Incognito — November 2026: Black Friday, Cyber Monday, and Giving Tuesday — AKA Scam Central

Welcome to the November 2026 issue of Incognito, your monthly privacy and security deep dive with DeleteMe. 

This month:

• Black Friday, Cyber Monday, Giving Tuesday, and Your Privacy: It’s that time of year again. Expect scams, phishing, and unfair pricing practices galore. 
• Hear How Chris “The Producer” Parr Became a Data Broker: Chris rejoined the pod to talk about how he tried to get a copy of his own data from brokers and got turned down, until he became a data broker himself. Listen to the full podcast episode. 
• Recommended Reads: New research shows AI can infer a lot with a little data; Muse is the worst AI agent for privacy; 8 million Illinois residents sue Apple for biometric privacy violations. 
• Q&A: What can companies learn about you from your smartphone? 
• Connect with us at ISC East. We’re looking forward to seeing you! Learn more

Black Friday, Cyber Monday, and Giving Tuesday — AKA Scam Central

This time of year is great for getting good deals. It’s also prime time for scammers, because everyone expects too-good-to-be-true promises and emails from every retailer in existence. Giving Tuesday throws non-profit requests and charitable donations into the mix. And retailers are joining in on the fun by using your private data to “personalize” deals, all while giving you the highest price they think you’ll be willing to pay. 

Protect your wallet, your privacy, and your peace of mind this year. 

1. Don’t click links in emails. It’s not worth it. 

Even if you’re expecting an email from Amazon, cybercriminals know everyone is expecting those kinds of emails this time of year. With the help of AI, they can spin up a lookalike in seconds. So don’t take the bait. Go directly to the retailer’s website and shop for deals there.

2. Check the sender’s actual address.

Display names are easy to fake. Look at the full email address behind the name. A message from “Amazon” that comes from a random domain is a scam. 

3. Treat urgency as a red flag.

Urgency alone doesn’t prove a scam, especially during the holiday marketing rush. Still, if an email requests an account action, such as “Your account will close in 24 hours” or “Your order is on hold, verify now,” it’s probably a phishing threat. Pause, then check the claim through the official app or website. 

4. Don’t trust a familiar voice or face.

AI can clone voices and create convincing videos. If a call or video message claims to be your bank, a family member in trouble, or a company executive asking for money or gift cards for the holidays, hang up and verify through another channel. 

5. Use app-based login protection.

Turn on multi-factor authentication for your email, shopping accounts, and bank. Choose an authenticator app or passkey over text message codes, which can be intercepted. Never share a one-time code with anyone, including someone who emails or calls saying they work for customer support.

6. Verify every charity before you donate.

Giving Tuesday brings a flood of fake appeals. Search the charity’s name yourself and donate only through its official website. Check its status with the IRS Tax Exempt Organization Search or a watchdog such as Charity Navigator. Ignore donation links in texts and social media posts.

7. Use virtual card numbers and transaction alerts.

If your card issuer offers virtual card numbers, use them for online shopping. A compromised number can be shut down without affecting your real account. Turn on instant transaction alerts so you spot unauthorized charges within minutes, and review your statements every week during the holiday season.

8. Report every scam you see.

Report phishing emails, fake sites, and fraudulent calls to the Federal Trade Commission at reportfraud.ftc.gov. If you lost money, call your bank or card issuer immediately. Don’t trust messages or comments on social media from people who say they can help you recover money or accounts. That’s a common follow-up scam. 

9. Use a VPN and private browsing to avoid location-based pricing.

We’ve been talking a lot about surveillance pricing recently, so we can’t ignore this one. 

Retailers sometimes raise prices based on where you live. A reputable VPN can mask your location and help you see the standard price. Pair it with a private browsing window and clear your cookies so your past searches don’t drive up the price. Compare the price across two or three browsing sessions before you buy. Choose a VPN from a well-known provider, because a free or untrustworthy VPN can expose your data.

You Too Can Be a Data Broker

If you want to see what’s really out there when it comes to your own personal information, how should you do that? Request that data brokers follow local laws and their own procedures and hand over your personal data? Turns out, that doesn’t really work, as Chris “The Producer” Parr found out. 

What is a privacy-conscious consumer to do? Become a data broker, apparently. 

In the latest episode of What the Hack, Chris described how he reached out to some of the largest data brokers and credit reporting agencies in the world to request his data. 

Five of the biggest brokers claimed they didn’t have it. Most of the other companies gave him the runaround. CoreLogic gave him an apparently empty web page with hidden links, and Equifax caught him in an identity verification loop to view his own data. Even after three hours on the phone, no one gave him access. Most brokers claimed they weren’t required to give him his information, despite a Minnesota law to the contrary. 

So Chris set up an LLC and became a data broker. Some data brokers priced him out with minimum bulk orders of $10,000, which would buy granular data points on thousands of individuals. Chris bought from smaller data brokers and ended up spending about $9 to purchase his own personal information. 

