The 2026 Scam Playbook: Every Scam, Sorted by Channel

The 2026 Scam Playbook: Every Scam, Sorted by Channel

Between your alarm going off and your first cup of coffee, you'll probably get a text about a package you didn't order, a call from a "bank" you don't use, and a DM from someone who thinks you're gorgeous. Maybe all three land before 9am. Only one of them might be real, and it's rarely the one that feels most urgent.

Here's the thing about scams in 2026: the underlying con hasn't changed much. Someone wants your money, your login, or your trust, fast, before you have time to think. What's changed is the delivery system. A text scam and a phone scam and a DM scam all run on the same psychology, but they exploit different blind spots depending on where they land. So instead of one more "here are 10 scams to watch for" list, I built this as a reference: every active 2026 pattern, organized by the channel it actually shows up on, so you can check the right playbook the second something feels off.

This is the umbrella version. If you want the demographic breakdown of who's getting hit hardest, our Q1 2026 threat bulletin covers that. If you want the AI-specific deep dive, the 2026 AI scam tactics piece goes further into voice cloning and deepfakes than I will here. The 2026 trends roundup covers the big-picture shifts, and every sourced number we cite anywhere on the site lives on the 2026 scam statistics page. This post is the index — I'll refresh it as the channels shift.

Text Message Scams (Smishing)

Texts work because they're short, they arrive on the device you check constantly, and a fake alert competes directly with your real ones. The FTC's most recent breakdown found $470 million lost to text scams, five times higher than 2020 even though the number of reports actually declined — fewer people falling for it, but the ones who do lose more (FTC, April 2025).

The active patterns:

• Fake package delivery. "Your package couldn't be delivered, reschedule here." The FTC's own data flags this as the single most-reported text scam, and it works because you probably do have something in transit. We break down the package delivery scam texts in detail, including how to check a shipping link against the real USPS site.
• Fake fraud alerts. "Suspicious charge on your card — reply YES to confirm or NO to dispute." Either answer gets you a follow-up call from a fake "fraud department."
• Unpaid toll notices. A link claiming your E-ZPass or FastTrak balance is overdue, with a late fee attached to create urgency. See our toll road scam texts breakdown.
• Task scams. "Earn $200/day rating products from home," which starts with small real payouts to build trust, then asks you to front money into a crypto wallet to "unlock" bigger tasks.
• Wrong-number openers. A friendly "Hey, is this still available?" text to a stranger, designed to start a conversation that slowly turns into a romance or investment pitch.

Smishing is broad enough now that we keep a dedicated text message scams hub tracking every active variant. If a text like this lands in your phone, run it through our text scanner before you tap anything — it checks the link and the pattern against a live scam database instead of asking you to eyeball it.

Phone Call Scams

Calls are the oldest channel and still one of the costliest, because a live human voice creates pressure a text never can. Imposter scams — someone on the phone claiming to be your bank, the government, or law enforcement — hit a record $3.5 billion in reported losses in 2025, nearly triple 2020, and accounted for roughly one in three fraud reports the FTC received all year (FTC, June 2026). Bank impersonators pulled in the single highest losses of any imposter type; government impersonators accounted for about $920 million, up from $866 million the year before.

The active patterns:

• Fake bank fraud department. A call claiming to be your bank's security team, often using a spoofed number that matches the real one on the back of your card. We cover the exact script in our bank spoof call scam post.
• Fake law enforcement. A caller claims you missed jury duty or there's a warrant out, and the only way to avoid arrest is an immediate payment. See how scammers impersonate police.
• The AI-cloned family emergency call. A voice that sounds exactly like your kid or grandkid, built from three seconds of public audio, calling in a panic about bail money. We go deep on this one in the grandparent emergency scam post.
• Tech support cold calls. A "Microsoft" or "Apple" rep claims your computer is compromised and needs remote access to fix it.

Real banks, courts, and government agencies do not ask you to confirm a full account number or pay a fine over the phone during the same call that raised the alarm. If a call like this pressures you, hang up and call back on a number you already have — not one the caller gives you.

