Scam texts have a “rush hour:” Fraudulent texts peak around noon ET and are roughly 50% more common on Fridays than at the beginning of the week.
Different scams favor different channels: Toll scams often arrive by text or email, while IRS and tech-support scams are more likely to come by phone.
Don’t let familiar timing or brands fool you: Scammers use normal business hours and trusted names like Google, Apple, and Amazon to make messages seem legitimate.
Scammers apparently keep something resembling business hours.
New research from Malwarebytes found that fraudulent text messages in the U.S. aren't arriving randomly. They surge during daytime hours, peak around noon ET, and become increasingly common as the workweek progresses.
Friday is particularly busy
Malwarebytes found consumers receive roughly 50% more fraudulent texts on Fridays compared to the beginning of the week. Specifically, around noon ET, scam-text volume was about 874% higher than at 1 a.m.
But the bigger takeaway isn't simply to be suspicious of your phone around lunchtime on Friday.
The research suggests scammers are getting smarter about where they approach you, matching different scams with communication channels where they're more likely to seem legitimate.
Here's what to watch for.
Scam texts peak around lunchtime
Malwarebytes analyzed global threat data collected between April 15 and July 14, 2026, and found a clear pattern in the timing of these scam text messages.
In the U.S., scam texts were least common in the early-morning hours and climbed as Americans started their day, peaking around noon ET.
The takeaway for consumers is that just because you get a text during normal business hours doesn’t mean it’s legitimate. Scammers know you’re more likely to have your guard down during the day, compared to getting a text message at 11 p.m., when the timing alone immediately raises suspicion.
If a message says you owe a toll, have a package problem, or need to take immediate action on an account, don't click the link. Open the company's app or type its website into your browser yourself.
Pro tip: Slow your roll whenever a message combines urgency messaging with money. “Pay today,” “your account will be suspended,” “your package can't be delivered,” and “final notice” are all designed to get you acting before you start asking questions.
Different scams favor different places
Perhaps the most useful finding is that different scams tend to favor different communication channels.
For example, a whopping nine out of 10 toll scams arrive through text or email, according to Malwarebytes.
In contrast, IRS and tech-support scams are much more likely to reach consumers by phone. Romance scams favor social media, while job scams commonly arrive through email.
That's important because the communication method can make the scam seem more believable. An email from a supposed recruiter doesn't feel strange. Neither does a social-media message from someone who wants to get to know you or a text claiming there's a problem with a package.
Pro tip: When you're contacted unexpectedly, switch channels before responding. If your bank texts you, open its official app. If a company calls, hang up and call the number on its official website or the back of your card. If a recruiter emails you, visit the company's careers page and see if the job actually exists.
Don't trust the logo
Scammers also lean heavily on familiar brands.
The five most impersonated brands in Malwarebytes' data were Google, Microsoft, Apple, Roblox, and Amazon.
Seeing a familiar name tends to lower your defenses, especially when the message matches what that company normally sends, like an Amazon delivery notification or Google security alert.
Treat the logo and company name as part of the sales pitch, not proof that the message is authentic.
Give yourself 30 seconds
Before clicking, paying, or replying to an unexpected message, ask yourself these three questions:
Was I expecting this?
Is it creating urgency?
Can I verify it another way?
And don't assume you're safe because it's Tuesday or 2 a.m. Scams can absolutely arrive at any time.
The Malwarebytes data simply suggests scammers are getting better at figuring out when and where you're most likely to respond.