Scam wave report · Edition 11 · October 10, 2026 · 7 net-new patterns

This Week's Scam Wave, in Numbers

This week’s wave photocopies the headlines and staples a link to them: tickets to “scarefest” events that don’t exist, fake “claim your Amazon settlement refund” messages riding a real $1.5 billion payout, order-problem and recall texts tailing $10 billion of Big Deal Days deliveries, sold-out hot toys miraculously in stock, fake seasonal recruiters, and midterm donation harvesting — seven net-new patterns, each verified against public warnings and linked to its full verdict page with the documented quotes.

Scam Detective research desk · Published October 10, 2026

Got one of these in your hand right now?

Paste the link, number, or sender into the instant check — free risk signal in 60 seconds, the full 0–100 report for $2, one-time.

Check a suspicious link — $2

Net-new scam patterns documented this edition — each verified against public warnings

Patterns documented across the series — 80 in editions 1–10, plus this edition's 7

7 of 7

Ride a real date on the calendar — an automatic payout, a 48-hour sale's delivery tail, Halloween, hiring season, holiday toy lists, a midterm election

5 of 7

Harvest what you type into a page the scam itself hands you — a ticket checkout, a claim form, a cloned sign-in, a refund portal

4 of 7

Borrow Amazon's name somewhere in the script — the settlement, the order, the recall, the “HR team”

The patterns

The wave, word for word

Tickets to “scarefest” events that don't exist

Arrives via social-media ad or post, or a search for halloween events near you

“We have been made aware of a website selling tickets for a ‘Halloween scarefest’ at Cardiff Castle. This event is not linked to the castle and is not scheduled to take place here.” — Cardiff Castle, Oct 2026

Check the venue's own site — if it isn't listed there, it isn't onFull script + verdict →

Fake “claim your Prime settlement refund” messages

Arrives via text, email, or phone call riding the real ftc payout

“The FTC is not contacting people about refunds in the Amazon matter. If you get a call from someone who claims to be from the FTC, it's a scam.” — FTC, Amazon Refunds page, Sep 2026

No claim, no fee, no call — the refund is automaticFull script + verdict →

“Problem with your order” texts tailing the deliveries

Arrives via text message (sometimes email) in the days after a big deal days purchase

“You have to stop and think, ‘Have I ever gotten a text message like this before?’ I've had hundreds of deliveries in the past year, and never once have they texted me and had a problem. Why would that happen now?” — Daniel Irwin, BBB of the Mid-South, Oct 9, 2026

If it isn't in Your Orders, it didn't happenFull script + verdict →

“Your purchase was recalled — claim your refund” texts

Arrives via text or email about “a product from your recent order”

“The text never actually said ‘air fryer.’ It said ‘a product from your recent order.’” — Ariel Reid, whose mother received a fake recall text (AARP, Sep 24, 2026)

Real recalls name the product — and never want your cardFull script + verdict →

Sold-out hot toys, miraculously “in stock”

Arrives via a search result or social-media ad after the toy sells out everywhere else

“I put in an order for a Nintendo Switch 2 game console, and once i realized it was probably a scam, i tried to dispute the claim, but they provided an alternative tracking number to a different package saying it was delivered to me ... I never received a tracking number or received my item.” — Shopper report to BBB Scam Tracker, Oct 6, 2026

Likely a fake storeFull script + verdict →

Fake seasonal-hiring texts riding October's job window

Arrives via text or dm from a “recruiter” for warehouse, delivery, or retail seasonal work

“Hello! Camila from Amazon's HR Team here. We've reviewed your profile and believe you'd excel in our effortless work-from-home role… Compensation: $250-$500 daily… Only 20 openings left.” — Fake-recruiter text documented by Trend Micro, Oct 6, 2026

Real seasonal jobs never text firstFull script + verdict →

“Campaign” calls that pocket the donation

Arrives via political-season phone call or text — a poll, a donation ask, or a registration warning

“By the fourth one the caller wants his date of birth to confirm he is a registered voter, and by the sixth there is a $50 gift card waiting if he reads off a card number for shipping.” — Scammer Guardian, Oct 7, 2026

Give only through a site you open yourselfFull script + verdict →

Analysis

Seven more costumes, five tells

Real news is the new lure.

A genuine $1.5 billion payout. A genuine hiring season. A genuine recall system. A genuine election three weeks out. This week's cons didn't invent a single story — they photocopied the headlines and stapled a link to them. “Based on a true story” is now the scammer's favorite genre.

The calendar does the persuading.

October 1 payments, an October 6–7 sale, October 20 “events,” a November 3 election, toy lists that just published. Every deadline in this edition exists in the real world, which means the urgency is free — the scammer just has to stand next to the date and hold out a hand.

