Your busy hour is their hour

If suspicious texts seem to arrive right when your day gets hectic, that is not your imagination. Malwarebytes research says scammers have gotten strategic about when and where they reach you.

Three months of threat data

Malwarebytes analyzed global threat data from April 15 to July 14, 2026, tracking more than 20 scam categories to see which platforms and moments criminals favor.

Noon is the spike

Scam text volume aimed at Americans peaked around 12 p.m. ET. That was roughly 874% higher than at 1 a.m. ET, the quietest hour in the data.

“scam text volume peaked around 12 p.m. ET”

Friday is the worst day

Volume was lowest on Sunday and climbed through the week. By Friday, people got about 50% more fraudulent texts than they did at the start.

The channel is part of the con

Job scams mostly arrive by email. Romance scams favor social media, where meeting strangers feels normal. Tech support scams usually start with a phone call.

“The channel becomes part of the trick.”

Why each channel works

A fake recruiter blends into a crowded inbox. A friendly social media stranger seems harmless. A caller warning about your computer puts you under pressure immediately.

The web is still the front door

Despite all the talk about scam texts and shady DMs, the web was the leading way scams reached people in the data. Email came second, SMS third.

Half a million fake pages a day

Malwarebytes says it blocks around 500,000 phishing websites daily. Some copy banks or retailers, others imitate tech companies or government services.

“Malwarebytes says it blocks around 500,000 phishing websites every day.”

Never use the link provided

When a message claims something went wrong with an account, skip its link. Open the company's app yourself or type the web address into your browser.

Lunchtime splits your attention

You are leaving a meeting or grabbing food when a text says a package cannot be delivered, a toll is unpaid, or someone accessed your account. You react before you look closely.

“That timing can work in a scammer's favor”

Deadlines stop you thinking

Fake government messages lean on the same trick. A DMV scam text threatens fines or license trouble, then pushes you to a payment page before you can pause.

“The threat gets your attention. The deadline tries to stop you from thinking.”

MrBeast tops the fakes

Jimmy Donaldson, known as MrBeast, was the most impersonated person in the data, appearing in about 30% of impersonation scams. Elon Musk and Donald Trump followed.

A face proves nothing now

These schemes push fake crypto giveaways or upfront fees for money you never receive. With AI video and cloned voices improving, a familiar face on screen is not evidence.

“A face on your screen no longer proves the person actually made the video.”

Google leads the fake brands

The five most impersonated brands, per Malwarebytes users, were Google, Microsoft, Apple, Roblox and Amazon. Google's name showed up at least twice as often as Amazon's.

“treat the logo as decoration until you verify the message yourself”

Gaming is the new target

Roblox, Steam, Discord and Minecraft were among the most impersonated gaming platforms. Roblox scam activity rose 15% and Steam 19% between mid-June and mid-July.

A thousand dollars, easily

About half the gaming scams analyzed could cost victims $1,000 or more. A promise of free in-game items leads to a fake login page, then a stolen account.

Verify outside the message

Contact the company through its official app, a saved bookmark or a number you already trust. Watch sponsored search ads too, since those can lead to convincing fakes.

“This breaks the scammer's control over the conversation.”

Guard codes like cash

Never hand over a password, PIN, recovery code or one-time verification code to someone who contacted you first. That code may be the key to your account.

Pressure means slow down

Treat demands for immediate payment as a red flag, especially gift cards, crypto or transfers that are hard to reverse. Turn on spam filtering, then block and report what gets through.

“Urgency should make you more cautious, not less.”

If you already clicked

Change the password on the real site and anywhere you reused it. Call your bank if you shared payment details. If your device was reached, disconnect it and run a security scan.