Scam Risk Check
Paste a suspicious text or email, or describe a phone call. You'll get a risk band, the warning signs we found, what not to do, and a safe way to verify it.
Please don't paste sensitive information. Do not enter passwords, Social Security numbers, bank or card numbers, one-time codes, or login credentials. You don't need them to check whether a message is a scam, and you should never share them with anyone who asks.
How this works: the check runs entirely in your browser using a fixed set of known scam patterns. Nothing you paste is sent to a server, stored, or logged. We record only an anonymous count of the risk band: never the message itself. See the privacy policy.
the risk band tells you the next move
The scam check result map
The check gives you a risk band, not a verdict on a person. Whatever it says, these are the only next moves that keep money and accounts safe.
- High riskDo not reply, do not pay, do not call the numberNever pay with gift cards, wire, crypto, or a cash app, never share a code or password, and never call a number the message gives you: verify with a number you already trust.
- Medium riskVerify from a number you chooseLook up the real contact independently (statement, card, official site) and check before acting: the suspicious message map has the full script.
- Low riskIt still pays to slow downNo single check catches everything, so keep the two habits that matter: never act on urgency, and confirm with a family member or the official number before money or codes move.
- If money or codes movedAct in the first hourCall the bank or card issuer now, report to the FTC at ReportFraud.ftc.gov, and use the accounts-compromised containment map for the 60-minute order.
What this tool can and can't do
This is a risk screener, not a detection guarantee. It matches patterns that appear in the most common scam families: payment pressure, impersonation, urgency, secrecy, and code requests. It cannot tell you with certainty whether a specific message is a scam, and it will occasionally miss new tricks or flag things a human would recognize as routine.
That's why the output always includes an independent verification path. The safest habit, for you and for your parents: is "verify through an official channel, never through the message itself."
Patterns are based on guidance from the FTC, FBI IC3, CISA, and SSA. Last reviewed August 2026.
When to call in a human
If a parent has already sent money, shared a code, or given remote access to their computer, act fast but don't panic:
- Money already sent by gift card, wire, or crypto: report it immediately. Gift-card companies, banks, and the FTC have specific reporting steps, and timing matters.
- Bank or card access involved: call the number on the back of the card right away and freeze or close affected accounts.
- Verification code already shared: treat the account as compromised and change the password and sign-out other devices now.
- A "relative" asked for bail money: call the relative at their real, known number before sending anything. This is a very common and very convincing scam.
For a step-by-step version of the first hour, read What to do when a parent gets a suspicious text or call.
The next thing your family needs
- How to verify a bank, utility, or tech-support message independently: the one skill that protects against almost everything.
- Set up a family safe-word for voice-impersonation scams: five minutes, genuinely effective.
- Make an iPhone easier for an aging parent, including silencing unknown callers for good.
- Call-blocking devices and services: what's worth it: when a parent's landline is a spam magnet.