Scam texts are getting smarter, louder, and more strategic, with new data showing they hit hardest around lunchtime and often spike late in the week. Researchers also found that criminals choose different channels for different cons, lean on familiar names to build trust, and keep pushing victims toward fake pages that look legitimate at first glance.
New analysis from Malwarebytes looked at global threat activity collected between April 15 and July 14, 2026, covering more than 20 scam categories. The big takeaway is simple: scammers are not spraying random messages and hoping for the best, they are matching the scam to the platform and the moment that gives them the best shot at getting a click.
For Americans, scam text volume peaked around 12 p.m. ET, which was roughly 874% higher than at 1 a.m. ET, the quietest hour in the data. The numbers also climbed steadily through the week, then reached their highest point on Friday, when people were getting about 50% more fraudulent texts than at the start of the week.
That timing matters because it catches people when attention is already split. Lunch breaks, meeting changes, errands, and half-finished tasks all create a perfect opening for a message that feels urgent enough to tap before thinking twice.
Different scams also keep showing up where they work best. Job scams tend to arrive in email, romance scams often live on social media, and tech support scams frequently begin with a phone call, which lines up with the way each trick is designed to pull someone in.
A fake recruiter can hide in a crowded inbox. A social media message can feel casual and harmless. A caller insisting your device is at risk can create panic in seconds, and that pressure is often the real bait.
The web is still the biggest doorway for scammers in the report, followed by email and then SMS. Malwarebytes says it blocks around 500,000 phishing websites every day, a reminder that fake pages are still being churned out at an aggressive pace.
Those pages often copy banks, retailers, tech companies, and government services with enough polish to fool someone who is rushing. A text may point to one of those sites, but the smart move is to ignore the link and go straight to the company’s app or type the address yourself.
Scammers also know that familiar names lower defenses fast. Malwarebytes found that MrBeast was the most impersonated person in its data, showing up in about 30% of impersonation scams, with Elon Musk and Donald Trump following behind.
Those impersonation schemes usually lean on fake crypto giveaways, made-up prize offers, or demands for a fee before a payout is supposedly released. The person in the video or message has nothing to do with the offer, but the name or face is there to make the scam feel credible.
That same tactic shows up with brands people use every day. Google, Microsoft, Apple, Roblox, and Amazon were the most impersonated companies in the data, and Google appeared at least twice as often as Amazon.
It is easy to see why that works. A fake security alert from a company you already trust can feel routine, and an Amazon scam can seem believable when a package is actually on the way. The logo may look official, but that does not make the message real.
Gaming is another big target, especially for younger users and communities that move fast. Malwarebytes saw Roblox, Steam, Discord, and Minecraft among the most impersonated gaming platforms, with Roblox scam activity up 15% and Steam up 19% over a short stretch.
Some of those scams can be costly too, with about half of the gaming scams in the study capable of leading to losses of $1,000 or more. Free items, exclusive access, and urgent account warnings are all classic hooks that can land victims on a fake login page in a hurry.
The best defense is still the old-school one: slow down and verify. Do not click unexpected links, do not trust phone numbers inside a suspicious message, and do not hand over passwords, verification codes, or payment information to someone who contacts you out of nowhere.
It also helps to check messages outside the conversation where they appeared. Open the real app, use a saved bookmark, call a trusted number you already have, and keep an eye out for sponsored search results that can lead to lookalike support pages.
On top of that, spam filters, browser protection, and security software can catch a lot of trouble before it reaches you. If something already slipped through, changing passwords fast, reviewing accounts for strange activity, and blocking the sender can make the damage much smaller.
