From fake tolls to romance scams: How fraudsters tailor their tactics to different platforms

A fake job offer will almost always show up as an email, while a supposed romantic interest is much more likely to make contact through social media. An IRS scam, meanwhile, will probably begin as a phone call.

Scammers are increasingly tailoring different types of fraud to different platforms, according to recent research from cybersecurity firm Malwarebytes.

The company analyzed more than 20 types of scams—scareware, fake giveaways, and sextortion, to name just a few—over three months, from April 15 to July 14, 2026. The findings are based on anonymized data collected through Malwarebytes’ threat research systems.

The report offers a revealing picture of how today’s scammers are targeting people, including which brands and celebrities they impersonate most often and when a fraudulent text message is likely to arrive.

Different scams, different platforms

The research found substantial differences in how and where scams first appear. For example, nine in ten toll scams, in which cybercriminals impersonate toll-collection agencies, showed up as an email or a text. Roughly six in ten romance scams appeared on social media. Job scams favored email, and tech support scams usually came by phone.

Across all the channels examined, the web remained the largest source of scams overall, followed by email and text.

These connections make intuitive sense. Email is a reasonable place to receive news and alerts about work opportunities. Social media connects people with strangers. A phone conversation gives someone claiming to offer technical help a chance to walk a person through instructions.

And while these patterns don’t show which channels produced the most successful scams, they do suggest why a given fraudulent approach might initially seem plausible: people grow accustomed to certain types of content on certain platforms, and scams can fit neatly into those existing expectations.

Scam texts have busy hours, too

 The volume of fraudulent text messages also varied considerably by time of day and day of the week.

Scam texts peaked at noon Eastern Time. They also rose from a Sunday low to a Friday high, with roughly 50% more fraudulent texts by Friday than at the start of the week.

The data does not explain those rhythms or establish whether people were more likely to engage at lunchtime or before the weekend, but it does show when fraudulent text messages were most prevalent.

Recognizable names, fraudulent messages

Scammers also used well-known brands and celebrities to make their messages look more credible.

Tech giants Google, Microsoft, and Apple led the brand rankings in reports from Malwarebytes users, followed by gaming platform Roblox and online retailer Amazon.

Among impersonated people, MrBeast ranked first, ahead of Elon Musk and Donald Trump. The YouTuber appeared in roughly 30% of the impersonation scams tracked in the research, including fraudulent cryptocurrency giveaways and schemes demanding an upfront payment.

The findings suggest that scammers are adapting their tactics to the platforms people use every day. Knowing where different scams are most likely to appear can make it easier to recognize them for what they are—and take the necessary steps to avoid them.

Sign up for the GASA newsletter to receive regular updates on scam prevention, research, and best practices. 

About the Author

Shahak Shalev is the Global Head of Scam and AI Research at Malwarebytes, where he leads efforts to understand and combat the evolving landscape of web-based threats. With a strong focus on leveraging cutting-edge technology to enhance cybersecurity, Shahak is committed to developing innovative solutions that safeguard consumer privacy and set new standards for data protection. A passionate advocate for online privacy and identity security, he continually pushes the boundaries of what’s possible in the fight against cybercrime.