A service that says “trust us” about scams should show its working. This page explains the three verdicts and what each one promises, why an unknown sender is never called safe, and what happens when we get one wrong. It also publishes how the engine scores against scam lists we didn't write — including the one case we deliberately don't catch.
Something concrete vouches for this message — and we say what it is.
Nothing looks wrong, and nothing proves it's safe. Check before acting.
It matches a known scam pattern — and we name the pattern.
FAMILY_EMERGENCY_PATTERNFAMILY_DISTRESS_UNVERIFIED — the same story, nothing asked for. See why this one stays amber.BANK_CONTROL_COACHINGTRUSTED_CONTACT_MATCH — a positive signal, which is the only route to green.These are the real replies, word for word, from the same templates the service sends — not illustrations written for this page.
The most important rule in the engine is about what it will not say. A message is never called safe just because nothing looked wrong. “Looks fine” has to be earned by a positive signal: the sender is in the family's trusted contacts, or the link resolves to a verified official sender — the real Australia Post, the real myGov, a bank's actual domain.
An unknown sender with a clean-looking message stays at “be careful”, because a clean-looking message from a stranger is exactly what a good scam looks like. This is also why the free web checker answers “be careful” so often: a pasted message arrives with no sender and no family context, so there is nothing that can vouch for it. That's the honest answer, not a hedge.
The same rule holds when our own systems stumble. If a lookup we rely on is unavailable mid-check, the verdict can stay cautious or get stronger — it can never soften to green on a check we couldn't fully run.
The sender and every link are checked against verified official details — the real Australia Post, the real myGov, a bank's actual domain — and against lookalikes, newly registered domains and scam blocklists. A forwarded email's original sender is pulled back out of the quoted text, because that is where the tell usually hides.
Several hundred named patterns built from real Australian scams: urgency plus a payment, a relative in trouble plus secrecy, a wrong number that keeps chatting, a request to raise your bank's transfer limits. Each one that matches is recorded by name.
A scrambled fingerprint of the message is compared against campaigns other families have forwarded. The second household to receive a campaign benefits from the first one that reported it.
An AI review runs on top when it adds value, and the reply says so when it does. It can make a warning stronger. It is never permitted to turn any verdict into “looks fine”.
Green is unreachable from here — by design, not by policy.Four layers read the message. None of them can see the one thing that matters most on a supplier invoice, because it isn't in the message at all — it's in your own history. A real supplier's mailbox is compromised, the invoice is genuine in every other respect, the wording is theirs, and only the account number changed. There is nothing in the words to catch.
So when a forwarded document carries payment details, we remember them — and check the next one against the last. Three reason codes come out of that, and they are the only ones a business tends to see:
SUPPLIER_DETAILS_CHANGED — these payment details differ from what this sender used last time. The verdict cannot be green, whatever else the invoice looks like. The advice is always the same and is never wrong: ring them on a number you already have, not one printed on the invoice.SUPPLIER_DETAILS_CHURN — a third set of details inside ninety days. Suppliers change banks; they rarely change three times a quarter.Two things this deliberately is not. It is not a supplier list you upload or maintain: the memory assembles itself as a side effect of forwarding, and a supplier we have never seen simply gets an honest “we can't confirm this”. And it is not a record of your suppliers' bank details. We store one-way fingerprints, salted per business — enough to recognise that something changed, never enough to reconstruct what it was. A copy of that table names nobody and no account.
Confirming a change clears it: once you've rung them and paid, the new details become the ones we remember, and the same invoice stops being flagged.
Every check runs through a deterministic rules engine first: several hundred named patterns built from real Australian scams. Each verdict carries its reason codes — FAMILY_EMERGENCY_PATTERN for “Mum, I've been in an accident, don't tell Dad”, WRONG_NUMBER_OPENER for the friendly stranger who texted the “wrong number” and kept chatting, SAFE_ACCOUNT_PATTERN for a “bank” asking you to move money somewhere safe.
Deterministic means the same message always gets the same answer, any verdict can be replayed and audited afterwards, and when we tell someone why a message is a scam, the reason is the actual reason — not a story written after the fact.
Most “new” scams are old shapes wearing new words, and the rules target the shapes: urgency plus a payment method, a relative in trouble plus secrecy, a prize plus a fee. A genuinely novel template can score “be careful” before it scores “scam” — which is the failure direction we chose on purpose, because amber already does the protective work: it tells the person to check before acting.
Then the network effect closes the gap. Campaign fingerprints update from live forwards across all covered families, so the second household to receive a campaign benefits from the first one that forwarded it.
A detector tested only by its own authors proves nothing much, so we run the engine against third-party scam catalogues and publish the results either way. Two so far, most recently August 2026 — and the number that matters is the first one:
Panda Security's 20 scam-text examples — delivery, tolls, bank fraud, fake jobs, gift cards, the “wrong number” opener.
INS LifeGuard's top threats facing Australians in 2026 — voice-clone family emergencies, deepfake investment lures, myGov and Medicare impersonation, remote-access cons.
The eighteenth is held at “be careful” on purpose. It is a bare “Mum, I've been in an accident” — no money asked for, no secrecy, nothing else. A real one reads exactly the same, so we will not call it a scam. And we don't need to: “be careful” already says the one thing that is right either way — ring them on the number you already have for them. Making that message red would earn us a rounder number here at the cost of telling a mother her injured son is a scammer.
Read these honestly. These are our own runs against outside catalogues, not an independent audit, and catching known shapes is table stakes. The harder half is the innocent side: the same suite checks that a genuine super statement, a gym promo, a surprise-party text and a real “sorry, wrong number” are not called scams — because a service that cries wolf teaches people to stop forwarding, and then it protects nobody.
It is the right question, and anyone being told to forward messages to a number they don't recognise should ask it. Four things about this service can be checked without trusting a word on this page.
The only message you will ever receive from us is a reply to something you sent. Nobody here can text you out of the blue, which is the one thing every scam has to do to start.
Not at sign-up, not in a verdict, not ever. If a message claiming to be from us asks for any of those, it isn't us.
The free checker needs no account, no phone number and no payment — and nothing you paste into it is stored.
Every warning tells you to contact the organisation on a number you found yourself. A scammer's whole objective is the opposite: to keep you inside their message, tapping their link, ringing their number.
Anyone can reply WRONG to any verdict — it's in the reply itself. Every WRONG is read by a human, the message content is retained encrypted for 30 days precisely so mistakes can be reviewed, and confirmed misses update the rules and blocklists for every family at once. A verdict is a second opinion to help someone pause and check — it is not a guarantee, and we'd rather say that here than in small print.
That is the whole service: one number and one email address, saved once, answering whatever you forward it. You have just read how the answer is reached — including what we refuse to guess at.
One tap saves the number, the email and the logo. WhatsApp is the best way to send photos.