Heading into Black Friday, Cyber Monday and this holiday season, the biggest security threat may come from bots designed to steal credentials, overwhelm e-commerce sites and siphon funds from gift cards.

To better understand the threat, San Francisco-based bot detection and mitigation company Distil Networks analyzed 2016 holiday traffic to approximately 600 e-commerce sites as well as a sample of 2,600 non-e-commerce sites over a six-day period.

Distil found bots – automated programs or scripts programmed to perform very specific tasks at the request of their architect – most likely deployed for one or more reasons over last-year's holiday season, performing various tasks:

1. Scraping sale prices so competitors can match deals in near real-time.
2. Flooding a competitor's site with more requests than it can handle (Denial of Service) to affect their sales.
3. Skewing analytics to impact conversion rates or performance metrics.
4. Clicking on ads to drive up digital ad spend costs.
5. Obtaining limited-availability or temporarily-lowered goods to resell at higher cost later.
6. Populating forums (likely the customer review section of the site) with ads for a competitor.
7. Stealing gift card balances. The Distil team actually started noticing increased bot activity on customer websites with gift card processing capabilities in February 2017.