Community Tech Network is now digitalLIFT. Same training. Same advocacy. Same team. Same commitment!
Blog
Oct 29

Trick or Trust? The Disguises Hiding in Your Inbox

Trick or Trust? The Disguises Hiding in Your Inbox

Phishing, fake profiles, and why the scariest things on the internet don’t look scary at all

What’s the difference between a costume and a disguise? At this spooky time of year, we wear costumes to fright and delight. But a disguise is worn all year round by someone wanting to fool you into believing they’re something or someone they’re not. And a subtle disguise can be way scarier than a silly costume.

The most dangerous things online work exactly the same way.

Phishing emails and texts disguised to look like your bank. Tech support calls from someone who sounds exactly like a Microsoft representative. A frantic call that sounds like your grandchild asking for money right away. Fake profiles built from real photographs, with coherent backstories and months of patient relationship-building. Investment opportunities presented by someone who knows your name, your interests, and just enough about your life to seem legitimate.

None of these look like threats. That’s what makes them threats.

So let’s talk about disguises.

The Costume Collection: What Threats Look Like Online

The Phishing Email or Text (Classic Disguise)

The phishing email is the disguise that’s been around so long you’d think everyone would recognize it by now. And yet it still works, every day, on people who are smart and careful. Americans reported losing a record $15.9 billion to fraud in 2025, according to the Federal Trade Commission, and people 60 and older reported $7.7 billion in internet crime losses to the FBI.

Because the disguise has gotten better as people have gotten wiser. Early phishing emails were full of typos and obvious tells. In contrast, contemporary phishing emails are often indistinguishable from real communications from the organizations they impersonate. They carry the right logos, the right formatting, the right tone. The sender address looks correct. The link destination looks right until you’re already there. The same costume now arrives by text message, too: a package that couldn’t be delivered, an unpaid toll, an alert from your bank.

The tell, almost always, is urgency. Your account will be suspended. Verify immediately. Action required within 24 hours. The time pressure is the trick: it rushes you past the pause where your skepticism kicks in.

The Tech Support Caller (The Authoritative Stranger)

This one wears a uniform. The voice is calm, professional, helpful — representing a company you recognize and trust. There’s a problem with your computer, your account, your service. They need access to fix it, or payment to resolve it, or information to verify your identity.

The authority that comes from the company name, professional tone, and specific-sounding technical language is the entire mechanism. Legitimate tech companies do not make unsolicited calls about problems on your device. And a real warning on your screen will never tell you to call a phone number. If a pop-up locks your screen and says to call for help, close the browser or restart the computer.

The Familiar Voice (The Emergency Call)

The phone rings and it sounds like your grandson or your daughter, scared and in trouble. There’s been an accident or an arrest, they need money right now, and they beg you not to tell anyone. Scammers can now copy a person’s voice from a few seconds of video posted online, so the voice alone proves nothing.

Hang up and call your family member back on the number you already have for them. Many families now agree on a code word for emergencies, which a scammer won’t know.

The Fake Profile (The Long Game)

This is the disguise that takes the most patience to build and causes the most damage when it works.

A profile built from someone else’s photographs. A backstory that holds up to casual inspection. Weeks or months of genuine-seeming conversation, relationship-building, and earned trust — before the request appears. A financial emergency. An investment opportunity. A reason to share something personal.

The costume isn’t just the profile. It’s the entire relationship. That’s why these are so devastating: what gets betrayed isn’t just money or information but trust in something that felt real.

The Too-Good-To-Be-True Offer (The Shiny Costume)

Free money. Guaranteed returns. A prize draw you didn’t enter. A deal so good it’s hard to believe.

That difficulty in believing it? That’s your instincts working correctly. These offers come wrapped in urgency and exclusivity, and in the hope that this time it might be real.

How to See Through a Costume

The good news: most costumes have seams. Here’s where to look for fraying edges.

Slow down when you feel rushed. Real banks, government agencies, tech companies, and healthcare providers won’t threaten you or demand payment on the spot. That pressure is a manipulation technique, and pausing is how you beat it.

Check it yourself. If an email or message claims to be from your bank, your insurance company, your government agency — don’t click the link in the message. Open a new browser tab and go directly to the organization’s website. Call the number on the back of your card. No disguise survives a direct check.

Check where a profile photo came from. Search the internet using the photo itself (this is called a reverse image search). If an online contact’s profile photo appears on stock photo sites or attached to a different name, you’ve found the disguise. On a computer, right-click the photo and choose “Search image with Google.” On a phone, use Google Lens. It takes fifteen seconds. One caution: some scammers now use AI-generated faces that won’t show up anywhere else, so a clean search doesn’t prove someone is real.

Verify before you trust, especially for money or information. Any request for financial transfer, personal information, or account access from someone you’ve only known online — regardless of how long or how well you feel you know them — warrants verification through an independent channel before you respond. And if anyone asks you to pay with gift cards, a wire transfer, or cryptocurrency, stop. That request alone tells you it’s a scam.

Ask someone else. Scammers count on isolation. Asking a trusted person (a friend, a family member, or a digital coach at your library or community center) to look at something with you breaks the spell faster than almost anything else. If someone is pressuring you to act alone and quickly, that pressure itself is the red flag.

If It’s Already Happened

Sometimes people don’t know it happened at all. In our Cybersecurity Awareness Month post, we shared a story from our partner Family Services Association of San Antonio. A man came into their rural office for help getting his driver’s license, and staff noticed more than $3,000 was missing from his bank account. He had no idea he’d been scammed, and staff worked with him until he got his money back. Their question has stayed with us: how many others haven’t noticed yet? It’s worth checking your bank account regularly, even when nothing seems wrong.

Scammers are skilled, and being fooled is nothing to be ashamed of. If you clicked a link, shared information, or sent money: call your bank or card company right away using the number on the back of your card, change the password on any account involved (starting with your email), and report it at reportfraud.ftc.gov. 

If you paid with a gift card, call the company that issued the card right away; they can sometimes stop the money. If you shared personal information, such as your Social Security number, go to identitytheft.gov for a step-by-step recovery plan. If you’re not sure what to do next, ask a trusted person or a digital coach to help you work through it.

The Treats: What digitalLIFT Offers

Common Scams Workshop: A ready-to-teach workshop curriculum for libraries, senior centers, and community organizations. It walks learners through the most common online scams: what they look like, how they feel, and what to do when something seems off.

Internet Safety & Responsibility Curriculum: Free and classroom-ready, with an instructor guide, slides, handouts, and activities in English, Spanish, Chinese, and Tagalog. Pair it with our Teaching Internet Safety & Responsibility online course, or with Digital Navigators: Advanced for staff who support people who’ve been targeted.

DigiLotería Game Kit: A free bilingual (Spanish/English) Lotería game for teaching digital literacy, with 54 call cards, 35 boards, facilitator instructions, and a participant handout. Download the free kit.

Learning on your own? Ask for help from a digital coach, or try our self-paced tutorials at digitallift.org/resources.

One More Thing

The scariest part of Halloween isn’t the monster you can see. It’s the one wearing a familiar face.

The same is true online. The threats that do the most damage are not the ones that look dangerous. They’re the ones that look like your bank, your tech support team, your new friend, your big opportunity.

Knowing that is the costume coming off. Share this with someone who could use it.

Happy Halloween. Stay safe out there — online and off.

Resources mentioned:

Does your organization serve people who need this? digitallift.org

Further reading and sources: