How the Scam Message Scanner Works
This page explains the reasoning behind the verdict the Scam Message Scanner returns when you paste in a suspicious message. Everything happens locally in your browser — the message is read by a JavaScript model running on your device, never uploaded, never logged. The verdict and the score that drives it are produced by combining the outputs of eight detection layers (described below) into a 0–100 risk score, with the model trained to err toward the “catch the scam” side of borderline cases rather than the “avoid the false positive” side. The reasoning behind that choice is in the “Why a score, not a yes/no” section.
If you want the full feature catalogue with each detection check named individually, the About the Scanner page lists all 23 of them with examples. If you want the open machine-learning methodology, the model training page covers the training data, the held-out validation, the algorithms used and the limitations we know about. This page is the in-between — the “what the layers are, what the score means, how to read the result” explainer that suits a reader who wants to understand the output without wading through the model architecture.
Our Detection Methodology
The Scam Message Scanner uses a multi-layered analysis approach to identify scams, phishing attempts, and fraudulent messages. All analysis happens locally in your browser—no data is sent to any server.
Detection Layers
Risk Scoring System
The Scam Message Scanner combines all detection layers into a 0-100 risk score:
| Risk Level | Score | Meaning |
|---|---|---|
| Safe | 0-14 | Appears legitimate |
| Low | 15-29 | Minor suspicious elements |
| Medium | 30-49 | Multiple warning signs |
| High | 50-74 | Strong scam indicators |
| Critical | 75-100 | Very likely a scam |
How the Machine Learning Model Fits In
The eight detection layers above are features — the raw signals extracted from a message. They are not the verdict on their own. The Scam Message Scanner feeds those features, plus seven more (sender-domain reputation, attachment hints, link-to-text ratio, suspicious-TLD count, capitalisation anomalies, financial-amount mentions, and brand-mismatch flags), into a small two-layer neural network trained on a labelled corpus of known scams and known-legitimate messages, with a held-out validation set of 351 cases spanning 7 UK scam categories kept entirely separate from training.
The network was trained for 100 epochs using the Adam optimiser, producing a macro F1 of 98.5% across the 7 UK scam categories, with macro precision and macro recall both at 98.5%. In plain language: across the validation set, when the model says a message is a scam it is right around 98.5% of the time, and when a message really is a scam the model catches it around 98.5% of the time. The full per-category breakdown is on the About the Scanner page, which is the canonical reference for the scanner’s validation results. The model is tuned to err toward catching borderline scams rather than minimising false positives on borderline-legitimate marketing emails, because the cost of a false negative on a scam is much higher than the cost of a false positive on a real marketing message.
The model runs entirely in your browser — about 18 KB of weights are loaded once and cached. Inference takes 2–3 milliseconds per message on a modern phone or laptop. Nothing is uploaded; if you want to confirm this, open your browser's network tab while you run a check and you'll see no requests fired during analysis.
Why a Score, Not a Yes/No
The 0–100 risk band exists because real-world messages sit on a spectrum. A genuinely transactional email from your bank usually scores 0–10. A delivery notification from a courier you do use might score 15–25 because it contains a tracking link. A "your account has been suspended" email impersonating a major brand will typically score 60–90, depending on how well-crafted it is. The score is meant to be informative — a 35 isn't a scam alarm, it's a flag that two or three suspicious patterns combined and you should look more carefully before clicking anything.
If you ever see a score that surprises you — a high score on a message you're confident is real, or a low score on something that turned out to be a scam — please report it through the report page. Those misclassifications are the single most useful training data we get.
How to read the result
The score tells you the model’s level of confidence that the message you pasted is part of a known scam pattern. It is a probability-shaped number, not a verdict on the sender’s character or intent. A “Low” score on a real, well-meaning message confirms what you already suspected. A “Critical” score on a message that looks suspicious gives you the structural evidence to act on that suspicion confidently. The grey area is the “Medium” band: the model has spotted enough signals to be concerned but not enough to be certain, and that is where the breakdown below the score becomes useful — which checks fired, and how strongly, is more decisive than the headline number.
Two practical rules apply regardless of the score:
- A “Safe” verdict is not an instruction to act on the message. It means the structural signals the model looks for are not present. Some sophisticated targeted attacks have no structural signals and rely entirely on the relationship the recipient has with the sender. Verify the request through a separate channel (phone the brand on a number you found yourself; log into your account directly) before doing anything significant on the basis of any email or text.
- A “Critical” verdict is not always conclusive either. If the message reads as plausible to you and the brand is one you actually have a relationship with, the verdict could be a false positive — the model occasionally flags legitimate marketing or transactional messages that share structural features with phishing. Cross-check by opening the brand’s app, calling them, or searching your email history for prior real correspondence before discarding a message that may matter.
Privacy & Security
The Scam Message Scanner is designed with privacy as a core principle. All analysis happens locally in your browser — no messages are sent to any server, no account is needed, and no data is collected or stored.
Limitations & Disclaimers
While the Scam Message Scanner is effective, no detection system is 100% accurate. Sophisticated scams may evade detection, and legitimate messages can occasionally trigger warnings. Always use your own judgement and, if unsure, contact the organisation directly through verified channels.