Depth is dead as a tell.

A “huge” website with hundreds of pages, built by AI in July for a Halloween that doesn't exist. Fluent HR texts, polished recall notices, cloned sign-ins. The shallow-site check a generation of shoppers was taught is over — the only verification left is a channel you open yourself.

Sometimes the page never loads at all.

The deposit to “unlock” wages, the gift card for a donation match, the card number for prize “shipping” — three of this week's scripts never needed a website, just your voice or a reply. The cheapest attacks still monetize manners and hope.

The ask is still the confession.

A fee to release a refund that's automatic. A card for a ticket to an event that isn't booked. A deposit for wages that don't exist. A gift card for a campaign that can't accept one. Seven costumes, one door — every script ends by asking for the one thing the real institution never would.

For businesses · $19, one-time

Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19

Free brand scan first — you only pay for the full audit.

For your readers

What to do now

Verify through a channel you open yourself — never the one in the message. The venue's own website, Your Orders in the Amazon app, cpsc.gov/recalls, fec.gov, amazon.jobs, ftc.gov/enforcement/refunds/amazon-refunds — typed by you, not linked by them. If the event, order, recall, committee, job, or refund isn't visible there, it isn't real.

Refuse the specific ask. A fee for a refund the government already said is automatic. A deposit to unlock wages. A card number for a prize's “shipping.” A donation by gift card, wire, or crypto. Each of these is the entire scam wearing a process costume — no legitimate institution on this list ever makes that ask.

Report it where it counts — the FTC at ReportFraud.ftc.gov, the FBI at IC3.gov, Amazon at amazon.com/reportascam, texts forwarded to 7726, BBB Scam Tracker, your state attorney general — and paste any link, app, or number from the message into Scam Detective's instant check ($2, one-time) for a 0–100 risk score before you act.

Methodology

This report is published by Scam Detective's research desk. The 7 patterns above are net-new for this edition: each was documented in public warnings and research published between September 24 and October 10, 2026 — the BBC's investigation of the “Halloween Nights Fear” scarefest ticket site (October 8), with the Beaufort County Sheriff's Office's US warning (October 9) and Police Scotland's Edinburgh alert (October 9); the FTC's Amazon Prime settlement refund page (September 2026) with Geebo's scam warning (October 9) and KCTV5's reporting (October 8); FOX13 Memphis's post–Big Deal Days reporting with the Better Business Bureau of the Mid-South (October 9), iSerial's documentation of the four post-sale text scripts (October 9), the Associated Press's delivery-text interactive (October 7), and Trend Micro's sale-week telemetry (October 6); AARP's recall-scam mechanics (September 24) with in-window confirmation the fake recall text is circulating post-sale (October 7); the Better Business Bureau's hot-toy Scam Alert (October 6); WCPO's seasonal-hiring report with BBB guidance (October 8) and Challenger, Gray & Christmas hiring data (October 6); and Scammer Guardian's election-call script documentation (October 7), corroborated by FTC and election-official warnings reported October 5 and the FBI's fraudulent-PAC guidance — and deduplicated against all 138 verdict pages previously published across this series and the /answers index, plus the 10 evergreen guides shipping in parallel today (148 slugs checked). The figures above are counts of documented scam patterns — not victim counts, loss estimates, or scans of customer-submitted URLs. Quoted language is drawn from the public warnings cited; names, places, and dollar figures in it are those warnings', not inventions of this desk.

Each pattern links to its full verdict page, built today with the dated surge context, the verbatim quote block, a 5-item red-flag checklist, and a 3-step response. Verdicts are educational, based on documented scam patterns — they are not live Scam Detective reports on specific URLs. Scam Detective does not run continuous monitoring or real-time threat feeds, and nothing in this report is legal advice.

For journalists

Using these figures

You may quote this report — including the scripts — with attribution to Scam Detective and a link to this page:

https://scam-detective5.acoco.ai/reports/scam-wave-2026-10-10

Each pattern above links to its full verdict page — complete quote block, checklist, and steps. Earlier waves are covered in the October 6, September 29, September 15, August 28, August 19, August 15, August 12, August 9, August 2, and July 30 editions. To check a specific URL mentioned in your coverage, the instant check is $2, one-time — no subscription.

About Scam Detective: Scam Detective is pay-per-use scam intelligence — an instant $2 URL risk check and a $19 brand impersonation audit, delivered in minutes, with no subscription. Spot the scam before it spots you.

Got a message that reads like these scripts?

Paste the link, number, or sender into the instant check — free risk signal in seconds, the full 0–100 report for $2, one-time.

Check a suspicious link — $2 Browse all verdict pages