If your phone seems to light up with suspicious texts right when your day gets busy, you may not be imagining it. New research from cybersecurity company Malwarebytes suggests scammers have gotten much more strategic about when they contact you and where they do it.
The company analyzed global threat data collected between April 15 and July 14, 2026. Researchers tracked more than 20 scam categories. They found that criminals often choose the platform that gives a particular scam the best chance of working.
Then there is the timing. For Americans, scam text volume peaked around 12 p.m. ET. That was about 874% higher than at 1 a.m. ET, the quietest hour Malwarebytes observed. Scam text volume also climbed as the week went on. It reached its highest point on Friday, when people received roughly 50% more fraudulent texts than at the beginning of the week.
That tells me scammers are paying attention to more than what they send you. They are also watching when you may be most likely to see it. And the timing is only part of the strategy, because the type of scam often determines exactly where they try to reach you.
THE SCAM TEXT TEST: SPOT DANGER BEFORE YOU TAP
NEW! Join our upcoming CyberGuy LIVE class: Get Better Healthcare With AI
In this free live online class, Kurt “CyberGuy” Knutsson will show you five practical ways AI can help you take a more active role in your healthcare. You’ll learn how to organize your health history, remember important appointment details, understand complicated medical information, research prescriptions and prepare questions for your next doctor’s visit. No technical experience is needed.
Register for free now at CyberGuyLive.com.
Different scams tend to favor different platforms. Malwarebytes found that job scams commonly arrive through email. Romance scams favor social media, where conversations with new people feel more natural. Meanwhile, tech support scams frequently start with a phone call. That makes sense when you think about how each scam works.
A fake recruiter can blend into a busy inbox. Someone starting a conversation on social media may seem harmless. A caller claiming your computer has a serious problem can immediately put you under pressure.
The channel becomes part of the trick. We’ve seen that with changing tech support scams. They can now begin with fake invoices, bogus security alerts or convincing support pages.
You hear plenty about scam texts and suspicious DMs. However, the web remains the leading way scams reach people in Malwarebytes’ data. Email came next, followed by SMS.
Malwarebytes says it blocks around 500,000 phishing websites every day. That number gives you an idea of how many fake pages criminals keep pushing online.
Some copy banks or popular retailers. Others imitate technology companies or government services. A link in a text can take you straight to one of these pages. The fake site may look polished enough to fool you at first glance.
So, when a message says something has gone wrong with an account, resist the urge to use the link it provides. Open the company’s app yourself or type the website address directly into your browser.
Here’s the part that really caught my attention. Malwarebytes found that scam texts targeting Americans reached their highest volume around 12 p.m. ET. At noon, volume was about 874% higher than at 1 a.m. ET. Think about what your phone habits look like around lunchtime.
You could be leaving a meeting, grabbing something to eat or checking messages between errands. Your attention may already be split. Then a text arrives saying your package cannot be delivered. Another claims you owe a toll. Maybe a message warns that somebody accessed your account. That timing can work in a scammer’s favor because you may react before giving the message a closer look.
Of course, a text arriving at noon does not automatically mean somebody is trying to scam you. The data shows when Malwarebytes observed the highest volume. Still, the pattern gives us another look at how organized scam campaigns have become.
IS THAT TRAFFIC TICKET TEXT A SCAM OR REAL?
The day of the week also appears to play a role. Malwarebytes saw its lowest scam text volume on Sunday. Activity then increased as the week went on. By Friday, people were receiving roughly 50% more fraudulent texts than at the beginning of the week.
The researchers cannot say exactly why Friday produced the highest volume. However, the pattern suggests scammers may be deliberately timing campaigns instead of sending messages at random.
Maybe you’re finishing work and thinking about the weekend. You could also be juggling deliveries, travel plans or bills. Whatever the reason, criminals want you moving quickly.
That’s something we’ve seen repeatedly with fake government messages. A DMV scam text can threaten fines or license problems while pushing you toward a payment page. The threat gets your attention. The deadline tries to stop you from thinking.
Timing gets the message in front of you. Familiarity can make you trust it. Malwarebytes found that Jimmy Donaldson, better known as MrBeast, was the most impersonated person in its data. His likeness appeared in about 30% of impersonation scams observed by the company.
Elon Musk and Donald Trump followed him in the data. These scams can involve fake cryptocurrency giveaways or schemes that demand a fee before you supposedly receive money. The real person has nothing to do with the offer.
Scammers borrow a face you recognize because familiarity can lower your guard. That tactic has become even more troubling as AI-generated video and cloned voices improve. A face on your screen no longer proves the person actually made the video.