Then he fed that information into AI and asked what five things it would market to him based on his data. A standard, consumer-focused LLM that wasn’t even optimized for AI inferences for advertising suggested:

1. A hybrid three-row family vehicle. He had just bought a three-row Kia Carnival.
2. Home improvement and remodeling. Chris said this could apply to many homeowners, but he agreed it fit him.
3. Creator and prosumer tech. The model tagged him as an early adopter who wants the latest tech regardless of price, and suggested cameras, editing software, storage, and monitors. Chris confirmed this fits his work as a video producer.
4. Travel and live events. This included NFL and NHL game attendance. Chris said he has no interest in the NFL but is a big Minnesota Wild hockey fan, so the NHL part fit.

The fifth suggestion was one Chris kept to himself. The little experiment was enough to show just how powerful AI inferences are. Recent research shows that many inferences are far more sensitive, allowing advertisers to determine a consumer’s religion, sexual orientation, political views, and much more. 

There were a lot of incorrect inferences as well, but LLMs and advertisers are only getting better at pulling together your information from hundreds of sources to pinpoint how you live, what you’re likely to purchase, and how much you might be willing to pay. In other words, to fuel surveillance pricing. 

As Beau and Chris discussed, you can still fight back. Make sure $9 isn’t enough for any company, government, or individual to buy up all your personal data. 

• Request your data file from brokers and companies you interact with. Start with Meta, since its download process is relatively easy, then work through others. 
• Advocate for stronger protections in your state. Right now, fewer than half of U.S. states have what’s called a comprehensive consumer privacy law that says companies must give you your data if asked.
• Opt out of data brokers. The same states that let you request your data often also allow you to opt out of its sale and misuse. 

Hear more from the full episode of What the Hack. 

New Research Shows AI Can Infer a Lot with a Little Data

What can AI learn about you from just a few pieces of data on your phone? That’s the experiment a group of researchers, including our own Zoe Robert, recently ran with. Researchers said “the experience significantly impacted participant willingness to share permissions data moving forward.”

Muse is the Worst AI Agent for Privacy

Meta’s Muse AI agent collects more data than ChatGPT, Grok, or DeepSeek. Even if you don’t use it, your information could still get caught up in chats if your relatives and friends are using it. Learn what the risks are and how you can protect yourself before it’s too late. 

8 Million Illinois Residents Sue Apple for Biometric Privacy Violations

Apple faces a jury trial in April 2027 over claims that its Photos app secretly creates “faceprints” of people in users’ pictures, violating Illinois’ biometric privacy law. A federal judge rejected most of Apple’s bid to dismiss, finding that its control over the software and servers gives it enough power over the data, despite encryption. The case could help define how the law applies to newer AI technologies.

You Asked, We Answered

Q: What can companies learn about you from your smartphone?

A: More than you think.

Your phone can reveal far more about you than you might expect. Companies can learn about your mental health, reproductive health, sexual orientation, substance use, medical conditions, religion, legal issues, and whether you have children. They can also estimate your income and draw conclusions about the people closest to you. Those conclusions do not have to be accurate to cause harm, because companies act on them anyway, whether to set your prices, target your ads, or make decisions about you without your knowledge.

• Deny precise location access. Set location to “While Using” or “Never” for every app that doesn’t need it to function.
• Limit photo access. Choose “Selected Photos” instead of the full camera roll. 
• Delete screenshots of IDs, passwords, and financial details. Your gallery is one of the most revealing parts of your phone. 
• Restrict contacts and calendar access. Grant these only to apps that truly need them, such as messaging or scheduling tools. 
• Audit your permissions every month. Go to your phone’s privacy settings, review each permission type, and revoke access for apps you no longer use.
• Delete apps you no longer use. Each unused app is a permission you forgot to revoke.
• Turn off ad tracking. On iPhone, disable “Allow Apps to Request to Track.” On Android, go to your Google settings and delete your advertising ID.
• Don’t sync your full contact list. Remember that the data you share can reveal information about your family, friends, and coworkers.

ISC East is Coming Soon

ISC East is “The Northeast’s Premier Security & Public Safety Event,” and we’re going to be there! Come see us at booth #1024 on November 4th-5th at the Javits Center in NYC. 

Our team will provide a live demo for how we remove exposed personal information from the open web and reduce your attackable surface. 

We’ll also share more about our 2026 State of AI Social Engineering Report and what it means for organizations now and in the coming year. 

Connect with us HERE

Back to You

Get in touch with us. We love getting emails from our readers. You can also find us on X, BlueSky, Instagram, Facebook, LinkedIn, and YouTube. 

And don’t forget to share! If you know someone who might enjoy learning more about data privacy, feel free to forward them this newsletter. If you’d like to subscribe to the newsletter, use this link.

That’s it for this issue of Incognito. Stay safe, and we’ll see you next month.