Scam Checker: How to Check Links, Sellers and Messages

To check whether something is a scam, start with what you are being asked to do. Then examine the available evidence and confirm the request through a channel you already trust. For an unexpected account alert, that usually means opening the organization’s official app or using a known contact number instead of following instructions in the message. The FTC recommends independently contacting the company when a suspicious message asks you to open a link or attachment. Consumer Advice

A scam checker can uncover warning signs. Its result alone cannot establish who controls a seller account, whether a caller represents your bank, or whether a payment request is authorized.

This page is a manual checking guide. The scanning and registration tools linked below are external services. DeepSearch.tools starts with a person’s name, with optional city or company context, for public-information research.

Already paid or shared financial information? Contact your bank or payment provider immediately through its official channel. You can investigate further afterward. If you shared a password, verification code, or device access, use the response sections below to match your next steps to what happened.

Start your scam checker workflow with the situation you have

Keep three questions separate:

1. Does this person or business exist?
2. Is this communication actually from them?
3. Is this particular request legitimate?

Finding a real company or a matching public profile addresses only part of the first question. It does not settle the other two.

Check the Request Before Checking the Technology

Write down the action the sender wants you to take. For example:

• “Enter my banking password.”
• “Read out a code sent to my phone.”
• “Move money to a new account.”
• “Pay this seller outside the marketplace.”
• “Install an app so someone can control my computer.”
• “Keep this conversation secret.”

This makes the decision easier to evaluate than a vague question such as “Does this message look professional?”

An unexpected request to transfer money to “protect” it deserves an immediate stop. The FTC warns about impersonators who invent account emergencies and direct people to transfer savings, buy cryptocurrency, or hand over valuables. Verify the alleged problem with the real institution through a channel you already know. Consumer Advice

Likewise, an unexpected caller asking for a sign-in or account verification code may be trying to use it to enter your account. Entering a code into the real service during a login you initiated is different from reading it to someone who contacted you. Consumer Advice

Urgency, secrecy, and a change in payment instructions deserve attention even when the message contains no suspicious link. A scam can operate entirely through conversation.

A real bill or account problem can also have a deadline. Pausing the suspicious interaction should lead to prompt independent verification, especially when the underlying issue might be genuine.

Choose a scam checker that answers the right question

Different tools examine different evidence. Use them with a specific question in mind.

Google describes Site Status as a way to check whether Safe Browsing has identified dangerous content. VirusTotal explains that it aggregates security findings, including information that can help identify false positives. URLhaus explicitly focuses on malware distribution. ICANN provides registration data. These are distinct kinds of evidence. Google Safe Browsing

When reading any result, ask:

• What was checked? A domain, a particular URL, a file, or only the message wording?
• When was it checked? A previous report may not describe the current page.
• Did the check finish? An error, timeout, or unsupported address is an incomplete check.
• What does the label mean? “No data,” “not detected,” and “verified” are different claims.
• What was outside the tool’s scope? A malware check cannot confirm that a seller will ship an item.

Treat a detection count as the output of those checks. It is not a percentage chance that you will be safe.

Protect Your Information Before Submitting Anything

A checking service should not become another place where you unnecessarily expose sensitive information.

Before pasting a message or uploading a screenshot, remove passwords, verification codes, full card and bank account numbers, Social Security numbers, identity documents, and unrelated private conversation. Keep an original copy securely if you may need evidence; make a separate redacted copy for outside analysis.

Be especially careful with complete URLs. A password-reset link, private document link, invitation, or sign-in link may contain information that grants access. Sensitive material can appear in the path as well as after a question mark. Removing query parameters alone is not a reliable privacy check.

Submission policies also differ:

• VirusTotal says scanning reports are shared with its public community, and submitted file or page contents may be shared with premium customers.
• urlscan says Public scans are visible publicly. Unlisted scans remain visible to urlscan Pro customers, so “unlisted” does not mean private. Its documentation identifies password-reset links, private documents, invitations, and URLs containing personal information as submissions requiring care. docs.virustotal.com

Also check what the service actually does. For example, urlscan browses submitted URLs and records the resulting page activity. Having a service investigate a link can therefore cause the destination to be visited, even when you do not open it yourself. urlscan.io

For a private account link, the better next step is usually to visit the real service independently. Checking only its domain may reduce disclosure, but that narrower check does not evaluate the full original link.

How to Check a Suspicious Link

1. Inspect the address without navigating to it

On a desktop, hovering over a link can reveal its destination. You can also use the context menu to copy the link address into a plain-text note.

Avoid pasting a suspicious address into the browser’s address bar, where an accidental Enter could open it.

