Scam wave report · Edition 12 · October 14, 2026 · 4 net-new patterns

This Week's Scam Wave, in Numbers

This week’s wave dresses as the rescue: “view your 2027 COLA notice” lures launched hours after the real 3.6% announcement — weeks before any real notice can exist — “your health benefits are about to expire” renewal shakedowns on the eve of Medicare open enrollment, a $60 million sextortion “rescue” the FTC says was the second scam stacked on the first, and fake FEMA aid plus “insurance-coordinated” tree-service texts trailing Hurricane Isaias — four net-new patterns, each verified against public warnings and linked to its full verdict page with the documented quotes.

Scam Detective research desk · Published October 14, 2026

Got one of these in your hand right now?

Paste the link, number, or sender into the instant check — free risk signal in 60 seconds, the full 0–100 report for $2, one-time.

Check a suspicious link — $2

Net-new scam patterns documented this edition — each verified against public warnings

Patterns documented across the series — 87 in editions 1–11, plus this edition's 4

4 of 4

Ride a real date on the calendar — the Oct. 14 COLA announcement, the Oct. 15 enrollment window, the Oct. 9 landfall, the Oct. 13 FTC suit

3 of 4

Hunt people already hit once — sextortion victims, storm survivors, benefit recipients: the “second scam” cohort

4 of 4

Impersonate the rescue, not the mark — the benefits office, the renewal desk, the forensic savior, the federal inspector

The patterns

The wave, word for word

“Your 2027 COLA notice is ready” — weeks before it exists

Arrives via text, email, call, or social message claiming your benefit increase or cola notice is ready to view, claim, or “activate”

“SSA does not offer to increase benefits in exchange for money. Benefit amounts are calculated by law based on your earnings record and other factors. They are not negotiated over the phone, and you never need to claim the offer or pay processing or administrative fees.” — SSA Office of the Inspector General, Sep 21, 2026

The real raise is automatic — and the real notice doesn't arrive until late NovemberFull script + verdict →

“Your health benefits are about to expire” — the renewal shakedown

Arrives via text message or robocall warning that your coverage lapses unless you “renew” — then asking for bank details or a payment

“Medicare is never going to call you out of the blue, so if you receive any unsolicited phone calls or text messages or even emails, don't respond at all. If you have any questions about the validity, then contact the department directly.” — Lisa Schiller, Better Business Bureau, Oct 12, 2026

Benefits don't expire by text — and renewing never costs moneyFull script + verdict →

The $60 million sextortion “rescue” that delivered nothing

Arrives via a search ad or sponsored result while you're desperately looking for help with a sextortion threat

“Digital Forensics preys on consumers already in crisis, exploiting victims of sextortion by using fear to pressure them into paying thousands of dollars for services that are never provided.” — Christopher Mufarrige, FTC Bureau of Consumer Protection, Oct 13, 2026

Real help starts free — block, report, and use the 48-hour takedown the law already gives youFull script + verdict →

Fake FEMA calls and “insurance-coordinated” tree crews after Isaias

Arrives via a text, call, or knock on the door in the storm's path — offering aid, inspections, tree work, or “insurance coordination”

“Don't trust someone who asks for money. FEMA, U.S. Small Business Administration, and other federal agencies will never charge applicants for disaster assistance or help in filling out applications.” — FEMA, post-disaster fraud guidance, Oct 2026

Real disaster aid never charges — free is the lawFull script + verdict →

Analysis

Four fresh costumes, four tells

The second scam is having a moment.

This week's standout cons don't find new victims — they harvest the ones already bleeding. A blackmail target searching for help finds a $20,000 “Phase 1.” A flooded homeowner finds a “free” aid application with a fee stapled on. A senior who already has Medicare gets told it expires Friday. The first crime creates the lead list for the second.

The calendar keeps doing the persuading.

The 3.6% COLA was announced at 8:30 this morning; the fake notices can start before lunch because the real one can't exist before late November. Open enrollment opens tomorrow; the “renewal” texts opened yesterday. Landfall was Friday night; the tree-service texts were in the AG's office by Saturday. Real dates, free urgency.

This week they dressed as the rescue.

Not the bill collector — the benefits office. Not the blackmailer — the forensic savior. Not the storm — the inspector, the “insurance-coordinated” crew, the renewal desk. When every institution is warning about scams, “I'm here to help” is the most effective costume left.

The ask is still the confession.

A fee to activate a raise that's automatic. A payment to renew coverage that never lapses that way. Twenty thousand dollars to do what the block button does free. Cash for disaster aid the law says is free. Four costumes, one door: every script ends asking for the one thing the real rescuer never would.

