Rules, limits, and privacy
How the checker works
There is no AI here and no database of bad numbers. The checker is a short list of written rules that run inside your browser. You can read every one of them on this page.
What do the three results mean?
High-risk warning signs found
At least one confirmed high-severity scenario, such as an unexpected caller who wants gift cards.
Warning signs found
At least one medium-severity scenario and nothing high. Worth checking before you act.
Unable to establish trust
No rule matched, or we did not have enough to go on. This is not a pass.
You will never see "safe", "verified", a score, or a percentage. A tool that reads text cannot know who sent it, and we would rather say so. Every result carries this line: This checks for common warning signs. It cannot confirm who sent this or whether a website is safe.
What does it look at?
- Messages: the wording, for requests in context. "Gift card" alone matches nothing. "Buy gift cards and send me the numbers" does.
- Links: the structure of the text. We split it into host, registrable domain, and path using the public suffix list, and point out tricks such as text before an @ sign. This is a URL structure check. It is not a malware scan.
- Calls: your answers to a short questionnaire. We do not look up phone numbers, because caller ID can be faked and a lookup would give false comfort.
What does it never do?
- It does not open, fetch, or follow any link. Short links stay unresolved.
- It does not send what you paste anywhere. There is no server call, no storage, no analytics of your input. You can confirm this in your browser’s network panel, or by switching to airplane mode after the page loads and running a check.
- It does not treat https, a padlock, a familiar logo, or a domain on our reviewed list as proof of anything.
- It does not treat urgency, cryptocurrency, an unfamiliar domain, or spelling mistakes as proof of fraud by themselves.
How does it handle "we will never ask for your code"?
Warnings, quotations, and negations use the same words as the scams they describe. When a match sits next to "never", "do not", or wording such as "scammers will", the checker does not count it. It asks you instead. Answer "Not sure" and it stays unknown. It is never quietly turned into a no.
The rules, version 2026.09.3
| Rule | Level | Why it matters | Source |
|---|---|---|---|
| An unexpected contact wants payment in gift cards gift-card-payment v1 | High | Someone you were not expecting asked you to buy gift cards or share the numbers on them. Gift card numbers work like cash and are close to impossible to trace, which is why this request is so common in scams. | |
| You were told to move money to keep it safe transfer-to-protect v1 | High | The contact says your account is at risk and the fix is to transfer your money somewhere else. Banks and government agencies do not protect money by having you move it. | |
| An unexpected contact asked for a code or password code-or-password-request v1 | High | A verification code proves you are the one signing in. Anyone who asks you to read it out or send it is trying to get into the account it protects. | |
| A prize that costs money to collect prize-advance-fee v1 | High | The message says you won something, then asks for a fee, tax, or shipping payment first. Real prizes do not come with a bill. | |
| Unrequested support wants into your device unsolicited-remote-access v1 | High | Someone contacted you out of the blue about a problem with your computer or phone and wants to connect to it. Remote access lets them see your screen, your saved passwords, and your banking. | |
| A new employer sends a check and wants money sent on employer-check-forward v1 | High | You are asked to deposit a check and then return or forward part of it. The check can bounce after the money you sent is gone, and the bank will look to you for the difference. | |
| You are asked to take a check and send part of the money back check-overpayment-refund v1 | High | Someone pays you by check, often for more than agreed, and wants the difference returned or passed on. The check can bounce days after the money you sent is gone, and your bank will look to you for it. | |
| A relative in trouble who needs money and asks you not to check relative-emergency-secrecy v1 | High | The contact says they are family, needs money fast, and wants it kept quiet or says they cannot be reached the usual way. That combination is built to stop you from making one phone call. | |
| A deadline attached to a payment or account request pressure-with-payment-or-account v1 | Medium | The message pushes you to act quickly and the action involves money or account details. A deadline alone is ordinary. A deadline tied to paying or signing in through their link is worth checking first. | |
| A fee you were not expecting unsolicited-fee v1 | Medium | Someone you did not expect to hear from says you owe a fee, fine, or unpaid balance. Check the claim in your own account before paying through anything they sent. | |
| A promised or guaranteed investment return guaranteed-return v1 | Medium | The message promises profit with little or no risk. Every real investment can lose money, and licensed advisers are not allowed to say otherwise. | |
| A request to pay outside the marketplace leave-marketplace-payment v1 | Medium | The other person wants to settle up away from the site or app where you met. Purchase protections usually stop applying once you do. | |
| An unexpected contact wants a payment that is hard to undo hard-to-reverse-payment v1 | Medium | Wire transfers, cryptocurrency, payment apps, and couriered cash are difficult to reverse. These methods are fine between people who know each other. From an unexpected contact, the choice of method is the warning sign. | |
| The link does not match the organization named sender-domain-mismatch v1 | Medium | You told us who the sender claims to be, and the link points to a domain that is not on our reviewed list for that organization. Some companies do use separate domains for tracking and email, so treat this as unresolved until you confirm it with them directly. | |
| The link is built to look like it goes somewhere else deceptive-link-structure v1 | Medium | A familiar name appears in the link, but not in the part that decides where it goes. The registrable domain shown below is the real destination. | |
