Remember, Remember: Bonfire Night Scams to Watch in 2026

Key takeaways

• The UK festive fraud season starts on 1 November, and Bonfire Night (Thursday 5 November 2026) is the first major lure of the year.

• Most Bonfire Night scams are a form of purchase fraud, where victims pay for tickets or goods that are fake or never arrive. Purchase scams were the most reported scam type of 2025.

• Ticket scams were the second most reported purchase scam at Lloyds Bank in 2025, and more than 70% of purchase scams happened on Meta-owned platforms.

• UK shoppers lost around £11.8 million to online shopping fraud between November 2024 and January 2025.

• Scammers build their lures weeks before an event, which means seasonal threat intelligence can catch them before they reach customers.

The festive season is officially here, and so are the scammers. From now until January, people are busy, distracted and spending more online than at any other time of year. Attackers know this, and they plan around it.

The numbers show it. UK shoppers lost around £11.8 million to online shopping fraud over the 2024/25 festive season, according to City of London Police data shared by the National Cyber Security Centre. The NCSC warns that scammers use fake deals, “limited stock” pressure and bogus delivery messages to rush people into paying.

The first big lure of the season arrives this week: Bonfire Night.

What are the most common Bonfire Night scams in the UK?

Most Bonfire Night scams fall under purchase fraud, the official term for scams where someone pays for goods, services or tickets that are fake or never arrive. It is now the biggest consumer scam category. Purchase scams were the most reported scam type of 2025, and Recorded Future tracked 2,500 purchase scam websites using 1,800 merchant accounts in the first half of 2026 alone.

Event tickets are a favourite target. Ticket scams were the second most reported purchase scam at Lloyds Bank in 2025, behind only vehicles, with demand for Glastonbury, the Oasis tour and big football fixtures driving reports. More than 70% of purchase scams reported to Lloyds started on Facebook, Instagram or other Meta-owned platforms.

• Fake tickets for sold-out displays. The biggest Bonfire Night events, from Lewes in East Sussex to large council-run displays across London and the Midlands, sell out fast, and scammers move into the gap. Tickets offered on social media or by private message for a sold-out event are a classic red flag.

• Firework sales on social media. Fireworks bought through marketplace listings and private sellers may be unsafe, counterfeit or never arrive at all, especially when the seller asks for payment by bank transfer.

• Event-themed phishing. Fake “your ticket is ready” emails, delivery texts for firework orders and bogus event pages all use the same urgency. They aim to steal card details and login credentials rather than just the ticket price.

How much do ticket scams cost UK victims?

Ticket fraud is growing fast. Action Fraud recorded £9.7 million in ticket fraud losses in 2024, a rise of nearly 50% on the year before.

London is the hotspot. An analysis of Action Fraud data by SeatPick found the Metropolitan Police area had the most ticket scam reports and around £3 million in losses, while Suffolk had the highest average loss per report.

Why does seasonal threat intelligence matter?

Scammers work to a calendar, and defenders should too. Bonfire Night is followed by Diwali, Black Friday, Christmas delivery season and New Year’s Eve, and each one brings its own lures.

The fake ticket problem does not stop on 5 November. In November 2025, City Hall warned people to buy London’s New Year’s Eve fireworks tickets only from Ticketmaster after a rise in fake tickets and rogue resale sites. Touts had reportedly charged up to £250 per person, a £200 markup, and on the night scammers sold copied QR-code ticket screenshots to several buyers at once.

Seasonal threat intelligence matters for three reasons:

• Lures are built in advance. Lookalike domains, fake event pages and social accounts are often set up weeks before an event, so they can be spotted and taken down early.

• Brands are impersonated, not just breached. Event organisers, ticketing platforms, retailers and councils all have their names used against their own customers.

• Teams are stretched. Festive staff shortages and change freezes give attackers more time before anyone notices.

How can people and organisations stay safe this Bonfire Night?

For the public:

• Buy tickets only from the event’s official website or named ticket partner.

• Treat any offer of tickets for a sold-out event as a red flag.

• Pay by credit card, never by bank transfer.

• Report fraud to Action Fraud on 0300 123 2040, and forward scam texts to 7726.

For organisations:

• Monitor for lookalike domains and fake social accounts using your brand ahead of seasonal events.

• Publish your official ticket and sales channels clearly so customers can check.

• Brief staff and customers on seasonal phishing themes before the festive rush.

How can CYJAX help with seasonal threats?

CYJAX tracks how threat actors adapt their campaigns to the calendar. Our analysts monitor lookalike domains, fake social accounts, phishing kits and dark web chatter, so organisations know what is being built against their brand before it reaches their customers.

Automated tools can flag a suspicious domain. CYJAX analysts add the context: who is behind it, what event it is targeting and how urgent the risk is. That context matters most when everyone is busy with the festive rush.

Want to know what seasonal threats are targeting your organisation this winter? Book a demo or ask a CYJAX analyst.

‍