Fake toll fines come by text, fake jobs come by email

Scammers pick the platform to match the story: a fake toll fine arrives by text or email, a fake romance arrives on social media, a fake IRS call arrives by phone, according to research from cybersecurity firm Malwarebytes. If a message about money, a job or a relationship appears on a platform that does not usually carry that kind of news, treat it as a warning sign rather than a coincidence.

Malwarebytes analyzed more than twenty types of scams over three months, from April 15 to July 14, 2026, using anonymized data from its own threat research systems. The pattern it found is consistent. Nine in ten toll scams, where someone poses as a toll-collection agency, arrive as an email or a text. Roughly six in ten romance scams begin on social media. Job scams favor email. Tech support scams usually come by phone.

The reason is not mysterious. Email already carries real news about work. Social media already connects strangers. A phone call lets someone walk a target through steps in real time, which a text cannot do as convincingly. Each scam has learned to use the channel that already carries that kind of message, so the first contact slips past a reader's guard before any content is even read.

This is what the data actually proves and what it does not. It shows where a given type of fraud is most likely to show up first. It does not show which of those channels produces the most completed scams, so a reader cannot conclude that text scams are more dangerous than phone scams, only that they are more common in that form.

The research also found a daily and weekly rhythm to scam texts. Volume peaked at noon Eastern Time, and rose across the week, with roughly 50% more fraudulent texts by Friday than at the start of the week. The report does not explain why, or whether people respond more at those times; it only shows when the messages were most prevalent.

Brand names did the same work as timing and channel. Google, Microsoft and Apple led the list of brands impersonated in reports from Malwarebytes users, followed by Roblox and Amazon. Among people impersonated, MrBeast ranked first, ahead of Elon Musk and Donald Trump, appearing in roughly 30% of the impersonation scams tracked, including fake cryptocurrency giveaways and schemes asking for an upfront payment.

None of this requires a person to be careless. It describes a sorting system: match the fraud to the channel a reader already trusts for that type of message, then dress it in a name a reader already recognizes. Flggd watches for exactly that combination, platform and identity used together, because it is the part of a scam that is built before a single message is sent.

Check a message

Received something like this? Paste it into the Flggd message checker before you reply, click or pay.