Email Scams

Email scams have gotten harder to spot because the old advice — check for typos, bad grammar, generic greetings — stopped working once AI started writing the messages. The costliest version by dollar amount is business email compromise: the FBI's 2025 Internet Crime Report put BEC losses at over $3 billion, part of the record $20.9 billion in total losses the report tracked across just over 1 million complaints (FBI IC3 2025 Annual Report).

The active patterns:

• CEO fraud / wire transfer requests. An email that looks like it's from your boss, urgent, asking accounts payable to move money to a "new vendor." We wrote the full playbook on business email compromise, including the one policy that stops it cold.
• Fake DocuSign envelopes. A "document awaiting signature" email that leads to a credential-harvesting login page.
• Inheritance and unclaimed-funds emails. A "law firm" claims a distant relative left you money, and you just need to cover a small fee to release it. Full breakdown in our inheritance scam post.
• Fake invoices and subscription renewal notices. A convincing "your subscription is about to renew for $499" email with a phone number to call and "cancel" — the number connects you to a scammer, not the company.

If you're not sure whether an email is real, check it against our phishing guide or scan it directly. For anyone handling money on behalf of a business, a hardware security key closes the exact hole most email account-takeovers exploit — a phished password alone can't get past it. We keep a YubiKey 5C NFC on hand for exactly this reason.

Social Media & DM Scams

This is the channel that grew the fastest, and by far the most expensive one per dollar reported. The FTC's April 2026 data found $2.1 billion lost to scams that started on social media in 2025 — an eightfold increase since 2020, and more money than any other contact method scammers use (FTC, April 2026). Nearly 30% of everyone who reported losing money to a scam last year said it started on a social platform. Investment pitches accounted for $1.1 billion of that total — more than half — and 60% of people who lost money to a romance scam said it began on social media. Facebook produced more reported losses than any other platform, with WhatsApp and Instagram trailing behind.

The active patterns:

• Fake ads for products that don't exist. Clothes, gadgets, even puppies, advertised through a slick social ad that leads to a site that takes your payment and ships nothing. See fake ad scams on Facebook and TikTok.
• Impersonated profiles. A cloned account using a real person's photos, messaging their friend list asking for a "quick loan." Covered in our social media impersonation guide.
• Romance-to-investment pipelines. A dating-app or DM connection that moves the conversation to a "friend's amazing crypto platform" once trust is built.
• AI chatbot romance accounts. Profiles that respond instantly, remember every detail, and never run out of patience — because there's no person on the other end. This overlaps heavily with AI scams more broadly, since the tell (unnaturally perfect, always-available conversation) is the same one showing up in voice-clone calls and AI-written emails.

The near-universal script on this channel: build rapport, then ask to move the conversation off-platform to WhatsApp or Telegram, where there's no fraud-detection team watching. If someone you just met online is in a hurry to leave the app you met on, that's the scam announcing itself.

Marketplace & Online Shopping Scams

Shopping scams overlap heavily with the social channel above — more than 40% of people who lost money to a social media scam in 2025 said it started with an ad for something they wanted to buy, from clothes to car parts to, yes, puppies that turned out not to exist (FTC, April 2026). But it also shows up independently on marketplace apps and search results.

The active patterns:

• Fake online stores. A slick storefront, often built to impersonate a real brand or mimic a small boutique, that vanishes after payment clears. We cover the checklist in how to spot fake online stores.
• Marketplace payment redirects. A "buyer" or "seller" on Facebook Marketplace or Craigslist asks you to complete payment outside the platform's protection — Zelle, Venmo, or a wire — right before the deal falls apart. Details in online marketplace payment scams.
• Fake breeder and pet adoption sites. A specific, cruel version of the fake-store pattern that preys on people wanting a family pet. Full field guide at puppy scams in 2026.

The fix here is boring but effective: pay through the platform's built-in protection, never a "friends and family" transfer to a stranger, and check a new seller's account age and reviews before you commit.

