What happens after you check something

We compare the address with warnings from OpenPhish, phishunt, TweetFeed, security researchers and reports sent in by the public. Our monitoring also looks for scams aimed at South African banks, SASSA, SARS, retailers and couriers. These records are useful evidence, not a complete list of every scam.

Protected server-side checks can follow a suspicious link’s redirects and read public page text without opening it on your device. Risky URLs are checked in urlz.dev’s remote security sandbox, which shows us which brand a page copies, how it behaves and where it sends what people type. urlz.dev also watches newly issued website certificates, so many fake bank sites are found before the first scam message goes out.

We use AI to read screenshot text and explain suspicious wording, alongside checks on links and numbers we find. Automated analysis can miss context or make mistakes. Remove personal details, passwords, PINs and one-time codes before sending anything.

A number is flagged only when a moderator explicitly approves it as a scam contact in a community warning that is currently published. Finding a number in a message isn’t enough. No reviewed match does not mean safe; a match is community evidence, not proof of who owns the number.

Warning cards and details may show a captured screenshot so you can recognise the page without opening it. The page may have changed since capture. If an image is missing or won’t load, the written warning remains available.

A result of “new to us” does not mean safe. No database knows every scam, and a convincing message can be dangerous before anyone reports it. We show what we know without manufacturing confidence.

We don’t collect stolen passwords, PINs or victim details. If a scam is leaking information, we report the location to the affected brand or a CERT so they can act. We do not download the data ourselves.