The Momo Challenge urban legend – what on earth is going on?

Some ideas are so good at getting people to spread them that they go viral.

There doesn’t have to be any design, purpose or merit in an idea to make it spread. It doesn’t have to be good, interesting, helpful, useful or true, in fact it can even be a very bad, even harmful, idea. All it has to do to spread is trigger our urge to share it with others.

One way to do that is to trigger the deep, primal urge inside parents to protect their children (and the deep primal urge within online news outlets to scare parents for clicks). And, over the last week or so, that’s exactly what the an idea called the Momo Challenge has been preying upon.

This article is about why you shouldn’t worry about the Momo Challenge, how we got here, and what we can usefully take away from this situation.

I’ll start by looking at what the Momo challenge is and isn’t.

What is the Momo Challenge?

The Momo Challenge is a modern equivalent of a campfire-side horror story.

Its fifteen minutes of infamy began with a story about a “haunted” WhatsApp account with the name Momo and a very creepy picture of a woman’s distorted face for an avatar.

The avatar is actually a much-shared picture of a sculpture called Momo (Mother Bird), made by a special effects company and exhibited in the Vanilla Gallery in Tokyo, Japan. The photo is much more disturbing when it’s cropped to show only the Mother Bird’s human head, and that’s the picture most often associated with Momo.

Legend has it that users who attempted to contact the Spanish-speaking WhatsApp account were mostly ignored but occasionally rewarded with responses in the form of “insults … and disturbing images”.

In a July 2018 video called Exploring The Momo Situation, YouTuber ReignBot took a look at the challenge and concluded that, by mid-2018:

The Momo thing is much more akin to an urban legend right now … People are claiming what Momo is and what Momo does, but not that many people have actually interacted with the account. Finding screenshots of interactions with Momo is nearly impossible.

Viral ideas often start life in one form and only explode into our collective consciousness after mutating (perhaps just through endless retelling) into something more frightening, and that seems to be what’s propelled Momo too.

Over time the idea seems to have undergone two important mutations.

At some point what people mean by The Momo Challenge seems to have changed from a story about a WhatsApp account into a new name for a completely different urban legend called The Blue Whale Challenge.

The Blue Whale Challenge is a story about a game in which players have to perform acts of self harm, before winning the game by committing suicide.

In both cases it’s important to note that the phenomenon isn’t the game, which almost certainly never existed, but stories about the game, and stories about stories about the game.

The second, more recent mutation to the idea seems to have occurred in the last week: that the Momo Challenge is appearing in the middle of innocent YouTube videos about things kids like, such as Peppa Pig and Fortnite.

For parents like me, whose kids love watching YouTube videos, that’s a terrifying thought. But, like the previous incarnations of Momo, that terrifying thought is being triggered by hysterical stories and warnings about videos, not by actual harmful videos, for which there seems to be no evidence at all.

The one verifiably real thing in the whole Momo saga, which seems to have propelled the meme on its journey, is the unsettling picture of the Mother Bird’s head. It’s a creepy picture which, by itself, might be enough to scare children.

What should you do?

Please, now you know what Momo is, don’t spread the hoax, and think twice the next time you receive a similar warning. When situations like this occur it’s entirely understandable that people want to warn others, but it’s normally counterproductive.

For example, thanks to unfounded social media chatter and the ensuing wall-to-wall media coverage, children are now talking to each other about Momo in the playground, and the scary Momo picture is all over the internet (but not in this article – if you want to see it, take a look at Momo’s Know Your Meme page.)

Entirely because of those warnings there’s a now a good chance your children will see the picture, and you should probably talk to them about what it is, and what it’s not, before they do see it.

All the attention that Momo is getting also increases the chance of copycats, or of scammers using it in social engineering attacks on kids or parents.

As a general heuristic, I recommend that you treat all unsolicited warnings about specific computer security threats as hoaxes, unless they come from reputable computer security organisations. And, I recommend you focus on doing the basics right rather than worrying about how to deal with specific threats.

You and your children are at some risk from a wide variety of online dangers all the time. There are too many to deal with on a case-by-case basis and getting cybersecurity right isn’t about doing one thing, it’s a process.

When it comes to your children, that means knowing what they’re doing online.

What that looks like is going to vary from one family to another, but here’s what we do in our house, with children under ten:

My children have time-limited access to a Mac laptop with parental controls enabled. If they want to use the computer they have to ask, and they have to say what they’re going to do. Their access to messaging is limited to email, which is restricted to classmates and, since they’ve only just started to use it, has to be done with a parent, so we can teach them the dos and don’ts.

Their favourite activity of all is looking at YouTube videos (almost always about Minecraft) but they are only allowed to look at videos by authors we have vetted and subscribed to, and they have to do it in a room with a parent in it.

If you’ve used different rules successfully, particularly with older children, I’d love to read about them in the comments below.

For more on the Momo Challenge, take a look at yesterday’s Naked Security Live video about Momo, embedded below.

(Watch directly on YouTube if the video won’t play here.)