The channel is doing part of the persuasion. Malwarebytes' own reading is that the platform tends to match the content: job lures land in email because that is where work correspondence lives, and romance approaches land on social media because meeting a stranger there is unremarkable [6]. Format also sets the tempo. A direct message reads as personal, while a phone call demands an answer while the target is still on the line [7].
Two grades of data sit in the same writeup and should not carry the same weight. The channel splits and the timing curves come from Malwarebytes' research systems [1]. The brand ranking comes from what users reported [12], and the gaming loss figure from its Scam Guard product [16]. Reported rankings measure what people noticed and bothered to flag. The published list of the five most impersonated brands names four: Microsoft, Apple, Roblox and Amazon [12], with Google described separately as abused at least twice as often as Amazon [13]. Roblox turns up again among the most impersonated gaming sites, with a 15% rise in scam activity from mid-June to mid-July [17].
The arithmetic on the timing claim: the 1:00 am ET low is the baseline, and 874% busier puts noon at 974% of it, roughly 9.7 times the volume [19]. At the stated blocking rate of about 500,000 phishing sites a day [9], the April 15 to July 14 window runs 91 days [18] and multiplies out to something near 45.5 million blocks [20]. That is a rate extended across the period rather than a count of distinct domains, and it covers the web surface only [8].
The usable finding is that the pretext predicts the channel across more than 20 measured scam types [5], which makes channel a control question rather than an awareness slogan. A mail gateway plus a quarterly email test will see toll notices, since nine in ten arrive by email or text [2]. It will not see the phone call carrying half of IRS scams [3]. It will not see the fake giveaway that appears in a feed instead of an inbox [10], nor the opening move in the six in ten romance scams that begin on social media [4]. Impersonation is concentrated enough to plan detection around: one face, MrBeast, accounts for about 30% of impersonation scams, ahead of Elon Musk and Donald Trump [11].
This is consumer telemetry, and the read across to staff is inference rather than measurement. The bridge is the handset, because the phone that takes the toll text also takes the helpdesk callback. The cheap correction is intake. A report-phish button counts email and nothing else, so a low click rate is as easily an unmeasured channel as a trained workforce.
