At Halloween, being fooled is part of the fun. The cobwebs are fake, the blood is fake, and the terrifying figure at the front door is probably just your neighbour in a costume. 

Online, disguises can be much harder to spot. 

A message can look like it came from your bank. A website can look exactly like a retailer you know. A profile photo can belong to someone who doesn’t even exist. 

This Halloween, it’s worth taking a closer look at what might be hiding behind the screen. 

The message pretending to be someone you trust 

Scam messages often imitate the businesses we interact with every day, delivery companies, banks, streaming services and government agencies. 

The branding might look familiar. The wording might sound convincing. There might even be a real sense of urgency.

The safest habit is simple: don’t use the link in an unexpected message. Open the organisation’s official app or website yourself and check whether there’s actually an issue.

The website dressed up as the real thing 

Fake online stores can look surprisingly polished. Product photos, reviews, logos and even entire website layouts can be copied quickly. 
Before buying from a site you don’t recognise:
 

• Check the web address carefully. 

• Search for the retailer independently. 

• Be cautious of prices that seem unusually low. 

• Look for clear contact and business information.
   

A professional-looking website is no longer enough on its own to prove that a business is legitimate. 

The person who might not be a person 

AI has made digital disguises even more convincing. 

Photos can be generated. Voices can be cloned. Videos can be manipulated. Social profiles can be built around people who don’t exist at all. 

That doesn’t mean you need to distrust everything you see online, but it does mean appearances alone aren’t always enough. If someone contacts you unexpectedly asking for money, personal information or urgent help, verify the request through another channel before acting. 

The QR code hiding its destination 

We scan QR codes at restaurants, shops, events, car parks and public spaces without thinking twice. The problem is that a QR code doesn’t immediately show you where it’s taking you. 

After scanning, take a second to check the website address before entering payment or login details. If the page looks unusual or asks for information you weren’t expecting, close it and find the organisation’s official website yourself. 

Think of the QR code as the mask. What matters is what’s underneath. 

The oldest trick in the book: making you panic 

Technology changes, but urgency remains one of the most effective ways to get people to act before they think. 

Watch for messages like:
 

• Your account will be suspended. 

• Your parcel couldn’t be delivered. 

• Payment is required immediately. 

• Your family member needs help. 

• This offer expires in minutes.
   
  

When something makes you feel like you need to act immediately, that’s usually the moment to slow down.

Look beyond the disguise 

You won’t always be able to recognise a fake message, website, image or voice at first glance. 

That’s why the better approach is to build simple habits around checking and verifying. 

Pause before clicking. Go directly to trusted websites. Be cautious about sharing personal information. And when something creates pressure or urgency, give yourself time to check what’s really happening. 

Halloween costumes are meant to fool us. 

Online disguises aren’t always so harmless. So before you click, pay or share, ask yourself one simple question: