Scammers are employing increasingly sophisticated strategies, including targeting specific times of day and days of the week to maximize the impact of fraudulent text messages, according to research from cybersecurity firm Malwarebytes. The analysis of global threat data from April 15 to July 14, 2026, revealed that criminals are strategic about both the platforms they use and the timing of their outreach.
For individuals in the United States, the volume of scam texts surged around 12 p.m. Eastern Time, reaching approximately 874% higher than during the quietest hour of 1 a.m. ET. The frequency of these messages also increased as the week progressed, with Fridays showing about 50% more fraudulent texts compared to the beginning of the week. This pattern suggests scammers are paying close attention to when individuals are most likely to be busy, distracted, and therefore more susceptible to acting on a message before thoroughly examining it.
The platform used for a scam often depends on the nature of the fraudulent activity. Job scams, for instance, frequently appear via email, while romance scams are more common on social media platforms. Tech support scams, on the other hand, often initiate with phone calls, leveraging the pressure and urgency that such direct contact can create.
Despite the prevalence of scam texts and suspicious direct messages, the web remains the primary channel for scams. Malwarebytes reports blocking around 500,000 phishing websites daily, highlighting the extensive efforts criminals undertake to create deceptive online presences. These fake websites often mimic legitimate services from banks, retailers, technology companies, or government agencies, aiming to trick users who click on links provided in scam messages. Researchers advise users to avoid clicking links in unsolicited messages and instead navigate directly to official websites or use company apps to verify any claims.
The research also identified the individuals and brands most frequently impersonated in these scams. Internet personality Jimmy Donaldson, known as MrBeast, was the most impersonated person, appearing in about 30% of impersonation scams analyzed. Other frequently impersonated public figures included Elon Musk and Donald Trump. In terms of brands, Google led the list of impersonated companies, followed by Microsoft, Apple, Roblox, and Amazon. The familiarity of these brands and individuals can lower a person's guard, making them more vulnerable to schemes involving fake giveaways or requests for fees before supposed money transfers.
Gaming platforms are also becoming a significant target for scammers, with Roblox, Steam, Discord, and Minecraft being among the most impersonated. Malwarebytes noted a 15% increase in Roblox scam activity and a 19% increase for Steam between mid-June and mid-July 2026. The potential financial losses from these scams can be substantial, with roughly half of the analyzed gaming scams having the potential to lead to losses of $1,000 or more. These scams often promise in-game items or exclusive access, luring users to fake login pages where their account credentials can be stolen.
To combat these evolving tactics, Malwarebytes suggests several protective measures. These include avoiding clicking links in unexpected messages, verifying communications through official channels, being cautious with sponsored search results, keeping passwords and verification codes private, and never sending payments under duress. Utilizing browser protection against scam sites and enabling scam and spam filtering on mobile devices can provide additional layers of security. Reporting fraudulent messages and blocking senders also helps providers identify and mitigate ongoing campaigns.
In cases where a user has already clicked on a suspicious link or shared information, immediate action is crucial. This involves changing passwords on affected and reused accounts, contacting financial institutions to report compromised payment information, and reviewing accounts for unauthorized activity. If a device is believed to be compromised, disconnecting it from the internet and running a security scan is recommended.