April brought a flood of fake debt relief calls. The number (877) 419-6664 alone generated 2,943 complaints, making it the most-reported scam number of the month. Four of the top five numbers on our list pushed bogus credit card, mortgage, and student loan services through toll-free area codes designed to look legitimate.
These aren't random calls. Scammers specifically target people struggling with debt because they know desperation makes victims more likely to bite on too-good-to-be-true offers. The debt relief category generated over 4,500 complaints in April, far outpacing other scam types.
The Numbers Behind the Calls
The second-highest complaint volume went to (855) 909-0815 with 1,066 reports. This number runs impersonation scams, with callers pretending to be government agencies, businesses, or even family members. They create artificial urgency around fake problems to extract personal information or payments.
The pattern is clear when you look at the full list. Scammers cluster their operations around toll-free prefixes 866, 877, and 888 because these numbers appear more legitimate than random area codes. People have been trained to trust toll-free numbers as belonging to real businesses, and fraudsters exploit that trust.
It works the other way too. Plenty of scam calls show local-looking area codes that have been spoofed, with the real operator dialing from somewhere else entirely. Treat any unsolicited call with the same skepticism whether the caller ID reads toll-free or local.
| # | Phone Number | Complaints | Category |
|---|---|---|---|
| 1 | (877) 419-6664 | 2,943 | |
| 2 | (866) 959-0957 | 1,205 | Reducing your debt (credit cards, mortgage, student loans) |
| 3 | (855) 909-0815 | 1,066 | Calls pretending to be government, businesses, or family and friends |
| 4 | (833) 746-6947 | 1,005 | |
| 5 | (888) 530-6830 | 929 |
Malware Networks Target Smart Devices
Beyond phone scams, we flagged new malicious IP addresses running malware that specifically targets smart devices. This malware turns routers and security cameras into networks that scammers use to launch internet attacks. The infected devices become part of larger criminal operations without their owners knowing.
The domains associated with these campaigns are designed to fool quick visual checks. Sites like member277.partner-invoice-network.com and seedccv.credits-center.com look like legitimate invoice or credit monitoring tools at first glance. The naming pattern uses "member" numbers and corporate-sounding language that can slip past busy employees checking email links.
| Domain | Why it's dangerous |
|---|---|
| member277.partner-invoice-network.com | looks like a real business invoice tool |
| member251.agency-collab-invite.com | looks like a real agency collaboration platform |
| seedccv.credits-center.com | looks like a real credit-monitoring service |
| www.72072.xyz | low-cost throwaway domain hosting fake content |
Real Victims, Real Damage
The complaints behind these numbers tell specific stories. A college student reported a roommate falling for a social engineering scam built on shared personal information. Small businesses faced procurement fraud through fake suppliers, with one printed circuit board company called Source Parts collecting advance payments and disappearing.
Car buyers on Autotrader were redirected to fake vehicle history report sites like drivelity.info that steal credit card information. A small Montana auction business discovered fraudsters running a copycat website to steal both money and brand reputation. A Canadian law firm found their name being used as a cover story in fake document scams circulating in the US.
These aren't abstract threats. Each complaint represents someone who lost money, had their identity stolen, or spent hours cleaning up the mess scammers left behind.
Data Sources
Reddit remains our largest single source of real-time scam reports, processing over 577,000 records through community posts and comments in April. Federal complaint databases from the FTC, CFPB, and FCC provide additional verification, while threat intelligence feeds flag malicious domains and IP addresses before they can spread widely.
| Source | Records Processed | Runs |
|---|---|---|
| 577,412 | 30 | |
| indexnow | 317,225 | 30 |
| ftc_dnc | 222,312 | 22 |
| cfpb | 195,000 | 30 |
| fcc_complaints | 148,547 | 30 |
| bbb_backfill | 51,064 | 16 |
| urlhaus | 15,000 | 30 |
| bbb | 9,004 | 30 |
The volume tells the story. Scammers aren't slowing down, and neither are the people reporting them. Every complaint helps build a clearer picture of how these operations work and which tactics are spreading.
This report is auto-generated from Scam Detective's data pipeline. Phone numbers, domains, and companies listed here have been reported by consumers to federal agencies or flagged by threat intelligence feeds. Presence in this report does not constitute a determination of wrongdoing.