Scammers use the same strategy with companies you recognize. According to reports from Malwarebytes users, the five most impersonated brands were: Google, Microsoft, Apple, Roblox and Amazon.
Google’s name appeared at least twice as often as Amazon’s. That familiarity gives criminals a huge advantage. If you use Google every day, a fake security warning may look routine. An Apple customer may react quickly to a message about an account problem.
Amazon scams can land at exactly the right moment because so many of us regularly have packages on the way. So, treat the logo as decoration until you verify the message yourself.
Gaming communities are also attracting scammers. Malwarebytes found Roblox, Steam, Discord and Minecraft among the most impersonated gaming platforms.
Roblox scam activity increased 15% between mid-June and mid-July. Steam saw a 19% increase during the same period. The potential losses can also get serious.
Malwarebytes says about half of the gaming scams it analyzed could lead to losses of $1,000 or more. That is particularly concerning when younger gamers may encounter fake offers through communities they already trust.
A message promising free in-game items or access to something exclusive can quickly lead to a fake login page. Once the victim enters a password, the scammer may take over the account.
AMAZON JOB SCAM TEXTS ARE SPREADING AGAIN WITH A NEW TWIST
Scammers can improve their timing, but you can make yourself a much harder target. The best defense starts with slowing down and verifying what you see.
Avoid links and phone numbers inside unsolicited emails, texts or social media messages. A link can take you to a copied website designed to steal your login or payment information. Likewise, the phone number in a fake security alert can connect you directly to the scammer. Instead, leave the message and contact the company another way.
Go directly to the company’s official website or open its app. If the message claims you owe money, check your real account before paying anything. You can also contact the organization using a phone number you already trust. This breaks the scammer’s control over the conversation.
Searching for a company’s website can help, but pay close attention to what you click. Scammers can use sponsored search ads that lead to fake support pages or convincing copies of legitimate websites. Check the web address before entering sensitive information. When possible, use a saved bookmark or the company’s official app.
Never give someone your password because they called or messaged you unexpectedly. The same goes for PINs, account recovery codes and one-time verification codes. A scammer may claim they need a code to verify your identity. In reality, that code may give them access to your account. If a caller asks for sensitive information, hang up and contact the organization yourself.
Be suspicious when an unexpected caller or message demands immediate payment. Before paying, confirm the charge through your actual account or by contacting the organization independently. Watch closely for payment requests involving gift cards, cryptocurrency or transfers that may be difficult to reverse. Urgency should make you more cautious, not less.
Strong antivirus software can help block known phishing sites and other malicious pages. Browser protection can also warn you before you enter information on a dangerous website. Keep your browser updated as well. Security updates help close weaknesses that criminals may try to exploit. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.
Your phone may already include tools that identify suspicious calls or messages. Turn on spam filtering when your device and messaging app support it. Mobile security software can provide another layer of protection by identifying scam texts and dangerous links. No filter catches everything, so continue checking unexpected messages yourself.
If something feels wrong, look into it before you reply. Search for the company’s official contact information. Check your account directly. You can also use a reputable scam-checking service to examine a suspicious phone number, message or link. The goal is simple. Verify the claim somewhere outside the conversation the scammer started.
Once you know a message is fraudulent, block the sender and report it as spam. Most phones and email services include built-in reporting options. Reporting scams can also help providers identify campaigns and block similar messages for other users. Then delete the message so you do not accidentally interact with it later.
If you entered a password on a suspicious site, change it immediately using the real website or app.
Change that password anywhere else you reused it. Better yet, use a password manager to create and store strong, unique passwords for each account so one stolen password cannot unlock several accounts.
If you gave away payment information, contact your bank or card issuer right away.
You should also review your accounts for unfamiliar activity.
If a scammer gained access to your device, disconnect it from the internet and run a trusted security scan.
What grabs me about this research is how deliberate scam campaigns are becoming. Scammers are paying attention to where you spend your time. Now, the timing data suggests they may also be watching when you’re more likely to respond. That changes how I think about those random-looking texts that pop up during a busy day. The message may feel like one more thing that needs your attention. That’s exactly when you need to slow down. You cannot control when a scammer contacts you. You can control whether that person gets to set the pace. When something unexpected asks for money or account information, get out of the message. Find the real company on your own and check the claim there. That small pause can ruin a scammer’s entire plan.
Have you noticed more scam texts arriving around lunchtime or toward the end of the week, and what kind of message almost fooled you into responding? Let us know by writing to us at CyberGuy.com.
Sign up for my FREE CyberGuy Report
Copyright 2026 CyberGuy.com. All rights reserved.