On a phone, use a copy-address option only if you can do so without opening the destination. If the interface makes that difficult or starts loading a preview, skip the link inspection and use the organization’s official app or known website.

A screenshot may show only a link’s displayed text. It cannot reveal an underlying destination that was not visible in the screenshot.

2. Identify the actual hostname

Suppose you have independently established that a fictional delivery company uses parcel.example.

The following addresses illustrate different structures. The .example ending is reserved for examples; these are not real suspicious websites. iana.org

These examples identify the initial host in the address. They do not tell you whether the page redirects somewhere else or whether its content is trustworthy. MDN’s URL documentation explains the distinction between the host, optional user information before @, and the path. MDN

Do not reduce domain checking to “look at the last two words.” Some public suffixes contain multiple parts, such as .ac.uk, so the registrable domain boundary can differ. If the address is difficult to interpret, use the organization’s independently confirmed entry point instead. developer.mozilla.org

3. Treat shortened links and QR codes as unresolved destinations

A familiar short-link service does not establish where its link leads. Checking the shortener’s main domain does not check the particular destination.

A QR code can also carry a web address. If your reader shows a preview, inspect it before opening. For a payment request, verify the payment route independently. The FTC has warned about replacement QR codes placed over legitimate parking-payment codes. Consumer Advice

You do not have to expand every suspicious link to make a useful decision. If an alleged delivery problem can be checked in your existing order account, do that.

4. Interpret HTTPS and domain records carefully

HTTPS protects the connection. It does not establish that the operator is honest; scam sites can use encryption too. Consumer Advice

Domain registration dates can help test a story. A recently created domain warrants more questions when a seller claims to have operated that exact website for many years. But a new domain can belong to a legitimate business, and an older domain does not validate a current offer.

ICANN’s date fields concern the domain registration. An “updated” date should not automatically be read as the website’s launch date or a change of ownership. Public contact details may also be redacted under applicable laws and registration policies, so hidden contact information alone is not evidence of fraud. lookup.icann.org

Worked example: A delivery text that arrives while you are expecting a package

This is a fictional scenario.

You receive:

“Delivery paused. Confirm your address and pay a $1.50 handling fee within 30 minutes.”

You are expecting a package, which makes the message feel relevant.

Use this process:

1. Leave the message’s link unopened.
2. Open the retailer account where you placed the order.
3. Retrieve the tracking number from that order.
4. Check the shipment through the carrier’s independently accessed website or app.
5. If a delivery issue appears there, resolve it through that official route.
6. If the message remains unverified, do not pay through it.

The small amount does not limit the potential exposure if the page requests full card information.

For USPS specifically, the Postal Inspection Service says its package-tracking texts require the customer to request the service and do not contain a link. That is a USPS-specific rule; do not assume every carrier uses identical messaging practices. United States Postal Inspection Service

How to Check an Email, Text, or Direct Message

Inspect the sender and the requested action separately

Expand the sender details where possible. Check the complete email address rather than only the display name. If a different Reply-To address is shown, consider why replies would go elsewhere.

A mismatch deserves investigation, but legitimate organizations can use outside mailing or support services. The useful question is whether the organization confirms that channel.

Then examine the request:

• Were you expecting this invoice, document, refund, or account alert?
• Has the payment destination changed?
• Are you being asked for credentials, a verification code, or an unexpected attachment download?
• Can the underlying task be confirmed through your existing account or contact?

Professional writing, a correct name, and a familiar logo do not answer those questions.

Avoid asking the suspicious sender to confirm their own legitimacy. Use contact details from an earlier trusted relationship or the organization’s independently verified channel.

Understand what email authentication actually checks

Email authentication can add useful context, but it has a narrower purpose than authenticating a business request.

• SPF checks whether the sending server is permitted to send for the domain used in the relevant mail-envelope identity.
• DKIM checks a domain’s cryptographic signature over signed parts of the message.
• DMARC checks whether an authenticated SPF or DKIM identity aligns with the domain in the visible From address and publishes handling policy for failures. Gmail Help

Finding SPF or DMARC records in public DNS does not prove that the particular message in your inbox passed those checks. For that, use your email provider’s security details or original-message headers. Pasted body text or a screenshot generally does not contain everything needed.

Google’s Gmail authentication guide explains how to inspect message details. It also notes that unauthenticated messages are not necessarily spam and that spammers can authenticate their mail. Gmail Help

A scammer can correctly authenticate mail from a domain they control. A real organization’s mailbox can also be compromised. For an important payment or account change, independently verify the request regardless of the technical result.

Worked example: New bank details in an existing invoice thread

This is a fictional scenario.