The Tells That Cross Every Channel

However the scam reaches you, a handful of signs show up almost every time:

• Manufactured urgency. "Act now," "final notice," "your account will be closed today." A real deadline rarely requires you to decide in the next ten minutes.
• A payment method that can't be clawed back. Gift cards, wire transfers, crypto, and payment apps sent to a stranger all share one feature scammers love: once it's gone, it's gone.
• A request to leave the platform you're on. Dating apps, marketplaces, and job boards all run fraud detection. A private chat has none, which is exactly why scammers push you there.
• A demand for secrecy. "Don't tell your bank," "don't tell your spouse," "keep this confidential." Real institutions don't need your silence.
• Something that sounds or looks exactly right, but shouldn't. Caller ID that matches, a voice that sounds like family, a photo that looks legitimate — spoofing and AI generation have made all three fakeable, which is the throughline connecting the AI scam variants showing up across calls, emails, and DMs alike.
• A second "authority" joining to add pressure. A fake lawyer, officer, or supervisor who shows up mid-conversation to vouch for the story is a scripted escalation, not a coincidence.

If This Already Happened to You

Stop responding, but don't delete anything yet. Screenshot the messages, the sender's number or profile, and any payment confirmation before you block them — you'll want that record. Report it to the FTC at reportfraud.ftc.gov and, if money moved, to the FBI's IC3 at ic3.gov within 24 hours; fast reporting is sometimes the difference between a frozen wire and a gone one. If you shared your SSN, card number, or login credentials, freeze your credit with all three bureaus and change the affected passwords immediately. And tell someone — a family member, a friend, your bank. Shame is the one thing every scammer on this list is counting on to keep you quiet, and quiet is what lets the same operation find its next target. Our full reporting guide walks through exactly who to contact and in what order.

How to Not Become Next Month's Statistic

None of this requires new software or a security degree. It requires a habit: verify through a channel you started, not one the message gave you. If your "bank" texts, hang up and call the number on the back of your card. If your "boss" emails a wire request, call them on the line you already have. If a new online connection wants to move off the app fast, that's your answer already. And when something still feels ambiguous, run it through Cautellus before you act on it — a second, unemotional check on a text, email, link, or screenshot, in the time it takes to second-guess yourself.

FAQ

What's the single most common way scammers reach people right now? Social media, by dollar amount and by report share. The FTC's 2026 data puts $2.1 billion in losses and nearly 30% of all scam-loss reports starting there — more than phone, text, or email individually.

Are phone scams or text scams more dangerous? Different math. Text scams reported $470 million in losses on their own, but a huge share of "phone" losses are counted under the broader imposter-scam category ($3.5 billion), which includes calls that start with a text or email lead-in. Treat both as equally live threats rather than ranking them.

Why do scammers always want me to switch to a different app? Because the app you met them on — a dating app, a marketplace, a job board — runs fraud detection that can flag and remove them mid-conversation. A private chat app has no referee watching, which is the entire appeal for them.

Can I trust caller ID or a familiar-sounding voice in 2026? No, not on its own. Caller ID spoofing is trivial, and voice cloning needs only a few seconds of audio to fake someone you know. Verify through a callback on a number you already have, every time money or personal information is involved.

What's the fastest way to check if something's a scam before I respond? Don't rely on gut feeling alone. Paste the text, email, or link into Cautellus's scanner, which checks it against a live database of confirmed scam patterns rather than asking you to spot the tell yourself.

How often does this playbook get updated? This page tracks active 2026 patterns by channel and gets refreshed as the landscape shifts — new variants get added, retired ones get trimmed. Bookmark it rather than a single scam post if you want the current state of play.

Sources: FTC Consumer Sentinel Network (text scams, imposter scams, and social media scam press releases, 2025-2026 data), FBI Internet Crime Complaint Center 2025 Annual Report.

Scammers only need one channel to work. You only need to know which playbook to check.