A Black Friday offer looks polished, uses a familiar store name, and urges a quick checkout.
Fastest safe move: Don’t use the email’s links. Open the retailer’s official website or a known account page yourself, then check whether the offer and its terms appear there.
This guide is for shoppers checking retailer promotions during Black Friday, especially messages with unusually low prices, countdowns, or urgent login requests. It also covers what to do after a link has already been opened or information has been submitted.
Last updated October 30, 2026. The seasonal warning and shopping advice below were checked against the U.S. Treasury’s holiday advisory, FTC phishing guidance, and FTC online shopping advice. The retailer’s official date page lists Black Friday 2026 as November 27; check its current Black Friday date FAQ for any later updates.
Start with the signal the email cannot provide
A smooth, personal-sounding message does not prove that a retailer sent it. It also does not prove that AI wrote it. A human can write convincing copy, and automated tools can produce polished text; the wording alone cannot settle either question.
The U.S. Treasury’s 2025 holiday advisory warns that AI-generated emails, advertisements, and promotions may be used to create convincing impersonations. That is a reason to verify a message, not evidence that any particular Black Friday email was generated by AI or that such messages are increasing this season. The Treasury advisory recommends caution and independent verification.
Treat the email as an unverified lead, not as proof of a deal. The useful question is not “Does this sound like a real retailer?” It is “Can the offer be confirmed through a channel reached independently?”
| Verification route | What it can establish | What it cannot establish by itself | Decision |
|---|---|---|---|
| Display name or logo | The message claims to represent a familiar retailer | Who controlled the sending address or whether the offer is genuine | Don’t rely on it |
| Full sender address | The visible email address used to send the message | That the address or sending account is legitimate | Compare it carefully; still verify independently |
| Link destination | The domain a button or text link appears to open | That the page is safe merely because the text looks familiar | Don’t visit a suspicious destination; open the retailer’s site separately |
| Official site or known account | Whether the deal appears in the retailer’s own shopping channel | Whether every email detail is genuine or the offer suits the shopper | Use this as the main offer check |
| Checkout page reached independently | Whether the price and terms apply to the intended purchase | That a message’s other requests are safe | Confirm the final amount and conditions before paying |
A familiar logo, professional layout, and plausible sender name are easy to imitate. A full sender address is more informative than a display name, but it still needs context. Retailers may use different sending services for newsletters, receipts, and account notices, so one generic address pattern cannot act as a universal authenticity test.
Step 1: Check the sender and destination without opening the message’s route
Inspect the full sender address rather than stopping at the display name. Look for a domain that differs from the retailer’s genuine web address, an unexpected extra word, or a lookalike spelling. A mismatch is a reason to stop and investigate, but a familiar-looking domain is not enough on its own to declare a message genuine.
Then inspect where a link appears to lead without clicking it. On a computer, the destination may appear when the pointer rests over the link; on a phone, the available preview depends on the mail app. If the destination is shortened, hidden, or difficult to inspect, skip it. Don’t copy an unfamiliar link into a browser to “test” it.
The safest route is simpler: open a saved bookmark, use the retailer’s official app if already installed, or enter the known website address yourself. Search results can contain ads and lookalike pages, so don’t assume that the first result is the right destination. The FTC’s phishing guidance also advises against using links in unexpected messages to reach an account.
A sender address can help identify inconsistencies. It cannot certify a message. Treat it as one clue, then verify the offer through a separate route.
There is no single sender format that every legitimate retailer must use. A retailer may send promotions through a service that differs from the one used for receipts. That variation means an unfamiliar sender is not conclusive proof of fraud; it also does not justify trusting a message that asks for account access or payment before the offer is independently confirmed.
Step 2: Confirm the deal on the retailer’s own channel
Close the email’s route and look for the promotion on the retailer’s official site or in an account reached independently. Search the promotions page, the relevant product page, or the account’s offer area. If the message names a specific item, compare the item and conditions rather than searching only for a similar headline.