A supplier you have used before sends a message in an existing email conversation:

“Please use our updated bank account for this invoice.”

The message looks familiar. Even if its authentication checks pass, the new payment instructions still need confirmation.

Call the supplier using the number already in your records. Ask them to confirm the invoice and the change through their established payment-verification process. Do not use a new “accounts department” number supplied in the same message.

If you cannot obtain that confirmation, hold the payment. If the change is confirmed, complete it through the verified process.

The FBI’s business email compromise guidance recommends using a secondary channel to verify changes in account information. A familiar conversation is not a substitute for that check. Internet Crime Complaint Center (IC3)

How to Check Whether an Online Seller Is Legitimate

A seller check needs to examine the transaction itself. A website can contain no detected malware and still fail to deliver what you buy.

Establish which seller you are evaluating

Record the exact website domain or marketplace profile. If a business name is provided, note its location and legal name where available.

When the seller claims to represent a registered business, compare those details with the relevant official business registry. Then ask what connects that business to this particular website, account, or payment recipient.

A registration record establishes that an entity has a record. It does not establish that the person messaging you controls that entity.

Likewise, an online business does not need a public storefront to be legitimate. Focus on whether its specific claims can be checked.

Examine the actual offer

Read the item description, condition, total cost, delivery promise, and return terms.

For a used item, request relevant condition details or additional product photos through the marketplace’s messaging system. For an unfamiliar store, clarify where returns go and which charges you would bear.

Photos and written answers help evaluate the offer, but they do not guarantee possession or delivery. Avoid treating a polished listing as the end of the investigation.

The FTC recommends reviewing the individual seller and item, including whether photos actually show the item being offered, and checking the marketplace’s terms. Consumer Advice

Read reviews as evidence, not a verdict

Search the exact domain and business name separately, adding terms such as “review,” “complaint,” or “scam.”

Look for specific accounts of completed purchases, delivery problems, refunds, or customer service. Check dates and whether the comments concern the same seller.

A complaint about another business with a similar name is not evidence against this one. Several directories repeating the seller’s description are also not several independent confirmations.

The FTC advises checking multiple review sources and warns that both positive and negative reviews can be fabricated. Star ratings alone are insufficient. Consumer Advice

Verify the payment route and applicable protection

Before paying, establish:

• Who will receive the payment.
• Whether you are still using the marketplace’s actual checkout.
• Whether any buyer protection applies to this item and transaction type.
• What evidence and deadlines would apply to a dispute.

The FTC advises against moving purchases outside a marketplace’s payment system and recommends safer methods such as credit cards or systems with applicable buyer protection. A payment app’s familiar logo does not, by itself, establish that your purchase is protected. Consumer Advice

If an unfamiliar seller insists on gift-card codes, cryptocurrency, or a payment route that leaves you without meaningful recourse, you can decline the transaction. You do not need to prove criminal intent first.

Worked example: A plausible seller with an unacceptable payment request

This is a fictional scenario.

A camera seller has a convincing profile and provides the name of a real business. They then offer a lower price if you leave the marketplace and send a bank transfer to a different recipient.

Even if a website check shows no warning, three questions remain unanswered:

1. Does this account actually belong to the named business?
2. Why is the recipient different?
3. What remedy applies if the camera never arrives?

Ask for confirmation through the business’s independently established contact channel and keep the purchase within an eligible, protected checkout process.

If the seller refuses and continues pressing for the transfer, stop. The existence of a business and an absence of malware findings do not resolve the payment risk.

Where a name search can help

If a seller or contact has given you a plausible full name and you need additional public-information context, you can search the name on DeepSearch.tools. Optional city or company context can help distinguish candidates.

Compare relevant public details carefully. A shared name alone is insufficient, and missing information is not evidence that someone is dishonest.

Most importantly, finding a matching person does not establish that the account contacting you belongs to them. Use the result as a lead to evaluate, then verify the actual communication and transaction independently.

How to Check a Suspicious Phone Call

Caller ID is not proof of identity. The FTC warns that scammers can make a familiar name or number appear on your screen. Consumer Advice

For an unexpected call about money, account access, or an emergency:

1. End the call.
2. Find a number from a source you already trust, such as your bank card, statement, or existing official app.
3. Dial it yourself.
4. Ask whether the organization contacted you and whether the claimed problem exists.

Avoid relying on a replacement number the caller supplies.

