28Scam Types Covered
10Guided Scenarios
4Threat Vectors
6Report Agencies
00:00:00
--- -- ----
---
GA Population
Est. 11.4M
Last Updated
May 2026
Step 1
Spot It
Figure out what type of scam you are dealing with
Not sure if it's a scam? Answer 2 quick questions
Quick Risk Check
2 questions. 60 seconds. We tell you exactly where you stand and what to do next. No pattern matching, no guessing — you answer, we route.
Know what type of scam this is? Select it
Step 2
Verify It
Check the specific thing you received using the right tools
What do you have to check?
🔗 Checking a link or website
Open any of these tools and paste your link or domain. Use more than one for confidence — a clean result on one tool doesn't guarantee safety.
VirusTotal
Scans your link against 70+ security engines. Paste the URL and click Search.
Paste URL
MetaDefender (OPSWAT)
Scans your link against a different engine set than VirusTotal. Run both — a clean result on one doesn't guarantee the other agrees. Free, no account required.
Paste URL
URLScan.io
Takes a safe screenshot so you can see the page without visiting it. Paste URL and click Scan.
Paste URL
ScamAdviser
Gives the website a trust score based on age, location, and reports. Paste the domain name and search.
Paste domain
Netcraft Site Report
Shows the site's full history — when created, where hosted, and if ever reported for fraud or phishing.
Paste domain
CheckShortURL
Reveals the real destination behind bit.ly and other shortened links before you click.
Paste short link
WHOIS Lookup
Shows who registered the domain and when. A domain created last week claiming to be a major brand is a hard red flag.
Paste domain
How to read the results
✅ Looks clean when…
VirusTotal and MetaDefender both show 0 detections. ScamAdviser score is 80+. WHOIS shows the domain is years old and owned by a known company. URLScan screenshot matches the real site. No fraud flags on Netcraft.
🚩 Treat as suspicious when…
Any VirusTotal or MetaDefender engine flags it. ScamAdviser score is below 50. Domain was registered in the last 30 days. WHOIS ownership is hidden or uses a privacy proxy. Site is hosted in a country unrelated to the company it claims to be.
QR codes: decode the QR with your phone camera first, then paste the resulting URL here before tapping it. Never open a QR-linked URL without checking it first.
📧 Checking an email address
The most important thing to check is the domain — the part after the @ symbol. Scammers use domains that look like real brands but aren't. These tools help you verify.
Verify a suspicious email you received
MXToolbox Email Headers
Open the suspicious email, view raw headers (Settings → More options), paste them here to trace where the email truly originated.
Paste headers
Google Header Analyzer
Paste raw email headers and see a clear timeline of every server the message passed through, plus SPF and DKIM authentication results.
Paste headers
How to read email header results
✅ Looks legitimate when…
The "From" domain exactly matches the company's real domain (paypal.com, not paypal-billing.net). SPF and DKIM both show PASS. The sending server IP belongs to the company or a known email provider like Sendgrid or Mailchimp.
🚩 Treat as spoofed when…
SPF shows FAIL or SOFTFAIL. DKIM shows FAIL or is missing. The originating IP is from a different country than the company. The "Reply-To" address is different from the "From" address. Any part of the domain doesn't exactly match.
Check your own email health
MXToolbox Email Health
Enter your own email domain to see if your outgoing mail is configured to prevent spoofing. Use this to check your own accounts, not suspicious senders.
Your domain
HaveIBeenPwned
Check if your personal email address appeared in any known data breach. If it has, change that account's password immediately. Free, no signup required.
Paste your email
How to read HaveIBeenPwned results
✅ Good result
"Good news — no pwnage found." Your email address has not appeared in any known breach database. Continue using strong unique passwords and enable 2FA.
🚩 Action required
Your email appeared in one or more breaches. The site tells you which services were breached. Change your password for every listed service immediately — and any other site where you used the same password.
Real companies email from their actual domain. support@paypal-helpdesk.com is not PayPal. support@paypal.com is. Always check the exact domain after the @ symbol before clicking anything.
📞 Checking a phone number
Remember: caller ID can be completely faked by anyone. Even if it shows your bank's name, it means nothing. These tools check community reports and carrier data — not the caller ID.
NumLookup
Free reverse lookup for US numbers. Shows the carrier, line type (mobile, landline, or VoIP), and sometimes the registered owner. No signup required.
Paste number
Should I Answer
Community-powered spam call database. Real people rate numbers and leave comments. Shows you if others have already flagged this number as a scam.
Paste number
FCC Complaint Center
Report robocalls, spoofed numbers, and phone scams to the Federal Communications Commission. Your report feeds the government's enforcement database.
Report it
How to read phone lookup results
✅ Lower risk when…
NumLookup shows a real mobile or landline registered to a known business or person. Should I Answer has no negative ratings or comments. The number exactly matches the company's published contact number.
