Halloween Scams Return on Email, SMS and Social Media Ads

Every year, Halloween gives scammers a ready-made excuse to repackage old tricks. A free decoration kit, a €250 gift card, a costume discount or a Halloween-only bonus may sound harmless, especially when inboxes and social feeds are already full of real seasonal promotions.

Here’s a look into the broader Halloween scam landscape of 2026, according to Bitdefender Labs.

Key takeaways

• Researchers at Bitdefender Labs have identified multiple Halloween-themed threats across email, SMS, social-media ads, instant messaging and suspicious online stores.
• The combined Costco and Tractor Supply email campaigns mainly targeted US users, who represented 73% of observed targeting. Romania, Ireland, Germany and Hungary were also targeted.
• Scammers impersonated Costco, Tractor Supply and bol.com in email lures, while other emails promoted suspicious Halloween stores, gambling bonuses and fake Samsung TV surveys. The impersonated brands are not involved in these campaigns.
• SMS campaigns used fake lottery winnings, expiring credits, “spooky” deposits, Halloween-party invitations and a malicious workbook to pressure people into clicking.

Halloween scams at a glance

Bitdefender Labs researchers Viorel Zavoiu and Alexandra Dinulica have uncovered multiple Halloween-themed scam campaigns between Sept. 1 and Oct. 22, 2026.

This includes scams delivered via email, text, instant messages and social media ads.  The campaigns targeted users across North America and Europe. Canada was targeted through French- and English-language SMS scams. UK users received prize and gambling-style messages. US users, meanwhile, were targeted with retailer impersonation, fake shopping offers and malware. France saw recently registered costume domains, while users in Germany, Romania, Ireland, Hungary, the Netherlands and Belgium were targeted by email lures and shopping scams.

The combined Costco and Tractor Supply campaigns were particularly US-focused: 73% of observed targeting involved US users. Romania accounted for 9%, Ireland for 5%, Germany for 4% and Hungary for 3%.

Fake Costco and Tractor Supply Halloween offers

Among the Halloween-themed email campaigns we observed, some of the most prominent used a classic lure we see each year during spooky season.

One campaign misused Tractor Supply branding and promised recipients a “Free Ultimate Halloween Decorating Kit.” Another impersonated Costco, claiming that a limited number of Halloween sets remained and asking recipients to complete a short shopping-feedback survey. Neither Tractor Supply nor Costco is associated with these messages.

The Tractor Supply campaign was heavily focused on US recipients, while the Costco lure was more geographically mixed, with notable targeting in Romania, the US and Ireland.

A survey may not sound dangerous. But fake survey scams can lead to pages designed to collect names, addresses, payment-card details or account credentials. Targets may be told they have “won” a prize, then asked to pay a small delivery or verification fee. The fee and the card data used to pay it are usually the real objective behind these lures.

Fake bol.com gift-card giveaway

Bitdefender Labs also identified a Halloween-themed email impersonating bol.com, the Dutch and Belgian online retailer. bol.com is not associated with this campaign.

The campaign offered recipients the chance to win a €250 bol.com gift card. Its Halloween landing page used the bol.com logo and festive purple-and-orange imagery, inviting people to join a supposedly free giveaway.

The page described a simple three-step process:

1. Click the button
2. Enter your information
3. Get the chance to win

It reassured visitors that they only needed to fill in “a few fields,” making the data collection look harmless and effortless.

For users in the Netherlands and Belgium, this is a useful reminder that a trusted local brand, a recognizable logo and a polished seasonal design do not make a promotion legitimate. If bol.com is running a real competition, you should be able to find it through the official website or app, and not just via an unexpected email.

Gambling bonuses and fake Samsung TV prizes

Other Halloween-themed emails relied on gambling-style rewards and expensive electronics.

One campaign, themed around “The Skeleton King,” promised €2,777 and 750 free spins. Another claimed that “the spirits” would bring recipients $20,000 and 1,000 free spins, but required a minimum £20 deposit to “complete the séance.”

