Scam wave report · Edition 8 · September 15, 2026 · 8 net-new patterns

This Week's Scam Wave, in Numbers

This week’s wave bolts each lie onto something that actually happened: AI-cloned car dealership sites selling rare cars wire-transfer-only, a “prove you’re human” CAPTCHA trick that can tunnel into your whole network, jail-roster bail scams timed to real arrests, and Dolly Parton memorial fraud live within two hours of her death — eight net-new patterns, each verified against public warnings and linked to its full verdict page with the exact script.

Scam Detective research desk · Published September 15, 2026

Got one of these in your hand right now?

Paste the link, number, or sender into the instant check — free risk signal in 60 seconds, the full 0–100 report for $2, one-time.

Check a suspicious link — $2

Net-new scam patterns documented this edition — each verified against public warnings

Patterns documented across the series — 57 in editions 1–7, plus this edition's 8

5 of 8

Hand you a link, app, or page at the exact moment the scam turns real

5 of 8

Bolt the lie onto something that actually happened — a real arrest, a real death, a real portal, a real season, a real dealership

3 of 8

The goal is your login itself, not just a one-time payment

The patterns

The wave, word for word

AI-cloned car dealership websites

Arrives via cloned dealer site, found by search or ad

“Wire transfer only.” — the FTC's own scenario: a buyer pays for a rare classic or muscle car on a cloned dealership site, then the “dealer” vanishes — or the real dealership has no record of the order, the payment, or a car.

Yes — it's a cloneFull script + verdict →

TerminalFix fake-CAPTCHA malware

Arrives via fake “verify you are human” page

“A real CAPTCHA may ask you to click boxes or select images, but it will not ask you to open Run, Terminal, Command Prompt, or PowerShell and paste a command.” — Malwarebytes, Sep 1, 2026

Yes — never run itFull script + verdict →

Airline & hotel loyalty-account phishing

Arrives via fake booking confirmation or “urgent alert” text

Fake booking confirmations and “urgent alert” texts push a login page that harvests loyalty-account credentials — accounts that can hold thousands of dollars in value but none of a bank account's protections.

Check before you clickFull script + verdict →

“MyChart Medicare Kit” phishing

Arrives via email or text

“Your MyChart Medicare Kit Awaits!” — signed “MyChart Health Network,” a Verona, Wisconsin entity that doesn't exist. Even the unsubscribe link is malicious.

No — there is no kitFull script + verdict →

Jail-roster “release fee” family calls

Arrives via phone call, spoofed as the sheriff's office

“Eligible for early release because of overcrowding.” / “Needs an ankle monitor before release.” / “Will remain in custody unless the family pays immediately.”

The fee is fakeFull script + verdict →

Dolly Parton memorial donation fraud

Arrives via ad, dm, or repurposed fan account

“If the path to donating runs through a DM, a Telegram handle, a WhatsApp thread, or a phone number instead of the charity's own website typed in by you, it's a scam.” — Allure Security

No — verify firstFull script + verdict →

Unlicensed sportsbooks & fake betting apps

Arrives via app or site, pushed through ads and group chats

Deposits clear instantly. Withdrawals stall on “technical issues,” a sudden demand for more ID, or a requirement to deposit more — or pay a “release fee” — before winnings are paid out.

Red flag — no licenseFull script + verdict →

“Google” suspicious-login support calls

Arrives via phone call, paired with a real recovery email

“There's been a suspicious sign-in attempt from Frankfurt, Germany.” — then a real-looking Google account-recovery notification, and a request to read back the verification code “to secure your account.”

No — Google doesn't callFull script + verdict →

Analysis

Eight costumes, five tells

Five of this wave's eight hand you something at the exact moment the scam turns real.

A cloned dealership site, a fake CAPTCHA page, a loyalty login page, a MyChart “kit” link, a betting app. The object in your hand is the payload — the scam doesn't ask you to imagine anything, it asks you to click, paste, or pay inside the thing it just handed you.

Five of eight bolt the lie onto something that actually happened.

