The handbook

Halloween: advice from the Data Protection Authority on how to guard against scams and the theft of personal data

From sharing content on social media in a responsible way to tips on how to avoid falling into the trap set by cybercriminals: what you can do to protect yourself

by Camilla Curcio

30 October 2026

Aggiungi Il Sole 24 Ore
ai preferiti su Google

4' min read

Translated by AI

Versione italiana

4' min read

Translated by AI

Versione italiana

Trick or treat? There are now just a few hours to go until Halloween and, amidst spooky costumes, carved pumpkins and baskets full of sweets, adults and children are getting ready to wander around the neighbourhoods and celebrate until late into the night. However, one can never be too careful in such situations: the excitement of the festivities could, in fact, lead to risky behaviour and unpleasant consequences. And that is precisely why the Data Protection Authority has drawn up a guide with tips to minimise potentially dangerous situations and ensure everyone can enjoy the festivities with peace of mind.

Keep an eye on social media activity

The Authority’s first piece of advice – perhaps the one that warrants the most consideration given the current climate – is to think carefully about the content you choose to publish on social media. Uploading anything to Instagram or TikTok without even a basic filter could, in fact, leave the door open to malicious individuals who, as well as viewing videos and images, could download them. Of course, you should also be wary of artificial intelligence systems: currently, the capabilities of certain software allow material to be captured and retained for long periods, thereby depriving the rightful owner of control over its management.

Particular caution is, of course, recommended, to parents: photographs of their children, especially if they are under 18, may remain in the digital space for several years, if not forever, and deleting them is not that straightforward. It is therefore best to avoid posting them or, at the very least, to restrict sharing to friends only.

That’s not all: pixelating faces, so that the child cannot be recognised, is a wise choice. Simply download a free programme from the internet or use an emoticon. Furthermore, if other children – apart from your own – appear in the images or videos, it is advisable, if not almost essential, to seek consent from those exercising parental authority before sharing them.

The same care should also be taken when sharing photos of children in WhatsApp or Telegram groups, especially when you do not know all the members: setting the ‘View once’ option may be a wise choice. This helps to curb or prevent inappropriate sharing. Because, once forwarded, the material ends up in a chain of shares and reposts online, which can have negative consequences.

Shopping with a (nasty) surprise

The risks do not diminish when you switch to written communication. Yes, even those seemingly innocent and tongue-in-cheek text messages, full of witches and animated ghosts, are part of the problem.

The Data Protection Authority is categorical on this point: it is always best to be wary of offers that promise extraordinary discounts on purchases of products, or vouchers and freebies that can only be obtained by following certain steps (for example, by clicking on a link of dubious origin or providing your bank details). In most cases, in fact, these messages are a prelude to fraud or are sent by individuals seeking to infect computers, tablets or smartphones with viruses and programmes capable of infiltrating systems and stealing credentials and personal information.

How can you protect yourself? First and foremost, don’t act on impulse or in the heat of the moment. Then check the source of the suspicious message, and assess whether it is a trustworthy website and whether any promotional campaigns are actually underway. You might also want to do a bit of research to find the official contact details, so you can get in touch with them and ask for confirmation.

Learning to recognise fake shopping websites created specifically to defraud people is a skill that should not be underestimated. Before proceeding with a purchase and entering your debit card details, it is important to look out for certain details – small but essential – that can help you spot the scam: the graphics and content of the interface (which are usually poorly designed and contain obvious grammatical errors), for example, can be decisive.

Fake shipments

False delivery notifications have been casting a shadow over many festive occasions for some years now. And Halloween is no exception. If in doubt – particularly if you haven’t been shopping and aren’t expecting any deliveries – clicking on links claiming to provide updates on a delivery or collection isn’t the right thing to do. Especially if they ask for personal details or to install strange software to complete the process. That’s why, to avoid any misunderstandings, it’s always best to refer back to the platform where the mysterious purchase was made, by searching for it online and carrying out thorough checks.

Focus on protection

Whilst it is important to protect yourself all year round, this is even more so during the festive season. Promptly updating security systems and anti-malware features is essential for keeping your data and wallet safe from online scams.

For personal accounts, always visit two-factor authentication, which is now implemented almost everywhere. In addition to your password, this ensures that access is only granted by entering a second factor, which could be a code received via text message or email, or authorisation granted solely via a dedicated app. In short, it’s a double barrier that’s difficult to breach.

The most valuable asset remains, in any case, awareness. When using web services, social media and messaging apps. And, above all, when sharing one’s own data.