A bad bot, conversely, is used to automate actions that violate a site’s security.

Shockingly, this is technically legal.

“There have been attempts to pass legislation specifically about targeting automated activity,” Klimek said.

Someone shopping on a smart phone.

d3sign / Getty Images

This continues to be a gray area in the market."

However, it’s often a catch-22.

Bot traffic can stress or overwhelm retailers' servers, resulting in high bandwidth costs and even actual damage.

A shipping notice for an online purchase displayed on someone’s smartphone.

Oscar Wong / Getty Images

With some goods, being bought up in bulk by bots can be financially detrimental.

The assumption is that the retailer and manufacturer will make up the difference on attached subscriptions or software.

This may sound like it’s mostly the retailers' problem, but consumers also need to watch out.

Volume of web attacks by target country.

Imperva

Imperva

For this holiday season, both retailers and customers should look to step up their security.

For stores, it’s possible to implementanti-botting measuresand adopt in-person sales practices.

For consumers, it’s worth being careful where you shop online and using two-factor authentication when you do.

For right now, it doesn’t look like the bots are going anywhere.