Very few retailers have a published DMARC record, so they're wide open to impersonation and spoofing attacks.

https://www.itproportal.com/news/uk-shoppers-at-risk-of-email-fraud-this-black-friday/