It’s that time of year when ghosts, goblins, and giveaways flood our inboxes — but not everything that looks like a treat is safe to click. Recently, a new phishing campaign posing as a Home Depot Halloween giveaway has been making the rounds online, promising users “free decorations” or “exclusive coupons.” In reality, these too-good-to-be-true offers are part of a cybercriminal scam designed to steal personal data, login credentials, and even payment information. At Nutmeg Technologies, we know cybercriminals love using trusted brands — and seasonal excitement — to lower people’s defenses. Here’s what you need to know to stay protected this fall.

HOW THE SCAM WORKS

The fraudulent campaign typically arrives via email or text message, claiming Home Depot is celebrating Halloween with a special giveaway or limited-time promotion.

The message includes a link to a fake landing page that closely resembles Home Depot’s official website. Users are then prompted to “claim their gift” by entering personal details such as their name, address, and credit card information — data that is then handed over to cybercriminals.

Some versions of the scam even include fake surveys or pop-up rewards designed to trick users into downloading malicious attachments or apps, thereby creating additional security risks.