| A request for money that you are asked to keep quiet money-request-with-secrecy v1 | Medium | Someone wants money sent and also wants it kept between the two of you. Secrecy removes the one thing that stops most scams: a second person who can say "wait, check that first". This pattern shows up in family impersonation and in online relationship scams. | |
| A charge you do not recognize, with a number to call surprise-charge-callback v1 | Medium | The message announces a renewal or purchase you did not make and gives a phone number to cancel or get a refund. The charge is usually invented. The call is the trap: the person who answers asks for remote access to your computer or for your bank details to "process the refund". | |
| You are asked to pay with gift cards or send the numbers from them gift-card-codes v1 | High | Gift cards are for gifts. Nobody legitimate takes payment in gift cards or needs a photo of the codes, and once the numbers are shared the money is gone within minutes. This is true even when the request seems to come from your boss, a relative, or a government office. | |
| Someone wants you to pass them a code that was sent to you code-relay-request v1 | Medium | A login or verification code is proof that you are you. A person who asks you to read, text, or forward one is usually trying to get into your account or approve a payment. Real companies ask you to type a code into their own app or site, never to give it to a person. | |
| A security warning that tells you to call a number device-alert-callback v1 | High | Real security warnings from your device or browser never ask you to phone anyone. These alerts are advertisements dressed up as system messages. The person who answers will ask for remote access, payment, or your bank login. | |
| You have to pay in before you can be paid out pay-to-earn v1 | High | The offer needs a deposit, top-up, or fee to unlock tasks, a higher level, or a withdrawal. Real work pays you. Platforms that show growing "earnings" and then ask for money before releasing them keep asking until you stop paying. | |
| Easy money for simple online tasks task-job-offer v1 | Medium | High pay for liking, rating, or reviewing things, usually arranged over a chat app, is the opening of a task scam. Small early payouts build trust, then a deposit is needed to continue. | |
| Someone you know only online is asking for money online-relationship-money v1 | High | Affection first, then an emergency: a frozen account, a flight, a medical bill, a customs fee. People who build relationships in order to ask for money are patient and convincing. Do not send money or gifts to anyone you have not met in person. | |
| A threat of arrest or legal action unless you pay or act now legal-threat-with-payment v1 | High | Courts, police, and government agencies do not call, text, or email to demand immediate payment, and they do not threaten arrest to collect it. The threat is there to stop you from hanging up and checking. | |
| A message that threatens arrest or legal trouble legal-threat v1 | Medium | Threats of arrest, lawsuits, or a suspended Social Security number are a standard way to frighten people into acting quickly. Real legal matters arrive on paper and give you time to respond. | |
| A threat to cut off a service almost immediately utility-shutoff-threat v1 | Medium | Utilities send written notices well before a disconnection and do not demand payment within minutes. Find a recent bill and call the number printed on it. | |
| Money wanted for a rental you have not been able to see rental-deposit-unseen v1 | Medium | An owner who is away, keys that will be mailed, and a deposit needed to hold the place are the marks of a copied listing. See the property with someone who can let you in before you pay anything. | |
| An unexpected offer to cancel or reduce your debt debt-relief-offer v1 | Medium | Offers of loan forgiveness that arrive unasked, with a deadline or a fee, are usually not from your lender. Real programs are free to apply for through your loan servicer or the government site you find yourself. | |
| A donation requested by gift card, crypto, wire, or payment app donation-untraceable v1 | Medium | Real charities take cards and checks and are happy for you to look them up first. A request for a donation in a form that cannot be traced or reversed deserves a closer look. | |
| A threat to expose you unless you pay blackmail-demand v1 | High | These emails are sent in bulk. The sender almost never has the recording or access they describe, even if they quote an old password taken from a data leak. Paying marks you as someone who pays. Do not reply and do not pay. If the password they quote is one you still use, change it. | |
| Someone says their bank or payment details have changed payment-details-changed v1 | Medium | A supplier, landlord, employer, or closing agent "updating" where to send money is how invoice and payroll fraud works. Confirm by calling a number you already had, not one in the message. | |
| An offer to get your lost money back, for a fee recovery-fee v1 | High | People who have been scammed are often contacted again by someone offering to recover the money for an upfront fee, a tax, or a percentage paid first. That is a second scam. Government agencies do not charge to help, and no one can guarantee recovery. | |
| Your account has a problem, and the message offers the fix account-problem-with-request v1 | Medium | A locked account or a failed payment, followed by a link or button to put it right, is the most common phishing message there is. If it is real you will see the same notice after opening the app or typing the address yourself. |
The reviewed domain list, version 2026.09.1
When a link’s registrable domain is an exact match for one of these, we say which organization publishes it. We never guess ownership from a name that merely appears in a link, and a match never hides another warning sign or tells you who sent the link.
| Organization | Domains | Checked |
|---|---|---|
| U.S. Postal Service | usps.com | 2026-09-21 |
| UPS | ups.com | 2026-09-21 |
| FedEx | fedex.com | 2026-09-21 |
| Internal Revenue Service | irs.gov | 2026-09-21 |
| Social Security Administration | ssa.gov | 2026-09-21 |
| Federal Trade Commission | ftc.gov | 2026-09-21 |
| Amazon | amazon.com | 2026-09-21 |
| PayPal | paypal.com | 2026-09-21 |
| Apple | apple.com, icloud.com | 2026-09-21 |
| Microsoft | microsoft.com, live.com | 2026-09-21 |
| Netflix | netflix.com | 2026-09-21 |
| Chase | chase.com | 2026-09-21 |
| Bank of America | bankofamerica.com | 2026-09-21 |
| Wells Fargo | wellsfargo.com | 2026-09-21 |