Scam wave report · Edition 10 · October 6, 2026 · 7 net-new patterns

This Week's Scam Wave, in Numbers

This week’s wave asks you to type into the page the scam itself just built: fake Amazon stores riding Prime Big Deal Days, lookalike Medicare sites buying the top search slot before open enrollment, a Google “security alert” hosted on Google’s own domain, and a Marketplace listing that wears your name — seven net-new patterns, each verified against public warnings and linked to its full verdict page with the exact script.

Scam Detective research desk · Published October 6, 2026

Got one of these in your hand right now?

Paste the link, number, or sender into the instant check — free risk signal in 60 seconds, the full 0–100 report for $2, one-time.

Check a suspicious link — $2

Net-new scam patterns documented this edition — each verified against public warnings

Patterns documented across the series — 73 in editions 1–9, plus this edition's 7

6 of 7

Harvest something typed into a page the scam itself handed you — a card number, a password, a wallet signature, your Medicare ID

5 of 7

Ride a real date on the calendar — a 48-hour sale, an enrollment window, Halloween, a benefits announcement, a token “burn” deadline

3 of 7

Borrow the sign-in of a platform you use every day — Amazon, Google, Facebook

The patterns

The wave, word for word

Fake Amazon “Big Deal Days” stores & lookalike domains

Arrives via search ad, phishing email, or social post riding the october 6–7 sale

“New Amazon- and Prime Day-related domain registrations have risen for three straight months, climbing from 905 in July 2026 to 1,284 in September 2026—an increase of 42%.” — Check Point Research, Oct 1, 2026

Likely a fake storeFull script + verdict →

Lookalike Medicare sites buying the top search slot

Arrives via the top of a search-results page — a paid ad — or an unsolicited call/text

“Scammers and dishonest businesses sometimes pay to appear at the top.” — FTC consumer alert, Sep 28, 2026

Scroll past the ads — check for .govFull script + verdict →

“Security alerts” hosted on Google's own sites.google.com

Arrives via email that looks — and sometimes is addressed — like google

“A real google.com URL in an email only tells you who hosts a page, not who wrote it.” — MEGA, Oct 6, 2026

Verify inside your account — never via the emailFull script + verdict →

Marketplace listings wearing your name

Arrives via text message (imessage/sms) carrying a fabricated listing screenshot

“Is this still available for purchase?” — attached to a fabricated Facebook Marketplace listing where the seller's name is yours.

Don't reply — check Facebook yourselfFull script + verdict →

Fake “vote for rewards” crypto sites

Arrives via link from a message, ad, or reply posing as the project

“We found 70 websites that impersonate legitimate crypto projects that invite visitors to vote on the date of an upcoming rewards distribution.” — Malwarebytes, Oct 1, 2026

Never connect a wallet thereFull script + verdict →

Fake Halloween costume stores

Arrives via social-media ad or promo email for costumes and decorations

“They took my money, and I am left without the costume I needed for an important event. I paid $110, which is not a small amount, and I feel completely frustrated.” — Ohio consumer report to BBB Scam Tracker, Oct 1, 2026

Likely a fake storeFull script + verdict →

“Boost your benefits” pitches ahead of the COLA announcement

Arrives via call, letter, text, ad, or social-media message

“SSA does not offer to increase benefits in exchange for money… They are not negotiated over the phone, and you never need to claim the offer or pay processing or administrative fees.” — SSA Office of the Inspector General, Sep 21, 2026

No — the increase is automaticFull script + verdict →

Analysis

Seven costumes, five tells

Six of seven put the payload on a page the scam itself hands you.

A fake Amazon checkout, a lookalike Medicare enrollment form, a “Check activity” button, a Connect Wallet window, a costume store's cart, a “verify your benefit” form. The con doesn't ask you to imagine anything — it asks you to type into the thing it just built for you.

Five of seven ride the calendar.

A 48-hour sale, a nine-day countdown to open enrollment, Halloween, a COLA announcement due any week, a token “burn” deadline. Real events supply the urgency, so the scammer doesn't have to manufacture it — the date does the persuading.

The checks you were taught are being farmed.