🚩 Treat as suspicious when…
NumLookup shows the line type as VoIP — scammers prefer VoIP because it's cheap and easy to spoof. Should I Answer has 1-star ratings or comments mentioning IRS, Social Security, or warranty. The number is out of state but the caller claims to be a local business. No results found at all — newly created numbers are common in scam campaigns.
The IRS, Social Security Administration, Medicare, and your bank will never demand immediate payment by phone — especially not by gift card, wire transfer, Zelle, or crypto. Hang up and call the agency directly using the number on their official website.
💬 Checking a suspicious text message
Text scams (smishing) are now the #1 delivery method for fraud in the US. Before clicking any link, replying, or calling any number in a text, take 60 seconds to verify.
🚩 Red Flags — Read Before Anything Else
- Claims to be USPS, FedEx, your bank, or the IRS from a regular 10-digit number — real companies text from short codes (5–6 digit numbers like 22000 for USPS or 48773 for FedEx), not random 10-digit numbers
- Contains a link — especially a shortened URL like bit.ly or tinyurl.com — real companies use their own domain in links
- Unexpected delivery fee or "address update required" when you have no pending package
- Urgent language: "Your account will be closed," "Respond within 24 hours," "Final notice"
- Prize, lottery, or gift card offer from a number you don't recognize
- Awkward phrasing, odd spacing, or unusual punctuation — often a sign of automated translation
- Asks you to reply STOP or click a link to opt out — doing either confirms your number is active and live
⚠️ Received a verification code you did NOT request? Someone already has your password and is attempting to log into your account right now. Change that account's password immediately from a trusted device. If someone then calls and asks you to read the code back to them — hang up. That is a live account takeover in progress.
Verify the Text
Bitdefender Scamio
Paste the full text message and Scamio analyzes the content for scam patterns — the only tool here that reads what the message actually says. Free account required for full use; basic analysis available without one.
Paste message text
NumLookup
Check the sender's line type instantly — no account needed. VoIP is the strongest single indicator of a scam text. Real companies text from registered business lines, not throwaway internet numbers.
Paste sender number
RoboKiller Spam Lookup
Spam database covering both 10-digit numbers and short codes. Shows community reports, scam type, and how many people flagged that sender. Basic lookup is free; full history requires an account.
Paste number or code
🔗 Text Contains a Link?
The link in the text is where credentials get stolen or malware gets installed. Click here to open the Link checker — VirusTotal, URLScan, WHOIS — and verify the URL before you touch it.
Open Link panel →
How to read the results
✅ Lower risk when…
Scamio finds no scam patterns in the message. NumLookup shows a real business mobile or landline — not VoIP. RoboKiller shows no spam reports or scam flags. Any link in the text passes VirusTotal and WHOIS shows the domain is years old and legitimately owned.
🚩 Treat as a scam when…
Scamio flags the message as a scam or phishing attempt. NumLookup shows VoIP — highest confidence scam indicator for a text sender. Any link in the text fails VirusTotal, has a newly registered domain, or uses a URL shortener.
Report the Text
📲 Forward to 7726 (SPAM)
Works on all US carriers — AT&T, Verizon, T-Mobile. Your report flags the number for everyone.
iPhone: Press & hold message → More… → Forward arrow → Type 7726 → Send
Android: Press & hold message → Forward → Type 7726 → Send
iPhone: Press & hold message → More… → Forward arrow → Type 7726 → Send
Android: Press & hold message → Forward → Type 7726 → Send
Action on your phone
FTC ReportFraud
File a report with the Federal Trade Commission. Your report feeds the national fraud database and triggers enforcement action when patterns emerge across victims.
Report it
Free Built-In Spam Text Protection — Enable Now
Most people never turn these on. All of them are free:
- iPhone (iOS Messages): Messages from unknown senders show a "Report Junk" link at the bottom — tap it to report to Apple and your carrier simultaneously
- Android (Google Messages): Open the conversation → Tap ⋮ → "Report spam" — reports to Google and enables automatic blocking
- T-Mobile: Download the free Scam Shield app — blocks spam texts and calls, no cost on any T-Mobile plan
- AT&T: Open the AT&T app → ActiveArmor → enable spam text blocking (free tier available)
- Verizon: Open My Verizon app → Call Filter → enable spam detection (free tier available)
Never click a link or reply STOP to a text from an unknown number — not even to opt out. Both actions confirm your number is active and can lead to more scam texts or malware. Navigate to any company's website directly by typing it yourself.
Step 3
Report It
Take action, stop the damage, and file your official report
Still happening right now?
I Think I Am Being Scammed Right Now
Stop. Do not send money. Do not give access. Read the 6 emergency steps immediately.
What happened to you?
1
Hang up or stop responding immediately
No explanation needed. Scammers are trained to keep you engaged. Disengage completely.
2
Do not call back numbers they gave you
Look up the real company number yourself on their official website or the back of your card.
3
Screenshot everything
Capture the number, email, messages, and exactly what they said. You will need this for reports.
4
Block the contact on all platforms
Phone, email, and social media. They may try other channels after you stop responding.
5
Warn family members
Scammers often target multiple people in the same network after a failed attempt.