These messages use Halloween imagery, a sense of exclusivity and time pressure to make a deposit feel like the final step before receiving an enormous reward. Never trust a gambling offer simply because it appears in an email or uses a festive theme.

Researchers also identified a German-language giveaway misusing the Fritz! logo and offering a Samsung 65-inch 4K Smart TV as a Halloween bonus. The message told recipients they had been selected to complete a short, free survey in exchange for the television. Neither Fritz! nor Samsung is associated with this message.

It said:

“Herzlichen Glückwunsch! Sie wurden ausgewählt, an dieser Umfrage teilzunehmen — völlig KOSTENLOS.”

Or: “Congratulations! You have been selected to take part in this survey — completely free.”

The promise is deliberately simple: answer a few questions and receive a valuable television. In reality, these prize-survey scams can collect personal information and payment details, sometimes followed by a request for a small shipping fee.

Halloween shopping emails leading to suspicious online stores

Not every Halloween scam email we’ve flagged this year promised free goodies in return for filling out a short survey. Some emails advertised Halloween products directly and led users to suspicious online stores.

Recent subject lines included:

• “Dulce de Halloween: 22% de descuento en todo”
• “Ultra-Realistic Alien Silicone Mask” with a 30% discount code
• “3D Skeleton Halloween Scary Mask” with a 30% discount code
• “Limited Edition Halloween Beaded Bracelet Set”

These messages target shoppers looking for costumes, masks, decorations and gifts at the last minute. The websites may feature professional-looking product photos, discount codes, Halloween graphics and countdowns designed to make people buy quickly.

Before entering payment details on an unfamiliar store, check the domain name, search for independent reviews, read the contact and refund information, and be cautious if the offer is dramatically cheaper than comparable listings elsewhere.

Scam ads can lead straight to fake Halloween shops

Halloween scams are not confined to inboxes and text messages. We’ve also identified scam ads promoting suspicious shops, costume deals and decorations. Some ads used steep discounts and urgent claims to sell costumes, lights, doormats, outdoor decorations and novelty products. Some ads promoted Halloween clothing, Salem-inspired costumes, plush toys and decorations through stores that redirected users through shared landing pages.

Be particularly cautious if an ad:

• promises an unusually large discount or an implausibly cheap bundle
• claims limited stock or fast local delivery without clear company information
• leads to a website with a strange or unrelated domain name
• redirects you through multiple websites before checkout
• has no credible independent reviews, contact details or refund policy

Halloween SMS scams: fake lottery winnings and expiring points

Bitdefender Labs also identified a French-language SMS campaign targeting Canadians with fake Halloween lottery winnings, expiring points and account credits. The campaign used 107 unique domains.

The messages appeared personalized and relied on urgency.

Sample messages

“Portefeuille credite [redacted name]. Halloween tirage - 2500 pret + lots million. Verrouille avant soir: [phishing link redacted]”

“[redacted name] vos points Halloween disparaissent bientot. 1550 en credits + prix d'un m1llion. Garde avant demain: [phishing link redacted] STOP to end”

“[redacted name] tes points Halloween fondent ce soir. 1405 en credits + lots d'un m1llion. Sauve avant minuit: [phishing link redacted] STOP to end”

The wording changes, but the trick is consistent: money, credits or a prize are supposedly waiting, but will disappear unless the recipient acts immediately.

“Spooky deposit” and Halloween credit scams

A separate English-language SMS campaign used Halloween-themed credit and deposit claims. The texts were designed to make phishing links look like the final step in claiming money already waiting in the recipient’s account.

Sample messages

“Halloween drop finally dropped ur account: [redacted]. No tricks. Only credits. Cla1m 1t. [phishing link redacted]”

“Spooky deposit just arrived yer 4ccount: [redacted]. Zero games. Just funds. Claim 1t. [phishing link redacted] STOP to end”

“Spooky credit ready to your card: [redacted]. Th3 only th1ng scary iz missing it. Open. [phishing link redacted]”

The letter substitutions — such as “Cla1m,” “4ccount” and “Th3” — may help scammers bypass filters. They are also a sign that the message is not likely from a legitimate financial or rewards provider.