If you must search for contact information, inspect the domain carefully. The FBI describes account-takeover schemes that use misleading search advertisements to lead people to imitation login sites. A prominent search placement is not authentication. Internet Crime Complaint Center (IC3)

For a purported family emergency or “new number” message, contact the person using a number you had before the incident. If you cannot reach them, ask another trusted relative or friend. A familiar voice alone is insufficient; the FTC warns that voice cloning can be used in family-emergency scams. Consumer Advice

Worked example: A caller asks for a code to “cancel fraud”

This is a fictional scenario.

A caller says they are investigating a fraudulent payment. They know your name and tell you to read out a code that just arrived.

Before doing anything, read the code message itself. If it describes a sign-in, password reset, or payment approval you did not initiate, the caller’s explanation does not make that action appropriate.

End the call and contact the bank through its official channel. If you already shared the code, tell the bank which code or approval was involved and when it happened.

Do not wait for the code to expire before acting. It may already have been used.

Turn scam checker evidence into a decision

You do not need a universal “scam score.” You need an action supported by the available evidence.

Stop when the risk is clear enough

A credible threat warning, an independently denied payment request, or pressure to surrender login codes provides a reason to stop the interaction.

A technical warning can still be wrong. Google’s Web Risk documentation explicitly recognizes both false positives and missed threats. If you think a warning is mistaken, resolve it through an independently verified support route instead of bypassing it to test the site yourself. docs.cloud.google.com

Leave unresolved cases unresolved

“No detections,” “no complaints found,” and “could not complete the check” do not establish legitimacy.

Record what remains unknown. For example:

“No malware warning was found, but I have not confirmed who receives the payment or whether the marketplace covers this transaction.”

That is a useful result because it identifies the reason to wait.

Continue through the channel that verified the request

If your bank’s actual app confirms an account issue, handle it there. If a supplier confirms a payment change through its established process, follow that process.

You can complete a legitimate task without returning to the original suspicious message.

If no alert appears in an account, the message may remain unverified. For a potentially real deadline or account problem, contact official support rather than assuming the absence of an alert settles everything.

What to Do If You Already Clicked, Paid, or Shared Information

Choose the branch that matches what happened. If several apply, address all of them.

You only read the message or replied

Reading or replying does not, by itself, establish that your account or device was compromised.

Stop the conversation if it is suspicious. Verify any underlying claim separately, preserve relevant evidence, and use the platform’s reporting or blocking controls.

If you provided only an email address or phone number, stay alert for more convincing follow-up attempts. That exposure is different from sharing a password, payment authorization, or device access.

You opened a page but did not enter information or approve anything

Close the page. Check whether anything downloaded and whether you installed software or granted a permission.

Do not call a “support” number displayed by the page or install a supposed repair tool. Microsoft explains that fake support warnings can appear as alarming browser pop-ups; their appearance does not establish that the claimed infection exists. Microsoft Support

Keep your browser and operating system updated. If you suspect a link or attachment downloaded harmful software, the FTC recommends updating your security software and running a scan. Consumer Advice

A click alone is not enough to conclude either that you were infected or that nothing happened.

You entered a password

From the real service, preferably using a device you trust:

1. Change the password to a unique one.
2. Replace it anywhere else you reused it.
3. Use the service’s option to sign out other sessions.
4. Check recovery email addresses and phone numbers.
5. Review recent activity and any unfamiliar forwarding rules.
6. Enable or review multifactor authentication.

If you cannot sign in, use the provider’s official account-recovery process. The FTC’s hacked-account recovery guide explains these steps. Consumer Advice

For a Google account, its compromised-account guide also covers recent security events, connected devices, and suspicious settings. Google Account Help

You shared a verification code or approved a login

Contact the relevant bank or account provider immediately through its genuine channel. Explain what the code message said, what you approved, and when.

Treat the event as a possible completed authorization. A code’s later expiration does not tell you whether it was used earlier.

Review the account’s recent activity and security settings with the provider’s guidance. The FBI describes account-takeover schemes that obtain one-time passcodes after capturing credentials. Internet Crime Complaint Center (IC3)

You granted a suspicious app access to an account

Go to the real account’s settings and review connected apps or third-party permissions. Remove access you do not recognize or no longer want.

Check what information the app could access. Revoking permission helps stop further access but does not automatically erase information already obtained. Google’s linked-app management guidance explains the distinction between removing access and deleting data held by another app. Google Account Help

You entered card details or sent money

Contact the appropriate provider now. Explain exactly what happened, including whether you initiated the payment after being deceived or someone made it without your permission.

