Skip to content
ScanMyPrivacy
Menu

Privacy and leak tests

Full Privacy ScanDNS Leak TestWebRTC Leak TestBrowser Fingerprint TestAm I Using a VPN?HTTP Headers ViewerUser Agent CheckerOpen Port Checker

Online safety assistant

Website Safety CheckerSuspicious Link CheckerScam and Phishing Message CheckerBrowser Security GuideMobile App Safety CheckPersonal Security Checkup

IP and network lookups

IP LookupMy IP LocationWhat Is My Public IP?What Is My IPv6 Address?Reverse DNS LookupDNS Lookup
Online safety Guides API About

Free scam check · nothing is uploaded

Scam and Phishing Message Checker

Not sure if a message is genuine? Paste it here and see which common scam tricks it uses, with plain advice on what to do next.

Check a message

Remove names, account numbers and anything private before pasting if you like. The text stays in your browser either way.

Anything else you noticed? (optional)

What we test, what we do not, and what we store

Full method →

We test

  • Common scam patterns in the text you paste: urgency, threats, impersonation of banks, couriers and authorities, requests for one-time codes, passwords or payment, gift-card and crypto demands, remote-access requests, prizes and easy-money bait
  • Any links in the message, using the same checks as the suspicious link checker
  • The things you noticed that text cannot show, such as an unexpected sender

We do not test

  • Who really sent the message: we cannot see headers, numbers or addresses
  • Attachments, images or voice notes
  • Whether a message is genuine: a message with no signs found can still be a scam, and a real one can trip a rule

What we store

  • Nothing: the message and your ticks are analysed in your browser and never sent to us
  • Anonymous usage counts only: which tool was completed and a coarse result category, never what you typed, your IP address or your results. Nothing is sent if your browser signals Global Privacy Control or Do Not Track.

Third parties that see data: None. This tool makes no network request with your message.

How the scam message checker works

Scams follow scripts. A fake bank alert, a missed-delivery text, a "your account will be closed" email and a boss asking for gift cards all pull the same few levers: urgency, fear, authority, greed and secrecy, followed by a request for a code, a password or a payment that cannot be reversed. This checker reads the text you paste for those levers and for links with warning signs, then explains each sign it found in plain language, with the exact words that triggered it.

The signs it looks for

  • Requests for codes or credentials. No genuine service asks you to read out a one-time password or send a PIN. This is the strongest sign of all.
  • Pressure. Deadlines, threats of blocking or arrest, and demands to stay on the line.
  • Impersonation. Banks, couriers, tax and police authorities, tech-support teams and employers are the most copied.
  • Unusual payment. Gift cards, crypto, wire transfers and "fees" to release a parcel or a prize.
  • Remote-access tools. Anyone who asks you to install software so they can "help" is trying to control your device.
  • Risky links and attachments. Links are run through the suspicious link checker rules.

Reading the result

"Strong signs" means at least one serious pattern appeared, such as a request for a code. Treat it as a scam until you have verified it another way. "Some signs" means the message has weaker patterns that deserve a second check. "No common patterns found" is not a clean bill of health: new scams appear constantly and a careful scammer avoids the obvious words. Always ask yourself whether you expected the message and whether it wants money, a code or a click.

What to do with a suspicious message

  1. Do not reply, click or call the number in the message.
  2. Contact the organisation yourself through its official app, its website typed into the browser or the number on your card.
  3. Report the message as spam or phishing in your email or messaging app, then delete it.
  4. If you already acted, follow what to do if you clicked a phishing link and secure your accounts with strong passwords and two-step verification.

Privacy

The message is analysed inside your browser. It is not uploaded, logged or shared. The only thing we count is that a check was completed, and nothing is counted at all if your browser sends Global Privacy Control or Do Not Track.

Last reviewed 2026-10-29. Found a mistake? Report a correction (how we handle them).

Fix it and learn more

What to do if you clicked a phishing linkClicked a suspicious link or typed a password on a fake page? Follow these steps in order: what to change, check and report, and what can wait.How to spot fake login pages and lookalike domainsLearn how to read a web address, catch lookalike domains and fake login pages, and what to do when a page asks for your password after a message or ad.Strong passwords and two-step verification, made simpleSecure your accounts: unique passwords with a password manager, two-step verification starting with email, and how to end a stolen session.

Also check your…

Suspicious Link CheckerPaste a link to spot look-alike domains, misleading subdomains and other warning signs. Runs on your device.Personal Security CheckupAnswer a few questions and get a personalised, prioritised action plan.Website Safety CheckerCheck a site's HTTPS, certificate, security headers and domain age.Browser Security GuideStep-by-step cookie, permission, pop-up and extension settings for your browser.

Frequently asked questions

Can this tell me if a message is definitely a scam?

No. It finds common scam patterns. Treat strong signs as a scam until you have verified the message through an official channel, and treat a clean result as "nothing obvious", not "safe".

Is the message I paste stored or sent anywhere?

No. The text is analysed in your browser and discarded when you leave the page.

A genuine bank message mentioned urgency. Does that make it fake?

Not by itself. Real alerts can use urgent wording, which is why a single weak sign scores low. The difference is what they ask for: genuine banks never ask for your PIN, password or one-time code by message or phone.

What if I already shared a code or password?

Change the password on the real site now, sign out of other devices, turn on two-step verification and call your bank if cards or money are involved. Speed matters.

Does this work for messages in other languages?

The pattern rules are written for English, with some common terms used in India, the UK and the US. Links and the checklist work for any language.