Scam wave report · Edition 9 · September 29, 2026 · 8 net-new patterns

This Week's Scam Wave, in Numbers

This week’s wave bolts each lie onto something real and current: AI-generated “police” on video calls, fake iPhone 18 pre-order stores riding launch week, farm-equipment dealers that vanish after the wire, and a “free AI upgrade” that steals your Google account — eight net-new patterns, each verified against public warnings and linked to its full verdict page with the exact script.

Scam Detective research desk · Published September 29, 2026

Got one of these in your hand right now?

Paste the link, number, or sender into the instant check — free risk signal in 60 seconds, the full 0–100 report for $2, one-time.

Check a suspicious link — $2

Net-new scam patterns documented this edition — each verified against public warnings

Patterns documented across the series — 65 in editions 1–8, plus this edition's 8

4 of 8

Harvest your card or bank details on a page the scam itself handed you

3 of 8

Wear the AI boom as a costume — a generated “officer” on video, AI brands as bait, AI subscriptions that don't exist

5 of 8

Bolt the lie onto something real and current — launch week, a real dealer, Anthropic's real site, your real carrier, peak storm season

The patterns

The wave, word for word

AI-powered fake “police” calls & video calls

Arrives via phone call or video call, spoofed as a real agency

“Law enforcement and government authorities will never contact members of the public by telephone or text message to demand any form of payment or to request personal or sensitive information.” — FBI public service announcement, Sep 17, 2026

No — police don't call for paymentFull script + verdict →

Fake iPhone 18 launch-week stores

Arrives via fake store or ad, found by search or social

“Offers that seem too good to be true, as well as product selections that are broader than or differ from those officially announced by the company, should be treated as clear warning signs.” — Olga Altukhova, Kaspersky, Sep 24, 2026

Likely a fake storeFull script + verdict →

Fake farm-equipment dealerships

Arrives via social media ad or search result for equipment

The FTC's scenario: a tractor at the right price from what looks like a legitimate business — a purchase agreement, an invoice, thousands wired as a deposit or full payment — and the delivery never comes.

Verify before you wireFull script + verdict →

“Free Claude Max” giveaway phishing

Arrives via “giveaway” page reached through ads, posts, or messages

10,000 free one-month Claude Max subscriptions, fewer than 750 slots left — the counter is generated in your browser and resets every reload. It never asks for your card; it wants your Google login.

No — it's a phishing pageFull script + verdict →

Fake AI subscription sites

Arrives via polished product site, found by search or ad

More than 100 subscription websites linked through the same $249 toolkit — some impersonate existing products, including GPT-6 Astra, DaVinci Resolve, PixAI, and OpenCut. Another uses the name of Omegle, the chat service that shut down in 2023.

Check who's sellingFull script + verdict →

T-Mobile “points expiring” texts

Arrives via text message

“T-Mobile Rewards Points Reminder: Your Points Are About to Expire… You currently have 18,400 points, which will expire… if unused.” — the same invented balance sent to thousands, on 81+ rotating t-mobile.<random>.top domains.

No — don't clickFull script + verdict →

“Shipping rebate” subscription traps

Arrives via checkout offer, retailer promo, or pop-up after a purchase

One complainant said they “did not understand” they were enrolling in a paid membership — the theme across 529 Better Business Bureau complaints in three years against a single shipping-rebate operation quietly billing $25 a month.

Red flag — hidden subscriptionFull script + verdict →

Post-hurricane “contractor” & relief fraud

Arrives via door-knock, phone call, or social post in storm-hit areas

“They will come in with all sorts of fake documents. They will come in with all sorts of promises or prices to fix your property, to fix your yard, whatever it may be.” — Chief Deputy David Baldwin, Bay County Sheriff's Office, Sep 15, 2026

Verify before you payFull script + verdict →

Analysis

Eight more costumes, five tells

Four of this wave's eight harvest your card on a page the scam itself handed you.

A fake iPhone store's checkout, a slick AI tool's pricing page, a carrier “points” site, a rebate form. The page is the payload — the scam doesn't ask you to imagine anything, it asks you to type your card into the thing it just built for you.

Three of eight wear the AI boom as a costume.