Check whether the offer requires a particular account, product, delivery method, or purchase threshold. Read the terms on the official page, and continue only far enough to confirm that the expected discount appears in the cart or at checkout. A promotional image, copied screenshot, or email countdown cannot show whether the offer is current, applies to the selected product, or changes the final price.
The FTC recommends researching a seller independently and keeping shopping records. Its online shopping guidance is useful when a message points to a seller or deal that is not already familiar. Save the retailer’s official offer page and order confirmation when a purchase is legitimate; those records can help with follow-up if the order, refund, or delivery later needs attention.
That independent check also resolves a common uncertainty: a real discount can be described in a fake email. The deal itself may exist while the message’s button leads somewhere unsafe. Confirming the promotion at the retailer does not make the email link trustworthy; use the independently opened site for the purchase.
Step 3: Treat urgency and requests for information as pause signals
An email that says an offer expires soon, an account will be locked, or payment must happen immediately deserves a pause. So does a request to enter a password, payment-card details, or extra personal information through a message link. Those requests are not automatic proof of a scam, because legitimate account notices can require action. They are reasons to verify before acting.
Do not reply with credentials or payment details, and don’t use contact information supplied in a suspicious message. Find the retailer’s support channel through its official site or a known account. Ask whether the message and requested action are real. If the same request appears only in the email and cannot be confirmed through the account, do not proceed through the email.
The distinction matters: urgency is a warning signal, not a verdict. A genuine promotion may have a deadline, but the deadline does not require using the email’s link. A legitimate account issue can be checked through the account’s usual sign-in route. The safer action is to verify the claim without following the path provided by the message.
Choose an email address for the kind of shopping mail
A separate address can help isolate promotional subscriptions and reduce how often a primary inbox is shared with retailers. It does not validate the sender, screen out every malicious message, or guarantee that an offer is usable. Address choice should depend on how long the account and messages need to remain accessible.
| Email option | Best fit | Main benefit | Main limitation | Shopping decision |
|---|---|---|---|---|
| Temporary inbox | A low-stakes promotion or a one-time signup that does not need later account access | Keeps some promotional mail separate from the primary inbox | Access and retention depend on the service; poor fit for recovery or ongoing support | Use only when losing access to the address will not affect the purchase or account |
| Email alias | Recurring retail updates when the shopper wants a separate address connected to a long-term inbox | Helps organize or compartmentalize retailer mail while keeping an ongoing contact route | The alias does not prove that an incoming message is genuine | Consider it for ongoing subscriptions; review how the alias is managed |
| Long-term primary address | Orders, refunds, returns, warranty details, and account recovery | Supports continued access to important records and account notices | Promotional mail can accumulate if subscriptions are not managed | Reserve it for shopping accounts and messages that may matter later |
If a shopper is considering an alias, the email alias guide explains that address-separation approach. For a temporary address, check its stated address lifetime and availability limits before using it. Those service details can change a decision about convenience, but no address type makes an unverified promotion safe.
Keep the distinction practical: separate promotional mail if that helps with inbox management, but leave order confirmations, refunds, returns, support conversations, and account-recovery messages at an address that remains accessible. A short-lived address may be unsuitable if the retailer later needs to verify identity or send a return label.
An email boundary can reduce exposure of a primary address. It is not an anti-phishing control: every offer still needs to be checked independently.
If the link was already opened, respond to what happened
The next action depends on what the shopper actually did. Opening a page is different from entering a password; entering payment details is different from completing a purchase. Avoid both panic and delay: use a known route to check the account, then address any information that was exposed.
| What happened | Immediate next step | What to check next |
|---|---|---|
| The page opened, but no information was entered | Close it. Don’t download anything or continue through its prompts. | Open the retailer’s account independently and watch for unfamiliar activity. |
| A password was entered | Go to the real account through a known route and change the password. | If that password was reused elsewhere, change it on those accounts too. Review account activity and available security settings. |
| Payment details were submitted | Contact the card issuer or payment provider using the number on the card or its official app. | Explain what was submitted and ask what monitoring, replacement, or dispute steps are appropriate. |
| A purchase was completed | Check the retailer account, order record, and payment activity independently. | Contact the retailer and payment provider through verified channels; save messages, receipts, and transaction records. |
If payment information may have been exposed, contact the card issuer or payment provider promptly through a verified channel. The provider can explain available steps for that particular account or transaction; recovery is not guaranteed. If the message led to a completed purchase, keep the order confirmation and related records while checking the retailer account independently.
