Malwarebytes, which specializes in real-time cyber protection, has released new research showing how criminals are tailoring specific scam types to the platforms where they are most likely to succeed.
Nine in ten toll scams, the fake unpaid-toll messages that threaten fines or license suspension, arrive by email or text, while roughly six in ten romance scams play out on social media.
The findings draw on global data from Malwarebytes threat research systems. Malwarebytes analyzed more than 20 distinct scam types, from tech support and refund scams to sextortion and scareware, and found that each one favors a specific delivery channel.
“Scammers are getting more deliberate about where and when they reach people,” said Shahak Shalev, Global Head of Scam and AI Research, Malwarebytes. “Certain scams work better on certain platforms, at certain moments, and scammers repeat what works. Knowing where and when particular scams are most likely to appear can help people recognize them before they engage.”
Here are key findings from the report:
- Every scam type has a preferred platform. Fake giveaway scams are far more likely to arrive through a social media feed than by email or text. Half of all IRS scams come by phone call. Job scams favor email, while romance scams mostly arrive through social media, and tech support scams mostly favor phone calls.
- The web is still the biggest hunting ground. Despite the rise of social media and messaging apps, scams are reaching us through the web more than any other platform, followed by email and SMS.
- MrBeast is the most impersonated person, ahead of Elon Musk and Donald Trump. MrBeast appears in roughly 30% of impersonation scams tracked by Malwarebytes, ranging from crypto giveaways to transfer-fee swindles. Elon Musk ranks second and Donald Trump ranks third.
- Noon ET is the “golden hour” for scam texts. Malwarebytes data shows scam text volume peaks at 12 p.m. ET, roughly 874% busier than the quietest hour, 1 a.m. ET.
- Scam texts build all week and peak on Fridays. Volume rises steadily from a low point on Sunday, and by Friday, people receive roughly 50% more fraudulent text messages than they did at the start of the week.
- Scammers favor the world’s best-known brands. Based on reports from Malwarebytes users, Google, Microsoft, Apple, Roblox, and Amazon are the five most impersonated brands, in that order. Google’s name appears in scam content at least twice as often as Amazon’s name.
- Gaming platforms are an increasingly popular target. Roblox, Steam, Discord, and Minecraft were the most impersonated gaming platforms. Roblox saw a 15% spike in scam activity from mid-June to mid-July, and Steam saw a 19% spike over the same period.
- One in five flagged sessions is high-risk. Malwarebytes Scam Guard, which checks messages, phone numbers, texts, social media messages and links against its threat intelligence database, flags approximately one in five analyzed sessions as high-risk, meaning they could lead to a loss of at least $1,000 or other personal harm.
How to spot and stop scams
Malwarebytes recommends the following steps to reduce risk:
- Do not click links or call phone numbers in unsolicited emails, texts, or social media DMs.
- When in doubt, verify a message’s legitimacy by going directly to the company’s official website and contacting it through official channels. Do not follow sponsored search results to get there, since these can be scams.
- Never share personal details, PINs, passwords, payment information, or verification codes during an unsolicited call. Legitimate companies will not ask for passwords or verification codes over the phone. Hang up and call back using the organization’s official phone number.
- Use a browser extension that blocks scam and phishing sites, such as Malwarebytes Browser Guard, which can flag a fake storefront before a user lands on it.
- Install a mobile security product that filters out scam and spam text messages like Malwarebytes Mobile Security alongside comprehensive security with real-time protection for your desktop.
- Check whether a message is legitimate with Malwarebytes Scam Guard, which analyzes any content, message, phone number, text or link against its threat intelligence database and provides information on red flags and recommended next steps.
Methodology
The data in this report comes from Malwarebytes proprietary threat research systems, collected between April 15 and July 14, 2026. All data is anonymized and reflects what Malwarebytes is able to observe through its own infrastructure.
To read more about the latest threats and cyber protection strategies, visit the Malwarebytes blog, or follow us on Bluesky, Facebook, Instagram, LinkedIn, TikTok, Reddit, and X.
I hope you’ll help support Apple World Today by becoming a patron. Almost all our income is from Patreon support and sponsored posts. Patreon pricing ranges from $2 to $10 a month. Thanks in advance for your support.
Article provided with permission from AppleWorld.Today