The Countdown Reset at Zero: A Christmas Checkout Sweep for Shoppers and Small Shops

It's quarter past eleven on a damp Tuesday in November, you've finally got the good biscuits out, and the basket is sitting at £74. Then a little box slides in from the right: "Wait! Here's £20 off — just tell us where to send it." Two fields. Email and mobile. Maybe a postcode. Lovely. You type, you click, and the discount mysteriously doesn't apply to anything you actually wanted.

That's not a glitch. That's the point.

With Black Friday landing on 27 November 2026 and the Christmas rush close behind, the discount pop-up is having its busiest season since, well, last year. Most are perfectly legitimate marketing. Some are quietly collecting far more than they need, and a few are dressed up to look like the shop you're already on. Below is a way to tell the difference — and a separate section for the small firms among you whose own checkout pages are about to get a lot of traffic.

Why a voucher wants your mobile number

An email address is worth something. A mobile number is worth considerably more, because it's harder to change, harder to filter, and it travels with you across accounts. Add a full name, a date of birth and a postcode and you've got a tidy little profile that can be matched against other lists.

None of that makes the shop evil. Loyalty schemes and newsletters are how small retailers survive. The question worth asking at the checkout isn't "is this legal?" but "what am I handing over, and what happens to it after Christmas?"

Three tells of a clock that isn't real

Urgency is the oldest trick in retail and it works because your brain hates losing a bargain more than it enjoys getting one. Watch for these:

• The timer that resets. Refresh the page or come back in an hour. If the countdown starts again from 09:59, it was never a deadline — it was decoration.
• Stock counters on things that never sell out. "Only 2 left!" on a mass-produced phone case in mid-November is a nudge, not a fact.
• A "was" price that was never charged. Crossed-out figures that vanished months ago are a Trading Standards matter, not a bargain. If it feels off, the CMA and your local trading standards team do take reports.

Permission creep: the boxes you didn't tick

This is where festive generosity gets expensive. Three patterns to look for on any checkout form:

1. Pre-ticked consent boxes. Under UK GDPR and the Privacy and Electronic Communications Regulations, consent has to be an active choice. A box that's already ticked — for newsletters, for "partner offers", for anything — isn't consent you gave, and you're within your rights to object.
2. Bundled consent. One tick covering newsletters, SMS alerts and "carefully selected third parties" is a bundle, not a choice. Look for the separate toggles. If there aren't any, assume the widest option applies.
3. "By continuing, you agree…" Language that treats proceeding to pay as agreement to marketing is worth a second look before you hit the button.

What "join the club" actually signs you up for

Loyalty schemes are usually fine. But read what the join button does beyond the points. Common extras:

• Saved card details kept on file indefinitely, sometimes across sibling brands.
• Auto-renewing subscriptions disguised as a free trial, with the renewal date buried in the confirmation email.
• App installs requested at the checkout, complete with contact and notification permissions the shop has no earthly use for.
• Open banking links — where you're asked to connect your bank account directly rather than pay by card. Legitimate services exist, but never connect an account from a link you didn't go looking for yourself.

A ten-minute checkout audit for households

Before you pay for anything this December, run this quickly in your head:

• Type the shop's address yourself rather than following a link from a text or social ad.
• Check the padlock and the exact domain. currys.co.uk and currys-outlet.shop are not the same business.
• Decline the pop-up, then see if the discount reappears at the basket anyway. It usually does.
• Untick everything that's already ticked, then re-tick only what you actually want.
• Use a card, not a direct bank transfer. Card payments have chargeback rights; bank transfers generally don't.
• Say no to "save my card for next time" unless you're a regular.
• Screenshot the order confirmation, including the price you agreed.
• If a page asks for your PIN, your banking password, or a photo of your driving licence to complete a normal retail purchase, close the tab.

Keep your browser and any security software up to date while you're at it — most of the aggressive pop-up behaviour gets blocked at that layer before it reaches you.

Small firms: your payment page is somebody else's template

If you run a micro-business, the festive period brings two risks that don't get talked about enough.

The first is cloning. Fraudsters lift a shop's branding, build a lookalike checkout on a cheap domain, and push it out through social ads and SMS. Your customers get burned, and your name is on the fake page. The defence is boring but effective: publish exactly which domain you take payments on, keep your contact details consistent everywhere, and tell customers you'll never email them asking them to "re-enter card details".

The second is your own plugin pile. Every extra script on a checkout page — analytics, heat maps, chat widgets, review pop-ups — is another thing that can collect data you didn't plan for. If you can't say what a script does and who receives the data, it probably shouldn't be on the payment page at all.

Use your payment provider's hosted fields so card details never touch your own site, keep a record of when and how each customer consented to marketing, and make unsubscribing as easy as signing up. The ICO is not unreasonable about small firms doing their best — but it is unreasonable about firms that can't show what they did.

A pre-December checklist for micro-firms

• Confirm your checkout only asks for what you actually need to fulfil the order.
• Turn off pre-ticked marketing boxes, everywhere, including on the confirmation screen.
• Write one plain-English paragraph explaining what you do with customer data, and link it at the point of payment.
• Test your own checkout on a phone, as a customer, once a month. You'll spot the oddities faster than anyone.
• Keep order confirmation emails consistent in tone and sender address so customers can tell yours from a fake.
• Brief whoever answers the inbox: if someone rings saying they've been asked to re-verify a card, that's a red flag, not a routine query.

The bit everyone skips: afterwards

If a discount pop-up turns out to have been something worse, don't spend the evening feeling foolish. Check your statement for small recurring charges, cancel any card you've shared with a suspicious page, and report it — Action Fraud for the scam itself, your bank for the payment, the ICO if your data has been mishandled.

And if you're just a shopper trying to get a decent price on a slow cooker? Untick the boxes, decline the app install, and let the countdown run out. It always starts again at ten minutes anyway.