Check something suspicious.
We’ll tell you kya lag raha hai.
Paste a message, link, or suspicious request before you act. A UPI ID, a number, or the whole WhatsApp forward — we read it for the tricks scammers actually use here.
The instant check runs in your browser. No account, ever. The deeper server check sends the text to be scored and then discards it — we keep which signals fired, never what you pasted. Exactly what we keep →
Seen a new scam? Report it →
How they actually get people.
Every one of these is running in India right now. The script barely changes — which is exactly why it’s catchable.
The one that empties accounts fastestKYC / PAN / Aadhaar "expiry"
An SMS or WhatsApp from "your bank" says your KYC has expired and the account will be frozen within 24 hours. A link takes you to a page that looks exactly right, and asks for your card number, then the OTP.
The one that starts with ₹150 creditedPart-time task job
A WhatsApp message from an unknown international number offers ₹2,000–5,000 a day for liking YouTube videos or rating hotels. You’re moved to Telegram. The first three tasks pay real money into your account. Then comes the "prepaid task" — deposit ₹10,000 to unlock a bigger commission. Every deposit needs one more deposit to withdraw.
The one people are too embarrassed to reportDigital arrest
A call claiming to be CBI, Customs, or the Narcotics Bureau: a parcel in your name contained drugs, or your Aadhaar was used for money laundering. They move you to a video call with a fake police backdrop and keep you on it for hours, telling you not to contact anyone. Then they demand a "verification deposit" to a bank account.
The one that reverses the direction of moneyQR code "to receive"
You’re selling something on OLX or Facebook Marketplace. The "buyer" sends a QR code and says scan it to receive the payment. Sometimes they even send a small amount first to build trust.
The one that uses your own screen against youFake customer care + screen share
You Google a helpline number for a refund and land on a paid ad or an SEO’d fake page. The "agent" is helpful, then asks you to install AnyDesk, TeamViewer, or Quick Support so they can "process the refund faster". Once installed, they watch you type your PIN.
The one that looks like a favourWrong transfer / refund reversal
Money arrives in your account. A stranger calls, distressed, saying they transferred it by mistake and please send it back. The incoming money is often from a stolen account or a credit that will be reversed — you end up paying twice.
The one that ends in blackmailInstant loan apps
A loan approved in four minutes with no paperwork — but the app demands access to your contacts and photo gallery. Repayment terms turn out to be brutal, and when you fall behind, they message everyone in your contacts and send morphed photos.
The one dressed up as financial literacyWhatsApp trading group
You’re added to a group with a "SEBI-registered" analyst and hundreds of members posting screenshots of profits. The calls are free and seem accurate. Then comes an invitation to a private app with a special IPO allotment or block deal. The app shows your money growing. It just can’t be withdrawn.
The first hour matters most.
Money moved out is sometimes recoverable, but the window is small and it closes fast. Report before you do anything else — before calling the bank, before blaming yourself.
Call 1930. Right now.
India’s national cybercrime helpline. It’s free, it works 24×7, and it can trigger a freeze on the receiving account. Then file the details at cybercrime.gov.in so there’s a record.
The same check, as one API call.
If you run a marketplace, a lending app, or a wallet, you’re already fighting this. Screen a message, a payee handle, or a listing before your user ever sees it — with server-side domain age, redirect resolution and an AI read the browser can’t do.
POST /v1/check
One endpoint. Returns a score, the tier, and every signal that fired — so you can show your user why, not just block them.
// request { "content": "Update KYC at http://sbi-verify.xyz", "responseLocale": "en" } // response { "tier": "high", "score": 9.4, "signals": [ { "code": "DOMAIN_NEW_BRAND_CLAIM", "severity": 5 }, { "code": "TLD_HIGH_ABUSE", "severity": 3 } ] }