The FTC’s advice for people who have been scammed outlines ways to respond based on what was shared or paid. Use its guidance alongside instructions from the relevant bank, payment provider, or retailer. Do not rely on a phone number or support link in the questionable email when contacting any of them.
FAQ: quick decisions for suspicious offers
Can polished wording tell whether AI wrote the message?
No. A fluent style may be produced by a person or a tool, and awkward writing can appear in legitimate mail. The Treasury’s warning is that AI-generated material can be used in convincing impersonations, not that a particular message can be identified by its tone. Judge the sender, destination, offer, and requested action through independent checks.
Where is a discount safest to verify?
Use the retailer’s official site or an account opened separately from the email. Confirm the named product, eligibility rules, and final checkout price there. If the promotion is absent or the terms do not match, don’t use the email’s button to investigate further. A screenshot or countdown does not replace a current offer shown by the retailer.
What if an email says the account or payment needs immediate action?
Pause and avoid its links and contact details. Open the account using a saved bookmark, known app, or independently entered address, then check for the same notice. If the account shows no matching issue, contact the retailer through an independently found support channel. Urgency alone is a warning to verify, not conclusive evidence of fraud.
Can a separate inbox make a promotional email safe?
No. It may help keep marketing mail away from a primary address, but it does not establish who sent a message or protect a shopper who follows a malicious link. Use a separate address only as an inbox-management choice. Keep essential purchase records and recovery messages at a long-term address, and verify every offer independently.
Keep the inbox boundary separate from the security check
For Black Friday shoppers, the reliable sequence is simple: don’t trust polish, verify the sender and offer through a route opened independently, and pause when a message asks for a password or payment. If an action has already happened, respond to the specific information or payment involved and contact the relevant provider through a verified channel.
A separate inbox can still be useful for low-stakes promotional subscriptions, as long as it is not mistaken for a way to detect phishing. If the goal is simply to keep a one-off promotion away from a primary address, forwardtemp offers a temporary-email option to review. Check the service’s current access and retention details before using it, and keep shopping accounts, orders, refunds, and recovery mail tied to an address that will remain available.
Frequently asked questions
Can a well-written Black Friday email still be a phishing attempt?
Yes. Clear writing, correct spelling, and familiar branding do not establish who sent a message. A genuine retailer can also use different mailing services, so an unfamiliar sender format alone does not prove fraud. Verify the full sender address and check the offer by opening the retailer’s official site or known account separately.
Where should I check whether a discount in an email is real?
Go to the retailer’s official website or open an account page using a saved bookmark or an address entered independently. Find the promotion there, then check its terms and the final price at checkout. Do not treat an email screenshot, countdown, or button as confirmation that the offer exists or applies to your purchase.
What should I do if a shopping email says I must log in or pay now?
Pause rather than follow the email’s link. Open the account through a route you already know, or contact the retailer using contact details found independently. An urgent request is a reason to verify before acting, not proof on its own that the message is fake. Never send a password or payment details in reply.
Does using a separate email address stop Black Friday phishing?
No. A separate address can help keep promotional mail apart from your main inbox and limit where you share that address, but it does not authenticate senders, inspect links, or block every phishing message. Keep order, refund, customer-service, and account-recovery mail at an address you can access long term.
Use a short-lived address for a quick trial
No registration required. Generate an address and start receiving welcome emails and confirmation links.