Since officially entering our lexicon in 2005, Cyber Monday has in many ways whizzed past Black Friday to become the year’s #1 shopping day.

Already in the Christmas shopping mindset and fresh off a long weekend, marketers noticed many consumers were making a large amount of purchases sitting in the office, browsing the web, struggling to get back into work mode.

In response, businesses took advantage of the pattern and built an entire holiday around encouraging online purchases and extending the Black Friday shopping boost through the weekend and into the following week.

Twelve years later, over half of Americans still say they prefer good old-fashioned brick-and-mortar Christmas shopping, but as a 2016 Pew Research study found, as many as 79% of Americans now shop online.

For these Americans, Cyber Monday is king: all of the absurd deals of Black Friday PLUS free shipping and the freedom to search for the perfect gifts while sipping coffee in your pajamas, watching news stories about the stampedes at your local mall the Friday before. Last year, all the perks of Cyber Monday combined to create a record-breaking $3.45 billion in sales.

But with 8 in 10 Americans embracing the online swipe, and billions of dollars up for grabs in a single day of online traffic, to online thieves, the internet on Cyber Monday is like a watering hole in the middle of summer on the Serengeti.

And the scammers are the lions.

How are they doing it? By using the same tricks and techniques cyber scammers always use–except today, they’ll be out in force to intercept the glut of inexperienced online shoppers with large Christmas funds who might only make an online purchase once or twice a year.

They’ll also be relying on shoppers’ expectations of finding phenomenal deals left and right–deals that we might deem “too good to be true” on any ordinary Monday.

On Cyber Monday, online shoppers are much easier to tempt, less apt to find an offer suspicious, eager to take advantage of a short-lived deal, and much more likely not to notice the tell-tale signs of a dupe.

But as we said, the cons they’ll pull are nothing new. As with any other shopping day, you have to know what those cons are and how to avoid them–the only difference is there are more of them and the urge to gamble on a really sweet deal is a little stronger.

Fake websites. These could either be phony versions of legitimate online business pages or totally bogus business sites altogether. You can usually spot these because they…just look…bad. Horrible graphics, sloppy organization, janky user interface, dead or broken links, and more spelling errors than an elementary English teacher can shake a yardstick at.

But not all of them will be readily identifiable–in fact, some scammers can replicate a legitimate business’ site right down to the logo and brand colors. In these cases, the site may look spot-on, but the URL might be slightly off. For example, a scammer might pass a “rn” off as a “m” (“www.xyzrnart.com” instead of “www.xyzmart.com”) or a “1” as a “l” (“www.dealswor1d.com” instead of “www.dealsworld.com”).

Typically, to get shoppers to navigate to these fake versions of sites, the scammer will need to get the fake link to the shopper through an email or a pop-up ad. To avoid this trap, always type the trusted retailer’s URL directly into the address bar of your browser, and don’t visit sites through unsolicited links.

Pop-up ads and windows. Don’t click pop-ups.

Not even if they say they’ll give you a coupon. Not even if they offer you a free trial of a service you might want to use. Not even if it says your Flash is out-of-date. Not even if it looks just like a Windows operating system alert. Not even if it says YOUR SYSTEM IS INFECTED WITH MALWARE!!! (especially if it says this). Not even if it says you’ve been randomly selected and you’ve won a prize. Not even if it says the Federal Bureau of Investigations is screening your computer because it was recently used to look at questionable content and now you’re in really big trouble.

Just don’t click them. Don’t do it. Seriously. If you have a question about whether the content in the pop-up is legitimate, navigate directly to the trusted site and see if you can find more information there.

But don’t click the pop-up. Get an adblocker to help with limiting the amount you see these.

Don’t shop on public WiFi. Man-in-the-middle attacking is very common on public hotspots someone might use in a restaurant, café, large retail store, or shopping mall. This type of attack allows a thief to position himself between you and a legitimate recipient, like an online store, and intercept all of the data you and the target send back and forth, including names, addresses, and credit card information.

But this is just the start of how a thief can wreck you via an unsecure public WiFi connection. So don’t shop on a public connection ever. Save all of your digital purchases for at home on a connection you trust.

Fake phone apps. If you use store apps or shopping apps to do your online shopping this year, be on the lookout for fake phone apps. Once downloaded, these apps are nothing more than malware and skimmers, swiping any information you have stored in your phone or enter into your phone later when making future logins or purchases.

These apps will also often ask you to log into your social media or other online accounts to proceed with use–don’t ever log into anything that prompts you to use your unrelated social media, email, or bank credentials in order to proceed with using the service.

These are just some of the biggest things to watch out for as you shop today and the rest of the holiday season, but the list could go on and on.

Here are some very helpful videos about other risks and red flags you can be watching out for as you do your Christmas shopping online:

With identity theft and cyber crime on the rise, it’s no wonder so many Americans are now questioning when it is and isn’t appropriate to give an institution or business their full Social Security number.

Virtually every major financial or health decision requires you to hand over your Social Security number (SSN). Banks require it to open accounts, loans, or credit cards in your name, and doctors, health insurers, and hospitals use it more for billing purposes.

These aren’t the only institutions asking for access to your SSN: universities, government agencies, employers, utility providers, landlords, and even some retailers will ask, but not every organization asking for your SSN necessarily NEEDS it. And in fact, in some cases, you’re better off if you don’t give it.

So, who NEEDS my Social Security number?

Businesses and organizations that report to or otherwise deal directly with the Internal Revenue Service (IRS) regarding your transactions with them will always ask you for your full SSN. In other words, if a company credit-reports or credit-checks, they’re going to need the number.

This includes credit-reporting bureaus, banking institutions during home purchases, car purchases, or credit card and account openings, some utility providers, insurance companies, landlords when you’re applying to rent an apartment, investment advisors, and your employer.