The FTC’s scam-recovery guide provides instructions by payment method. Recovery is not guaranteed. For fraudulent transfers, IC3 also recommends promptly asking the originating financial institution about recall or reversal. Consumer Advice

If you typed financial information into a suspicious page but did not press Submit, do not assume it remained private. Treat it as potentially exposed. The Postal Inspection Service specifically cautions about interactions with smishing pages even when the victim did not click Submit. United States Postal Inspection Service

Do not pay an unsolicited “recovery specialist” who promises to retrieve your money for an advance fee. The FTC identifies this as a common way to target people again after a loss. Consumer Advice

You installed software or allowed remote access

End the remote session. If you cannot stop it, disconnect the affected device from the network while you seek trusted help from another device.

Do not continue banking or changing passwords while a suspicious remote session is active. Contact your financial institution from a device you trust.

Use updated security software, review the installed remote-access tools, and obtain help from your device manufacturer, workplace IT team, or another established support provider. The FBI recommends scanning for malicious software, considering professional cleaning, protecting financial accounts, and changing passwords after a scammer has had device access. FBI

You shared a Social Security number or identity information

If information may have been exposed but you do not know whether it was misused, consult IdentityTheft.gov’s exposure guidance. If someone has used your identity, IdentityTheft.gov provides reporting and recovery steps. Consumer Advice

Consider a credit freeze with each of the three major credit bureaus: Equifax, Experian, and TransUnion. The FTC explains that freezes are free and help prevent new credit accounts from being opened in your name. They address new-credit risk; you still need to secure existing accounts and handle any affected payments. Consumer Advice

Keep a Short Evidence Log

A useful record separates what someone claimed from what you independently confirmed.

Use this template:

• Received: Date, time, and communication channel.
• Claimed sender: The name or organization presented to you.
• Requested action: Payment, login, code, download, or another instruction.
• Evidence retained: Original message, sender address, URL, screenshots, and transaction details.
• Independent check: Who you contacted, how you found their contact details, and what they confirmed.
• Unresolved questions: Anything you still cannot establish.
• Action taken: Account protection, payment report, platform report, and reference numbers.

Preserve original emails and their headers where available, along with receipts and relevant conversations. Store sensitive evidence securely rather than posting it publicly.

IC3 advises retaining original evidence and explains that its complaint form does not accept attachments. Save a copy of your submitted complaint when prompted. Do not let collecting a perfect evidence package delay an urgent call to your bank. Internet Crime Complaint Center (IC3)

Where to Report a Scam

The channels below are primarily for U.S. readers. Readers elsewhere should also use their local consumer-protection, cybercrime, and financial-provider reporting routes.

The FTC confirms the phishing-email and text-reporting routes above; USPIS provides its specific reporting instructions. Consumer Advice

A report does not replace contacting the institution that can protect your account or attempt to stop a payment. It also does not guarantee an investigation, reply, or recovery.

If someone is in immediate physical danger, contact emergency services or local police. IC3 specifically directs people facing immediate danger to 911 or local law enforcement rather than relying only on an online complaint. Internet Crime Complaint Center (IC3)

Scam Checker FAQs

Is there a free way to check for a scam?

Yes. You can inspect a message, verify a request through an established contact, research a seller, and consult public resources without buying a report.

VirusTotal also describes its core service as free for end users’ noncommercial use, subject to its terms. That does not make ordinary submissions confidential or turn the result into a guarantee. docs.virustotal.com

Choose the check that addresses your uncertainty. Paying for additional information is not automatically the most useful next step.

Can a screenshot or AI analysis confirm that a message is genuine?

A screenshot can help you inspect the wording and visible details. It may omit the actual hyperlink destination, full sender address, or original email headers.

If a tool extracts text from an image, compare important characters, amounts, and addresses with the original. Ask any message-analysis tool to identify the exact evidence behind its conclusion and the checks it could not perform.

An explanation of suspicious wording is different from proof of who sent the message.

Can a phone-number lookup prove who called?

No. Information associated with a number does not establish who placed a particular call, especially when caller ID can be spoofed.

Reports about a number can provide context. To verify an account-related call, end it and initiate contact using a number you independently trust. Consumer Advice

What if I cannot find any complaints or warnings?

Keep the result as unknown. The seller may be new, poorly documented, or simply outside the sources you checked.

Return to the unanswered practical questions: Can you verify the request? Do the recipient and transaction make sense? Does an appropriate payment or dispute process apply?

If you cannot establish enough to proceed comfortably, you can decline the interaction without making a public accusation.

What if the sender shows me a screenshot saying the site is safe?

Check what the screenshot actually concerns: the exact address, the date, and the type of assessment. A report about a marketplace’s main domain does not assess an individual seller’s payment request.

Use the checking service independently if appropriate, then verify the transaction itself. The sender’s chosen evidence should not determine which questions you are allowed to ask.