Key takeaway: Merchants should treat lookalike domains and subdomains as a path into their own systems and customer accounts. Brand monitoring and takedowns belong on the same priority list as other fraud controls.
ReliaQuest reported on November 9, 2026 that attacks targeting the retail trade sector rose 31% in its Q3 2026 Retail Trade Threat Landscape Report. The same report found that phishing now accounts for 39% of initial access in retail, up from 15%.
The security firm also found that impersonating domains made up 43% of retail brand-impersonation alerts. Impersonating subdomains made up another 25%. Separately, data-leak sites named 30% more retail organizations in Q3 2026, bringing the total to 165.
ReliaQuest said retail is a frequent target because “the environment is built for throughput.” It recommended that retailers treat brand impersonation as an access risk rather than a marketing issue. Its guidance includes monitoring lookalike domains and subdomains, prioritizing takedowns for login and payment workflows, and correlating those alerts with identity telemetry.
Why it matters: Lookalike login and payment pages can lead to stolen customer credentials and account takeover. Those incidents often surface later as fraud losses and chargebacks. Impersonation monitoring has typically sat with marketing or brand teams. ReliaQuest’s data suggests fraud and security teams may need to own it too.
Source: ReliaQuest