Masks and Disguises: What Halloween Teaches Us About Phishing

Where the masks came from

Halloween grew out of Samhain, a Celtic festival held around the end of October, more than 2,000 years ago. People believed spirits walked the earth that night, so they wore disguises to confuse them and blend in. Many costume traditions we enjoy today come from that idea: if you look like someone else, nobody knows who you really are.

Today's disguise: phishing

Online scammers use the same trick every day of the year. A phishing message is a disguise. It looks like it comes from someone you trust: your bank, a delivery company, a supplier, your own boss, or even Google or Facebook "about your business page". The goal is to get you to click a link, open a file, pay a fake invoice, or type in a password.

The U.S. Federal Trade Commission says scam messages often tell a story to rush you: a problem with your account, a payment you must make, a package you must confirm, or a prize you must claim.

Five ways to see behind the mask

Slow down when a message hurries you. "Act now or lose your account" is the costume's loudest part.
Check who really sent it. Look at the full email address or phone number, not just the name shown. One wrong letter is a common trick.
Don't use the link in the message. Type the company's address yourself, or use the app you already have.
Call back on a number you already know. If a "supplier" emails new bank details, call the number on an old invoice before you pay anything.
Turn on multi-factor authentication (MFA). Even if someone gets your password, a second step (an app code or a security key) stops most break-ins. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recommends it for every important account.

For small business owners

Scammers love small businesses because one person often handles email, bills and the website. Two habits help most: make one simple rule that nobody changes payment details from an email alone, and keep your business email, website and Google Business Profile behind MFA.

If you clicked

It happens to careful people too. Change the password from a device you trust, turn on MFA, and tell your bank right away if money or card details were involved. You can report scams at ReportFraud.ftc.gov.

Happy Halloween. Enjoy the costumes at the door; question the ones in your inbox.