A genuine [email protected] sender. A link that really is google.com. A password manager that offers to autofill. A top-of-search slot wearing an official-looking seal. Three of this week's seven pass at least one test that used to mean “safe” — which is why the only check that still works is a channel you open yourself.

Sometimes you don't have to type anything at all.

The Marketplace lure just wants a reply — any reply — because a live number is inventory that resells. In a week of polished pages, the cheapest attack monetizes your manners.

The tell is still the ask.

A card for a costume that doesn't exist, a fee to “boost” a benefit that's automatic, a wallet approval to cast a “vote,” a Google password to fix an “app password.” The costumes change weekly; the ask gives the con away every time.

For businesses · $19, one-time

Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19

Free brand scan first — you only pay for the full audit.

For your readers

What to do now

Verify through a channel you open yourself — never the one in the message. amazon.com, Medicare.gov, ssa.gov/myaccount, myaccount.google.com/notifications, the Facebook app — typed by you, not linked by them. If the alert isn't inside your account, it didn't happen.

Refuse the specific ask. A fee to raise a benefit set by law, a wallet “approval” to cast a vote, card details on a store an ad handed you, a password typed into a page an email handed you — each of these is the entire scam wearing a process costume.

Report it where it counts — the FTC at ReportFraud.ftc.gov, the FBI at ic3.gov, the SSA at ssa.gov/scam, your state attorney general, or the impersonated platform (Amazon's [email protected], Facebook's impersonation report) — and paste any link, app, or number from the message into Scam Detective's instant check ($2, one-time) for a 0–100 risk score before you act.

Methodology

This report is published by Scam Detective's research desk. The 7 patterns above are net-new for this edition: each was documented in public warnings and research published between September 21 and October 6, 2026 — the Social Security Administration Office of Inspector General's benefit-increase alert (September 21), with Money's reporting on the COLA-timing surge (September 25) and the West Virginia Attorney General's September complaint data (reported October 6); the FTC's open-enrollment health-insurance alert (September 28), with BBB Scam Tracker reporting (October 5–6) and AARP Fraud Watch Helpline detail via the Detroit Free Press (October 6); the Better Business Bureau's Halloween costume-store warning (October 1) and TrustSniffer's fake-store teardown (October 3); Check Point Research's Prime Big Deal Days domain findings (October 1) with KnowBe4 Threat Lab's Amazon-impersonation telemetry (October 6); Malwarebytes' research on the 70-site fake crypto “rewards vote” network (October 1) and the Facebook Marketplace name-and-number lure (October 6); and MEGA's reconstruction of the sites.google.com “security alert” phish (October 6), first flagged in an X post viewed more than five million times (October 1) — and deduplicated against all 121 verdict pages previously published across this series and the /answers index, including the 10 evergreen guides. The figures above are counts of documented scam patterns — not victim counts, loss estimates, or scans of customer-submitted URLs. Quoted language is drawn from the public warnings cited; names, places, and dollar figures in it are those warnings', not inventions of this desk.

Each pattern links to its full verdict page, built today with the dated surge context, the verbatim quote block, a 5-item red-flag checklist, and a 3-step response. Verdicts are educational, based on documented scam patterns — they are not live Scam Detective reports on specific URLs. Scam Detective does not run continuous monitoring or real-time threat feeds, and nothing in this report is legal advice.

For journalists

Using these figures

You may quote this report — including the scripts — with attribution to Scam Detective and a link to this page:

https://scam-detective5.acoco.ai/reports/scam-wave-2026-10-06

Each pattern above links to its full verdict page — complete script, checklist, and steps. Earlier waves are covered in the September 29, September 15, August 28, August 19, August 15, August 12, August 9, August 2, and July 30 editions. To check a specific URL mentioned in your coverage, the instant check is $2, one-time — no subscription.

About Scam Detective: Scam Detective is pay-per-use scam intelligence — an instant $2 URL risk check and a $19 brand impersonation audit, delivered in minutes, with no subscription. Spot the scam before it spots you.

Got a message that reads like these scripts?

Paste the link, number, or sender into the instant check — free risk signal in seconds, the full 0–100 report for $2, one-time.

Check a suspicious link — $2 Browse all verdict pages