Fake Halloween-party invitations

We’ve also spotted a phishing campaign posing as a Halloween or costume-party invitation targeting users in Canada.

The messages included realistic-looking Canadian phone numbers, said that treats or goodies had been set aside, and asked recipients to RSVP through a link.

Sample messages

“Halloween bash Sylvia [redacted] file set. 500 treats ready. RSVP or Im ghosted: [phishing link redacted]”

“Costume bash invite Sylvia: your [redacted] dossier posted. 690 treats parked. RSVP or you ghost me: [phishing link redacted]”

The links led to rotating phishing domains. An unexpected party invitation should not require you to sign in or enter personal details through an unfamiliar website. If you think it may be real, contact the organizer through a known phone number or another trusted channel.

The malicious “Halloween Work-boo-k”

Bitdefender Labs also observed a smishing campaign impersonating Tobio’s Kits, which is not associated with these messages. It used a seemingly harmless Halloween educational product as bait:

“Tobio's: Hey, it's Mel! The Spooky Halloween Work-boo-k is here. [phishing link]”

Be cautious with Halloween-themed crypto offers too

Halloween is also being used to promote cryptocurrency offers and memecoins. A spooky name, themed artwork or a “Halloween-only” token launch can make a crypto promotion feel timely and fun.

But a seasonal token can also be part of a possible pump-and-dump scheme. Promoters create excitement and encourage people to buy quickly, then may sell their own holdings after the price rises. Late buyers can be left with assets that rapidly lose value.

Treat any crypto offer promising fast profits, exclusive rewards or a limited-time Halloween bonus with caution. Never connect a wallet, disclose a recovery phrase or send cryptocurrency based on an unsolicited email, ad, text message or social-media post.

How to spot a Halloween scam

Be cautious if an offer:

• arrives unexpectedly and promises a gift card, free decoration kit, television, cash reward or free spins
• asks you to complete a survey or enter personal information to unlock a prize
• tells you that credits, points or rewards will expire before midnight
• asks for a shipping, handling, verification or deposit payment
• uses a trusted retailer’s name but directs you to an unrelated web address
• promotes unusually cheap costumes, masks, jewellery or decorations through an unfamiliar shop
• asks you to download a workbook, file or app from an unexpected message
• promotes a cryptocurrency token while promising quick returns or “Halloween-only” access

How to stay safe

If you receive a tempting Halloween offer, don’t use the link in the email, text message or social-media post. Head to the retailer’s official app or type its web address into your browser yourself to check for any seasonal discounts, giveaways or bonuses.  If the offer is real, you should be able to find it independently.

Before visiting an unfamiliar shopping website, use Bitdefender Link Checker to vet potentially suspicious links or have a chat with Bitdefender Scamio, our AI-powered scam detector for FREE!

Add an extra layer of protection across your devices

Scams rarely stay on one screen. We shop on our phones, scroll social media, open sponsored posts, and receive text messages all day.

A Bitdefender all-in-one security suite helps protect your family across the devices they use every day. With Bitdefender Mobile Security for Android or iOS, you can get protection against malicious links, scam-driven redirects, and unsafe websites that often originate in social-media apps, sponsored posts, emails, and text messages.

Scam Radar can also provide real-time alerts about scam campaigns actively spreading in your area, acting as an early warning system before you encounter the scam yourself. Alerts include real examples of messages or ads, along with the tactics, keywords and links attackers are using. They can also show who scammers are impersonating, making it easier to spot the same pattern when it appears in your inbox, messages or feed.

This Halloween, do not let a fake offer catch you off guard. The right protection can help keep the seasonal nasties off every device in your home.

Disclaimer: This report is published for informational and educational purposes only. The findings presented are based on independent research conducted by Bitdefender Labs using publicly available information and proprietary threat intelligence. The mention of specific domains, entities, brands, or trademarks does not imply any endorsement, affiliation, or official relationship. All trademarks referenced herein are the property of their respective owners. Bitdefender makes no representations or warranties regarding the accuracy or completeness of third-party information. Readers are encouraged to verify any information independently before taking action.