5 Halloween Scam Texts Going Around in 2026
Quick answer: Delete any Halloween-themed text you weren't expecting — especially ones with links about costume orders, held packages, or prize winnings. Real companies don't send payment or login links by surprise text. When in doubt, look up the company yourself instead of tapping the link.
October is prime season for Halloween scam texts. Scammers dress their usual tricks in Halloween costumes — fake costume orders, held packages, prize winnings — because the holiday gives them a believable excuse to text you out of the blue.
Below are the 5 Halloween scam texts making the rounds in 2026, why each one works, and exactly what to do about it. The examples are composites of real scam patterns — the wording changes, but the tricks stay the same.
Text #1: The fake costume order confirmation
"Your Halloween costume order #84721 has shipped! Track here: [link]"
Why it works: You did order a costume recently — or someone in your family did — so a shipping text feels plausible. Curiosity does the rest.
The tell: You get it from a number you don't recognize, and the link doesn't go to the store you actually bought from. Real order updates come from the retailer's own system, not a random 10-digit number.
What to do: Don't click. Open the store's site or app yourself (type the address) and check your order status there.
Text #2: The held Halloween package
"USPS: Your Halloween package is held due to incomplete address. Confirm here: [link]"
Why it works: October means packages — candy, costumes, decorations. A "held package" text plays on the one delivery you're actually waiting for.
The tell: Delivery companies don't text you out of nowhere asking you to "confirm" your address through a link. And they never ask for payment or personal details by text to release a package.
What to do: Delete it. If you're genuinely expecting something, check tracking on the carrier's official site — typed by you, not via the link.
Text #3: The free candy / prize win
"CONGRATS! You've won a FREE Halloween candy bundle from [big brand]! Claim in 24hrs: [link]"
Why it works: Free stuff + countdown timer. The urgency ("24 hours!") is there to stop you thinking.
The tell: You never entered any contest. Real sweepstakes don't notify winners by random text with a link, and they never ask for your card "for shipping" on a free prize.
What to do: Delete it. Remember: a prize you never entered is never real.
Text #4: The fake bank fraud alert
"[Bank name] ALERT: $189.99 charge at COSTUME OUTLET. Not you? Verify here: [link]"
Why it works: It's the scariest of the five — it warns you about fraud, so your guard drops. The link leads to a fake bank login page that harvests your credentials.
The tell: Real banks don't send login links by text. They also don't text from random numbers — and the "charge" is fictional, designed to panic you into clicking fast.
What to do: Don't click, don't reply. Call your bank at the number on your card (not any number in the text) and ask about the charge.
Text #5: The "neighbor" with a link
"Hi neighbor! We're doing a Halloween block party — sign up here with your address: [link]"
Why it works: It's friendly, local, and seasonal. In October, a block party text doesn't feel strange at all.
The tell: A real neighbor would knock, call, or use the neighborhood group you're already in — not text a link from an unknown number asking for your address.
What to do: Don't click or share your address. If your street really is planning something, you'll hear about it through channels you already trust.
Got a suspicious text? Check it free
Paste the message into our scam checker for a plain-English verdict — before you click anything.
Check a Text — Free →The 4 rules that defeat every scam text
- Don't click the link. Ever. Not even "to see." Clicking can install malware or confirm your number is active.
- Don't reply — not even "STOP." Replying tells scammers a real person reads this number. Silence starves them.
- Verify through your own channels. Bank? Call the number on your card. Package? Type the carrier's site yourself. Store? Open their app.
- Forward to 7726 (SPAM), then block and delete. Forwarding helps carriers kill the sender's number. Then it's gone.
If you already clicked
Don't panic — act in this order:
- Entered nothing? Just close the page, block the number, delete the text. You're almost certainly fine.
- Entered a password? Change it on the real site — typed by you, never via the link. If you reuse that password anywhere, change it there too.
- Entered card details? Call your card company now and report it. Then watch statements for a month.
- Report it: forward to 7726 and file at ReportFraud.ftc.gov.
Frequently Asked Questions
I clicked a link in a Halloween scam text. What now?
Don't enter any information on the page that opened — close it. Then: don't reply to the text, block the number, and delete the message. If you entered a password, change it on the real site (typed by you, not via the link). If you entered card details, call your card company immediately.
How do I report a Halloween scam text?
Forward it to 7726 (SPAM) — this works on all major US carriers and helps them block the sender. Then report it at ReportFraud.ftc.gov. Finally, block the number and delete the message.
Can I tell a scam text just by the phone number?
Not reliably — scammers spoof numbers to look local or familiar. Judge the message by its content instead: unexpected links, urgency, and requests for personal info are the real tells, regardless of what number it came from.