For businesses · $19, one-time

Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19

Free brand scan first — you only pay for the full audit.

For your readers

What to do now

Verify through a channel you open yourself — never the one in the message. ssa.gov/cola for the raise and ssa.gov/myaccount for the real notice in late November. Medicare.gov or 1-800-MEDICARE for coverage questions, and shiphelp.org (877-839-2675) for free plan help. FEMA at DisasterAssistance.gov or 800-621-3362 for aid, and TakeItDown.ftc.gov if a platform ignores a takedown. Typed by you, not linked by them.

Refuse the specific ask. No fee to “activate” a COLA that's automatic. No payment to “renew” benefits Medicare says never expire by text. No $1,499 “Phase 1” for what blocking and the free 48-hour takedown already do. No cash or deposit for disaster aid that is free by law. Each ask is the entire scam wearing a process costume.

Report it where it counts — SSA OIG at oig.ssa.gov/report, Medicare at 1-800-MEDICARE, the FTC at ReportFraud.ftc.gov, the FBI at tips.fbi.gov or IC3.gov, disaster fraud at [email protected] and the National Center for Disaster Fraud, price gouging and scam texts to your state attorney general — and paste any link, app, or number from the message into Scam Detective's instant check ($2, one-time) for a 0–100 risk score before you act.

Methodology

This report is published by Scam Detective's research desk. The 4 patterns above are net-new for this edition: each was documented in public warnings, enforcement actions, and official announcements published between October 9 and October 14, 2026 — the Social Security Administration's 2027 COLA announcement (October 14), with the SSA Office of the Inspector General's benefit-increase scam alert (September 21) and the agency's standing scam guidance naming the COLA-activation ask, corroborated in-window by consumer coverage (October 13); the Better Business Bureau of Wisconsin's Medicare impersonation warning (October 12) and BBB of North Alabama's consumer alert (October 13), with AARP Fraud Watch Network's helpline reporting (October 12) and standing FTC and FCC guidance; the Federal Trade Commission's lawsuit against the Digital Forensics sextortion-relief operation and its paired consumer alert (both October 13); and the Florida and Georgia attorneys general's Hurricane Isaias warnings (October 9–10), FEMA's post-disaster fraud guidance (October 7, updated October 9), Florida's disaster-fraud hotline updates, and BBB's storm-damage scam warning in Tennessee (October 13) — and deduplicated against all 164 verdict pages previously published across this series and the /answers index, the 11 edition report hubs and the October seasonal hub, and the 12 SEO landing pages (full collision table in the research spec). The figures above are counts of documented scam patterns — not victim counts, loss estimates, or scans of customer-submitted URLs. Quoted language is drawn from the public warnings and filings cited; names, places, and dollar figures in it are those sources', not inventions of this desk. Where the underlying matter is an enforcement action (the FTC's sextortion-relief case), the allegations are the Commission's and the case will be decided by the court.

One honesty note specific to this edition: the COLA announcement landed the morning of publication. The “view your notice” lures are documented by the SSA OIG's standing alert and the SSA's own scam guidance; the decisive tell — that no 2027 notice can exist before late November — comes from SSA's announcement itself. No consumer outlet had yet documented a live notice-phishing campaign at press time, and we say so on the page.

Each pattern links to its full verdict page, built today with the dated surge context, the verbatim quote block, a 5-item red-flag checklist, and a 3-step response. Verdicts are educational, based on documented scam patterns — they are not live Scam Detective reports on specific URLs. Scam Detective does not run continuous monitoring or real-time threat feeds, and nothing in this report is legal advice.

For journalists

Using these figures

You may quote this report — including the scripts — with attribution to Scam Detective and a link to this page:

https://scam-detective5.acoco.ai/reports/scam-wave-2026-10-14

Each pattern above links to its full verdict page — complete quote block, checklist, and steps. Earlier waves are covered in the October 10, October 6, September 29, September 15, August 28, August 19, August 15, August 12, August 9, August 2, and July 30 editions. To check a specific URL mentioned in your coverage, the instant check is $2, one-time — no subscription.

About Scam Detective: Scam Detective is pay-per-use scam intelligence — an instant $2 URL risk check and a $19 brand impersonation audit, delivered in minutes, with no subscription. Spot the scam before it spots you.

Got a message that reads like these scripts?

Paste the link, number, or sender into the instant check — free risk signal in seconds, the full 0–100 report for $2, one-time.

Check a suspicious link — $2 Browse all verdict pages