Federal law also says tax authorities, the Department of Motor Vehicles, and federal agencies have a right to ask for your SSN to identify you, though The Privacy Act of 1974 mandates that all government agencies from local to federal level notify citizens whether or not requests for their SSNs are required.

For more information about the kinds of places you’ll have to provide your SSN, here is a list compiled by the Social Security Administration detailing many of the agencies and organizations where giving your SSN is required by law.

When should I refuse to give my Social Security number?

This piece over at CBS Pittsburgh provides some helpful tips when it comes to choosing when you should give someone your SSN. In an interview with Andrew Richards, fraud expert at Fraud Investigative Service in Pittsburgh, Richards recommends keeping three questions in mind when prompted to give your SSN:

Did you reach out to them or did they reach out to you? If you’ve initiated an inquiry, service, or purchase wherein you’re asked for your SSN, it’s likely the request is more trustworthy than if someone contacts you out of the blue to request it. In the case of requests made via email, online forms, or phone calls, this is especially true–most if not all reputable organizations asking for this information will never do so using these methods.

Do you know why they need it? You are always within your rights to ask someone why he needs your SSN. Someone prompting you for your SSN should be able to tell you why he needs it without hesitation. If the reason isn’t something that has to do with legitimate and required reporting to the IRS (such as simple identification), it might be best to ask for an alternative method to identify yourself without giving your full number.

Do they need your full SSN? If an organization simply needs to identify you, ask if it’s possible to use a partial SSN to do so. Many legitimate businesses and agencies only need you to verify the last four digits of your SSN along with some other information to satisfy identification requirements. It may also be wise to ask the organization if you can identify yourself through other means.

The Social Security Administration itself says a person can refuse to give his SSN to a private business at any time, but that a refusal to do so may result in a failure to receive services.

Protecting your parents from CNBC.

A 2015 study by True Link Financial estimated scammers drain around $36.5 billion from senior citizens every year, but a more recent report by CNBC claims this number might, in reality, be much higher.

According to President of the North American Securities Administrators Association, Mike Rothman, current retirees represent some of the wealthiest retirees to date in terms of total assets and savings.

Though thieves have always been attracted to seniors–preying on those experiencing cognitive decline or living alone–the appeal is growing due to the large nest eggs many Boomer retirees have built for themselves.

And with our population aging as a whole, the pool of potential retiree victims at peak personal wealth is much larger than ever before. For scam artists, it pays to go after seniors.

And pay it does: if a scammer is successful, Allianz Life estimates a senior financial fraud victim loses $36,000 on average.

As CNBC reports, the majority of reported fraud cases fall into three categories:

Third-party exploitation (27%)

This could include a third party insisting on becoming a cosigner to a victim’s accounts, showing unusual interest in assisting or escorting a victim to the bank, third party check cashing, and a third party giving unusual or inappropriate financial advice or demonstrating financial influence.

Account distributions (26%)

Including phony or unethical savings and investment schemes.

Exploitation by family, trustee, or power of attorney (23%)

Outright theft perpetrated by those charged with financial caretaking and decision-making–including by those closest to and most trusted by the victim.

The article goes on to caution seniors against false comfort when it comes to fraudsters. Though con artists looking to take advantage someone prefer to prey on the vulnerable, like the cognitively impaired, many senior victims aren’t disabled and have no memory loss or illness. A good scammer can take anyone for a ride–especially when he’s confident no one can.

You can read the rest of CNBC’s report about the high price tag of senior financial fraud right here.

Yesterday, KAKE News in Wichita, Kansas reported a new twist on the old Social Security phone phishing scam.

And this one’s a doozy.

Kansas resident Justin H. Kelley contacted the Better Business Bureau after receiving an alarming phone call from someone claiming to be a Social Security agent.

What he heard next would have made anyone’s jaw hit the floor.

According to this “agent,” a rental car was located somewhere in Texas containing a large amount of cocaine and blood. Upon examining the rental agreement, it was found Kelley’s Social Security number had been used to rent the vehicle.

Naturally, law enforcement had a few questions for Kelley. The caller told him federal and local police as well as US Marshals were on the way to his home to speak with him.

Wow.

Initially, Kelley says he was taken in–as he said, “[the caller] had one hell of a story.” Parts of it he even found very plausible given his profession requiring him to rent cars for travel.

But before getting carried away completely, he noted some strange inconsistencies with the story. For example, the “agent” called on a holiday when Social Security offices would have been closed.

Thanks to Kelley’s quick thinking and attention to detail, he dodged a scam artist.

The object of this scam was most likely to tell a story so fantastic and intimidating (nothing will make you volunteer personal information faster than thinking federal agents are on the way to your house to arrest you) that a victim would totally ignore everything they’ve ever learned about not handing out their information, and tell the scammer everything he wanted to know–including a full Social Security number.

It’s worth noting that in this case, the scammer may have played his cards a little low–we’ve never heard of a car rental agreement asking for your SSN. It seems pretty suspect that a Social Security agent would be involved in this scenario at all.

And for that matter, in a case where a serious crime may have been committed…why would a Social Security agent call and not the police…?

While this is far and beyond one of the wildest phone scam techniques we’ve ever heard, Denise Groene, state director at the BBB, says all of these phone scams, from the most commonplace to the truly bizarre, have a common denominator:

“The more you divulge, the more they tend to ask. So, these scammers like to use these phishing techniques because sometimes they just need one piece of your information to put the whole puzzle together.”

It just goes to show, no matter what someone may tell you or how dire it may seem, you always have the right–and should absolutely invoke the right–to verify the identity of someone asking for your information.

And as always, if you receive a call like this, report it to your local authorities or the Social Security Administration.