6
Report the attempt
Use the reporting links below. Your report protects others in your community.
1
Disconnect from WiFi immediately
Turn off WiFi or unplug ethernet. This stops any active data transfer to the attacker.
2
Do not enter any information on the page
Close the browser tab now. If you already did, assume that information is compromised.
3
Run a malware scan right now
Use Malwarebytes Free or Windows Defender. Do not wait until later.
4
Change passwords from a different device
Any account you were logged into is at risk. Start with email and bank accounts.
5
Enable two-factor authentication
On your email, bank, and social accounts. This stops attackers even if they have your password.
6
Monitor your accounts for 30 days
Watch for unauthorized charges, password resets you did not request, or new accounts you did not open.
1
Call your bank or payment app right now
Ask to reverse, recall, or stop the transaction. Use the number on the back of your card.
2
Gift cards - call the issuer immediately
Call the number on the back of the card. Keep the card and your receipt. Some issuers can freeze unused balances.
3
File a local police report
Gwinnett County PD non-emergency: (770) 513-5700. You need a report number for bank disputes.
4
Report to the FTC
reportfraud.ftc.gov generates an official report ID your bank can use in a dispute. Takes 5 minutes.
5
Document everything
Screenshots, transaction IDs, phone numbers, all communications. More evidence means better recovery.
1
Change passwords immediately
Start with email - it is the master key to everything else. Then bank accounts, then social media.
2
If SSN was shared - freeze your credit now
Free at all 3 bureaus: Equifax.com, Experian.com, TransUnion.com. Takes about 10 minutes each.
3
Check haveibeenpwned.com
See if your email appeared in known data breaches. Free and instant.
4
If bank or card info was shared - cancel and reissue
Call your bank now. Request new card numbers. Set up transaction alerts.
5
File at identitytheft.gov
Official government recovery plan tailored to what was stolen. Creates a personal recovery checklist.
Walk through your exact situation step by step
💸 Someone sent me money by mistake
🛒 Marketplace buyer acting suspicious
💼 Job offer seems too good
📦 Suspicious delivery text
💻 Someone wants remote access
💔 Online relationship asking for money
🏛️ Government agency called me
🖥️ Tech support popup
🏦 I received a check I didn't expect
⚡ Utility company threatening shutoff
File your official report
Reference Library
Scam Library
All 28 scam types with full playbooks, red flags, and what to do
Deep Investigation
Advanced tools: sandboxing, identity investigation, forensics
Local Resources
Snellville, Gwinnett, Atlanta contacts and neighborhood safety maps
Learn and Stay Safe
Daily habits, golden rules, phishing quiz, password tools
Home & Physical Security
Doors, locks, cameras, lighting, dogs, perimeter security, and emergency preparedness for your home
Digital Footprint & Privacy
Reduce your online exposure, opt out of data brokers, protect your identity, and understand authentication security
These tools do not react to scams — they prevent them. A VPN encrypts your connection. A private browser and search engine reduce the tracking scammers exploit to target you. Encrypted email keeps your real inbox out of the wrong hands. Two-factor authentication stops account takeovers even when a password is stolen.
Proton VPN
VPN
Genuinely free VPN with no data logging, no credit card required. Encrypts your internet connection so scammers, hackers, and trackers cannot see what you are doing online. Based in Switzerland with strong privacy laws.
protonvpn.com ↗
Brave Browser
Browser
Free privacy browser with built-in ad blocking, anti-tracking, and fingerprint protection. No extensions needed to get strong privacy out of the box. The fastest option if you want privacy without configuration.
brave.com ↗
Firefox
Browser
Free, open source browser with strong privacy defaults and full support for uBlock Origin. Best choice if you want more customization and control over your privacy settings.
mozilla.org/firefox ↗
Opera Browser
Browser + VPN
Free browser with a built-in VPN, ad blocker, and tracker protection all included - no extensions needed. The only major free browser with a VPN built directly into the interface. Good option if you want everything in one place.
opera.com ↗
DuckDuckGo
Search Engine
Private search engine that does not track your searches, build an advertising profile on you, or sell your data to third parties. Use it instead of Google for everyday searching. Free, no account needed.
duckduckgo.com ↗
Proton Mail
Encrypted Email
Free encrypted email account not tied to your real identity. Use it when signing up for any site you are unsure about — keeps your primary inbox safe from harvesting and spam. End-to-end encrypted, based in Switzerland. No ads, no data selling. Same company as Proton VPN.
proton.me/mail ↗
Authenticator App
2-Factor Auth
A stolen password alone is not enough to break into your account when 2FA is on. Install Authy or Google Authenticator — both free — and enable two-factor authentication on your email, bank app, and social media accounts. The single most impactful account protection step you can take.
authy.com ↗
Bitwarden
Password Manager
Free, open source password manager that generates and stores a unique password for every account. Reusing passwords is one of the most common ways scammers break in — one leaked password unlocks everything. Bitwarden eliminates that risk entirely. Works on every device, no credit card required.
bitwarden.com ↗