A real arrest mined from public jail rosters, a real death announced August 25, a real patient portal, a real football season, a real dealership with real reviews. The true half is borrowed credibility; only the ask — the fee, the login, the command — is invented.

Three of eight want the login itself, not a one-time payment.

Loyalty credentials worth thousands of dollars in points, a MyChart password guarding a full medical record, a Google verification code read aloud. The account is worth more than any single charge — and none of the three carries a bank's protections.

The verification channel is the whole defense.

Every one of these collapses when you check through a channel you open yourself: the real dealer's published number, the airline's own app, the jail's switchboard, the charity's typed-in website, your own Google security page. Never the channel in the message — the message is the crime scene.

The tell is still the ask.

Wire-transfer-only for a car, a command pasted into Terminal, a code read aloud to “Google,” a fee before a jail release, a “release fee” on your own winnings. The costumes change weekly; the ask gives the con away every time.

For businesses · $19, one-time

Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19

Free brand scan first — you only pay for the full audit.

For your readers

What to do now

Verify through a channel you open yourself — never the one in the message. The dealer's published number, the airline's app, the jail's switchboard, the charity's typed-in website, your own Google security page: the answer is always at the source, never in the message that found you.

Refuse the specific ask. A wire-only car payment, a pasted “verification” command, a login on a page a message handed you, a fee before a jail release or a betting withdrawal, a code read aloud to a caller — each of these is the entire scam wearing a process costume.

Report it where it counts — the FTC at reportfraud.ftc.gov, the FBI at ic3.gov, or the impersonated platform, health system, airline, or sheriff's office — and paste any link, app, or number from the message into Scam Detective's instant check ($2, one-time) for a 0–100 risk score before you act.

Methodology

This report is published by Scam Detective's research desk. The 8 patterns above are net-new for this edition: each was documented in public warnings published between August 25 and September 1, 2026 — the FTC's cloned-dealership alert (September 1); Microsoft's TerminalFix teardown (August 28) and Malwarebytes' consumer guidance (September 1); Bitwarden's loyalty-account research and ABC7 Chicago's consumer warning (August 29); the 41-plus hospital and health-system alerts and the Pennsylvania Attorney General's warning on the MyChart kit wave; Bitdefender's jail-call breakdown (August 28) and county sheriff alerts in Texas, Georgia, Virginia, and elsewhere; Allure Security's memorial-fraud tracking with press coverage August 28–29; the Better Business Bureau's sportsbook warning and Washington State's August 30 advisory; and the Google suspicious-login call script exposed by Rossen Reports the weekend of August 30 — and deduplicated against all 95 verdict pages previously published across this series and the /answers index. The figures above are counts of documented scam patterns — not victim counts, loss estimates, or scans of customer-submitted URLs. Quoted language is drawn from the public warnings cited; names, places, and dollar figures in it are those warnings', not inventions of this desk.

Each pattern links to its full verdict page, built today with the dated surge context, the verbatim quote block, a 5-item red-flag checklist, and a 3-step response. Verdicts are educational, based on documented scam patterns — they are not live Scam Detective reports on specific URLs. Scam Detective does not run continuous monitoring or real-time threat feeds, and nothing in this report is legal advice.

For journalists

Using these figures

You may quote this report — including the scripts — with attribution to Scam Detective and a link to this page:

https://scam-detective5.acoco.ai/reports/scam-wave-2026-09-15

Each pattern above links to its full verdict page — complete script, checklist, and steps. Earlier waves are covered in the August 28, August 19, August 15, August 12, August 9, August 2, and July 30 editions. To check a specific URL mentioned in your coverage, the instant check is $2, one-time — no subscription.

About Scam Detective: Scam Detective is pay-per-use scam intelligence — an instant $2 URL risk check and a $19 brand impersonation audit, delivered in minutes, with no subscription. Spot the scam before it spots you.

Got a message that reads like these scripts?

Paste the link, number, or sender into the instant check — free risk signal in seconds, the full 0–100 report for $2, one-time.

Check a suspicious link — $2 Browse all verdict pages