation sites, overtaking .com in July and September 2026. It rose from 7 percent of new retail impersonation domains in January to 35 percent by September. The Interisle Phishing Landscape report shows .shop’s phishing score is nearly four times higher than .com. Retailers monitoring for brand abuse should include .shop in their domain surveillance.
If impersonation infrastructure has been running continuously since March, scaling detection and takedown coverage only in October or November may start too late. More than a third of targeted retail brands in 2026 were hit every single month. Coverage models built around seasonal peaks need to account for a threat landscape that now runs year-round, particularly as Adobe forecasts $275.1 billion in U.S. online holiday sales.
Confirmed retail breaches rose from 419 to 806 in the 2026 edition, nearly doubling. Third parties were involved in 68 percent of retail breaches. Espionage-motivated actors rose from 9 percent to 19 percent of retail breaches with a known motive. The breach data and the impersonation data tell the same story: retail’s external attack surface is expanding.
