Scam Message Checker
Paste a suspicious text, email or DM and see the warning signs it contains — checked against 27 known scam patterns, entirely in your browser.
Got a text, email or DM that feels off? Paste it here before you reply, pay or tap anything. The checker reads the message the slow way — wording, demands and links — and matches it against 27 warning-sign patterns drawn from public consumer-protection guidance (the US FTC and FBI IC3 describe the same tactics). You get a plain list of what it found, with the exact words that triggered each flag, so you can judge for yourself.
🔒 The checker is locked until you tick the declaration above.
Everything runs on your device: load this page, go offline, and the checker still works — because nothing is ever sent anywhere.
How to use
- Tick the declaration so the checker unlocks — it confirms you understand the result is a pattern report, not a verdict.
- Paste the full message, exactly as received. If you know it, add who it claims to be from (the sender name, number or email address shown on the message).
- Read the flags. Each one quotes the words that triggered it and explains the tactic in plain English.
- Follow the next steps shown with the result — usually: do not reply, do not tap the link, and contact the organisation through its official app or a number you already trust.
About this tool
Scam messages are engineered to be read in two seconds, on the move, with one thumb. They lean on a small set of tricks: manufactured urgency, a borrowed brand name, a request that breaks the rules a real organisation follows (gift cards, crypto, a code read aloud), and a link that is not what it claims to be. This checker scores none of that with a black box — every flag names the pattern, quotes the matching text, and says why it matters.
Your message never leaves this tab. The pattern engine is JavaScript that runs on your device; nothing is uploaded, sent to a server, logged or stored, and closing the tab erases it. That is a stronger privacy guarantee than checkers that send your message away for analysis — and it means you can safely paste the messages you would never want to share.
How it works
How the checker works: 27 patterns in five families. Pressure — urgency deadlines, account-closure threats, secrecy demands. Impersonation — brand claims from the wrong sender, family members on a "new number". Rule-breaking requests — verification codes, passwords, gift cards, crypto, wire transfers, moving money to a "safe account". Story templates — delivery fees, toll charges, prizes, tax threats, task-job offers, investment pitches, tech-support calls. Link forensics — any link is pulled out and its structure checked for shorteners, look-alike brand domains, punycode and IP addresses.
Scoring is a tally, not a probability. Requests for codes, passwords, gift cards or crypto are weighted as critical; other strong patterns count double; single weaker signals count once. Four or more points — or any critical request — reads as "strong warning signs". The tally is deliberately transparent: you can see every point and disagree with it.
What it cannot do: it cannot look a sender or link up in a live database, it cannot read images or attachments, and a message with no flags can still be a scam that uses none of the known patterns. Treat a clean result as "no strong warning signs found" — never as proof a message is safe.
Worked examples
Delivery-fee text: Input: "USPS: your parcel is held at the depot due to an unpaid customs fee of $1.99. Pay within 12 hours or it will be returned: parcel-redelivery-help.top/pay". Output: strong warning signs — delivery-fee template, urgency deadline, and a look-alike link on a throwaway domain are flagged, with the advice to check the tracking number in the official USPS app instead.
Bank impersonation email: Input: "Dear customer, unusual activity was detected. Verify your account and password within 24 hours or your account will be suspended" with a link to secure-bankofamerica-verify.top. Output: strong warning signs — account-closure threat, credential request, urgency, and a domain that uses the bank’s name on a domain the bank does not own.
An ordinary reminder: Input: "Hi Sam, a reminder that your dental appointment is tomorrow at 9:30. Reply C to confirm or call the clinic to reschedule." Output: no strong warning signs found — no demands, no links, no pressure patterns — followed by the standing reminder that this tool cannot prove a message is safe.
Frequently asked questions
Can this checker tell me if a message is a scam?
No — and any tool that promises a certain answer is overstating what pattern matching can do. This checker lists the warning signs a message contains, based on 27 documented patterns. Many flags together is a strong reason to stop and verify through official channels; no flags is not proof a message is genuine.
Is the message I paste uploaded or stored?
No. The checker is JavaScript that runs entirely in your browser tab. Your message is never sent to a server, never logged and never stored; closing the tab erases it. You can verify this by loading the page, going offline, and running a check — it still works.
What should I do if a message has strong warning signs?
Do not reply, do not tap links or attachments, and do not call numbers in the message. Contact the organisation directly using its official app, its real website typed by hand, or a number from a statement or the back of your card. In the US you can forward scam texts to 7726 and report fraud at reportfraud.ftc.gov; in the UK forward texts free to 7726 and visit Action Fraud.
Why does it ask who the message claims to be from?
Sender mismatch is one of the most reliable tells. Banks and agencies do not text from ordinary mobile numbers or free email addresses, and a sender domain that looks like a brand but is not the brand’s real domain is a classic impersonation sign. The sender field is optional, but it sharpens the result.
Can it check messages in other languages?
The pattern list is built on English-language scam scripts, which are also the templates most often translated. Messages in other languages may trigger the link and sender checks but fewer wording patterns, so treat a clean result on a non-English message with extra caution.
More free tools
Suspicious Link Checker
Paste a link and read what its structure reveals — look-alike domains, punycode disguises, hidden destinations and bait words — without ever visiting it.
Password Strength Checker
How strong is your password — really? Local strength scoring plus a private breach check.
Phone Number Checker
Validate any phone number: country, line type and the correct international format.
IBAN Validator
Check an IBAN for typos before you send money — mod-97 validation and full structure breakdown.
Credit Card Validator
Check a card number’s format: Luhn checksum and card brand, right in your browser.
C2PA Content Credentials Verifier
Check a photo or video for Content Credentials (C2PA): who signed it, whether the signature still validates, and whether AI involvement was declared — verified on your device.