Before you click, check.
Paste a sender's email address and the message you received. ScamSentry scans both — plus any links inside — for the patterns scammers use most often, and gives you a plain-language trust score in seconds.
Scanning...
Here's what we found in what you pasted.
Three steps, no signup, nothing leaves your browser.
The core scan runs entirely on your device using a set of pattern checks built from common scam tactics. Nothing you type is uploaded unless you choose to run the optional AI Deep Scan with your own key.
Paste
Drop in the sender's email address and the full message — links included. The more context you give, the more accurate the read.
Scan
ScamSentry checks the address, wording, and any links against patterns seen in phishing, lottery, and "urgent account" scams.
Decide
You get a 0–100 trust score, a risk level, and a plain-English breakdown of exactly what raised — or didn't raise — a flag.
The sender's address
We check for:
- Lookalike domains (e.g. "paypa1.com")
- Brand names sent from free email providers
- Unusual or throwaway domain endings
- Auto-generated-looking domains
The message wording
We look for language patterns common in scams:
- Urgency and threats ("act now", "account suspended")
- Requests for OTPs, passwords, or card details
- Prize, lottery, or "you've won" language
- Generic greetings and excessive caps/punctuation
Links inside the message
Any URL pasted in is checked for:
- Link shorteners that hide the real destination
- Raw IP addresses instead of domain names
- Lookalike or hyphen-heavy domains
- Missing encryption (no HTTPS)
Habits that stop most scams before they start.
A scanner helps, but a few simple habits catch what no tool can — because they rely on you pausing before you act.
Never share OTPs or PINs
No bank, courier, or government office will ever call or message you asking for a one-time password, PIN, or CVV. Sharing it hands over full access to your account.
Check the sender's actual address
Look past the display name. "Amazon Support" can still be sent from a random Gmail account or a domain with swapped letters like "amaz0n.com".
Hover before you click
On a computer, hover over a link to see where it really goes. On mobile, press and hold to preview the address. If it doesn't match the company name, don't tap.
Urgency is a red flag
"Your account will be closed in 24 hours" is designed to make you panic and skip the part where you'd normally double-check. Real deadlines from real companies rarely work this way.
Too good to be true, is
Lottery wins for contests you never entered, free phones, or huge refunds you didn't expect are almost always bait to get you to click or pay a "fee".
Verify through a separate channel
If a message claims to be your bank, don't reply or click — open your banking app, or call the number printed on your card, to check independently.
Don't open unexpected attachments
Invoices, "delivery failure" notices, or resumes from people you don't know can carry malware. If you weren't expecting a file, confirm with the sender first — separately.
Turn on two-factor authentication
Even if a password leaks, 2FA on your email and banking apps adds a second lock that most scammers can't get past.
Common questions
If something's still unclear after this, treat any message you're unsure about as risky and verify it independently.
No tool can be. ScamSentry highlights patterns that are common in scams, but determined scammers can write a clean message with no obvious flags, and some legitimate companies write messages that sound urgent. Treat the score as a second opinion, not a final verdict — especially if money, passwords, or personal details are involved.
The core scan runs entirely in your browser — nothing you type is sent to a server. The only exception is the optional "AI Deep Scan", which sends your input directly to Anthropic's API using an API key you provide, and only when you click that button.
A score below 50 means we found one or more strong red flags — like a request for your password or OTP, a lookalike domain, or a link pointing to a raw IP address. These are patterns almost never used by legitimate senders.
Yes. Paste the message text into the "Message content" box even if it came as a text or chat message. You can leave the email field empty — the wording and link checks work the same way.
Read through the findings list — each one explains exactly what triggered it. Some legitimate companies do use urgent language or shortened links, so a flag isn't proof of fraud. When in doubt, contact the company directly through their official website or app rather than replying to the message.
If you entered a password or card details, change that password immediately and contact your bank or card provider to flag possible fraud. If you only opened the link without entering anything, run a security scan on your device and avoid downloading anything it offered.
A second pair of eyes before you click
Built for the moment you get a message that feels slightly off but you can't quite say why.
What ScamSentry is
ScamSentry is a free, browser-based tool that scans an email address, message text, and any links inside it for patterns commonly seen in phishing, fraud, and spam. It's built for everyday people — not security experts — who want a quick, plain-language read on whether a message looks safe before they reply, click, or share information.
Runs in your browser
The core scan needs no account, no installation, and no server — everything happens on your device the moment you click "Scan".
Free, no limits
No sign-up, no daily caps, no premium tier. Built as a public-good tool anyone can use whenever a message feels off.
Plain language
Every flag is explained in everyday words — no jargon, no scores without context, so you actually understand the "why".
How the scan works
The core checker uses a set of rules drawn from well-documented scam tactics: lookalike domains, requests for sensitive information, urgency and threat language, prize and lottery wording, link shorteners, and raw-IP links, among others. Each match adjusts a 0–100 trust score and is explained in the results so you understand exactly why.
Who this is for
Anyone who's ever paused over a message and thought "wait, is this real?" — parents and grandparents navigating unfamiliar tech, students and job-seekers dealing with a flood of offers and "selections", small business owners getting "urgent invoice" emails, and anyone who's been targeted by SMS or WhatsApp scams claiming to be a bank, courier, or government office. You don't need any technical background to read the results.
Why this exists
Most fraud doesn't rely on sophisticated hacking — it relies on a moment of distraction, urgency, or trust. A short pause to run a message through a checker like this can be the difference between deleting a scam and losing money or access to an account. ScamSentry exists to make that pause easy, fast, and judgment-free.
What this isn't
This is not antivirus software, a spam filter for your inbox, a fraud reporting service, or a way to recover lost funds. It doesn't connect to your email account, doesn't scan your inbox automatically, and doesn't block or delete anything. It simply reads what you paste in and tells you what it notices — nothing more, nothing less.
Where this is headed
Planned additions include support for analyzing screenshots of messages, a browser extension for one-click checks, and an expanded pattern library covering more region-specific scam formats (courier scams, fake job offers, UPI/payment fraud, and impersonation of local government services). The optional AI Deep Scan will continue to be opt-in and never required for the core check to work.
Not a substitute for official security tools. ScamSentry is a heuristic helper, not antivirus software, a law enforcement tool, or a guarantee of safety. For anything involving money, passwords, or legal matters, always verify directly with the organization involved through a channel you trust.
Your privacy: everything you paste into the main checker stays on your device — nothing is logged, stored, or sent anywhere. The optional AI Deep Scan is the only feature that sends data externally, and only when you choose to use it with your own API key, which is itself stored only in your browser.
Feedback
This tool is most useful when it reflects scams people are actually seeing. If a message slips through, or a flag doesn't make sense, that's useful to know — patterns and wording get refined over time based on exactly that kind of feedback.