A generated officer's face on a video call, the two hottest AI brands dangled as giveaway bait, a hundred fake AI “subscriptions” stamped out of the same $249 kit. The hype is the lure; the mechanics underneath are decades old.

Five of eight bolt the lie onto something real and current.

iPhone launch week, a dealership you've actually bought from, Anthropic's real website linked in the footer, your real carrier, peak hurricane season. The true half is borrowed credibility; only the ask is invented.

The verification channel is still the whole defense.

Apple's own site typed in by you, the dealer's published number, your carrier's own app, the state license lookup, hanging up and calling the agency yourself. Every one of these collapses when you check through a channel you open — never the one in the message.

The tell is still the ask.

A wire for a tractor, Bitcoin for a phone, your Google password for a “free” upgrade, your card number to receive a “rebate,” payment to make “charges” disappear. The costumes change weekly; the ask gives the con away every time.

For businesses · $19, one-time

Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19

Free brand scan first — you only pay for the full audit.

For your readers

What to do now

Verify through a channel you open yourself — never the one in the message. apple.com typed into your browser, the dealership's published number, your carrier's own app, the agency's switchboard, the state's contractor-license lookup: the answer is always at the source, never in the message that found you.

Refuse the specific ask. A wire-only equipment payment, Bitcoin for a phone, a Google login for a “free upgrade,” card details to receive a “rebate,” a fee to make “charges” or a “warrant” disappear — each of these is the entire scam wearing a process costume.

Report it where it counts — the FTC at reportfraud.ftc.gov, the FBI at ic3.gov, your state attorney general, or the impersonated company, carrier, or agency — and paste any link, app, or number from the message into Scam Detective's instant check ($2, one-time) for a 0–100 risk score before you act.

Methodology

This report is published by Scam Detective's research desk. The 8 patterns above are net-new for this edition: each was documented in public warnings published between September 15 and September 25, 2026 — the FBI's IC3 public service announcement on law-enforcement and government impersonation (September 17); Kaspersky's fake-iPhone-store findings (September 24) with WhoisXML API's pre-launch domain tracking reported by Forbes (September 11–12); the FTC's farm-equipment impersonation alert (September 15), Bitdefender's follow-up reporting the Georgia Department of Agriculture's warning and Denver7's Colorado case (September 24); Malwarebytes' research on the fake Claude Max giveaway (September 23), the 100-plus-site fake AI subscription network (September 21), the T-Mobile rewards-points phishing campaign (September 17), and the ShipmentsFree rebate cluster (September 25); and the joint U.S. Attorney–FBI–Bay County Sheriff hurricane-fraud briefing (September 15, reported September 16) alongside the FTC's National Preparedness Month guidance (September 9) — and deduplicated against all 103 verdict pages previously published across this series and the /answers index. The figures above are counts of documented scam patterns — not victim counts, loss estimates, or scans of customer-submitted URLs. Quoted language is drawn from the public warnings cited; names, places, and dollar figures in it are those warnings', not inventions of this desk.

Each pattern links to its full verdict page, built today with the dated surge context, the verbatim quote block, a 5-item red-flag checklist, and a 3-step response. Verdicts are educational, based on documented scam patterns — they are not live Scam Detective reports on specific URLs. Scam Detective does not run continuous monitoring or real-time threat feeds, and nothing in this report is legal advice.

For journalists

Using these figures

You may quote this report — including the scripts — with attribution to Scam Detective and a link to this page:

https://scam-detective5.acoco.ai/reports/scam-wave-2026-09-29

Each pattern above links to its full verdict page — complete script, checklist, and steps. Earlier waves are covered in the September 15, August 28, August 19, August 15, August 12, August 9, August 2, and July 30 editions. To check a specific URL mentioned in your coverage, the instant check is $2, one-time — no subscription.

About Scam Detective: Scam Detective is pay-per-use scam intelligence — an instant $2 URL risk check and a $19 brand impersonation audit, delivered in minutes, with no subscription. Spot the scam before it spots you.

Got a message that reads like these scripts?

Paste the link, number, or sender into the instant check — free risk signal in seconds, the full 0–100 report for $2, one-time.

Check a suspicious link — $2 Browse all verdict pages