Verify before you trust.
Turn suspicious messages, links, and screenshots into grounded evidence, a defensible risk explanation, and safer next actions—before you open the link.
Privacy note
Do not submit passwords, OTPs, or sensitive personal data. Hybrid analysis sends submissions to the configured provider.
Synthetic training files
Load an example; analysis still runs live.
Every name, organization, message, and URL in these files is fictional.
Exact excerpts and technical facts stay traceable to the submission.
Model interpretation is labeled, schema-checked, and kept separate.
Every report ends with verification steps that do not trust the sender.
No automatic link visits. No identity verification. No “verified safe” badge.
A report with a chain of reasoning.
ScamTrace keeps three evidence sources distinct. External reputation can confirm a known record, deterministic rules establish repeatable observations, and AI adds bounded context. The report preserves each source for inspection.
Review the measured evaluation- Phase 1
Inspect
Configured reputation sources run first for privacy-screened URLs. Deterministic rules then inspect payment pressure, credentials, coercion, impersonation, channel switching, and URL structure. Public-page retrieval remains a separate opt-in.
- Phase 2
Interpret
A configured server-side model explains likely mechanisms while treating the submission as hostile evidence, never as instructions.
- Phase 3
Reconcile
Equivalent Rule and AI observations are grouped, provenance is preserved, and unsupported text quotes are removed.
- Phase 4
Verify
The report separates severity from confidence and turns findings into independently checkable next steps.
Privacy by restraint
No account, application database, or analytics SDK. Disclosed reputation checks may share a privacy-screened URL with configured providers; hybrid analysis sends bounded evidence to Microsoft Foundry. ScamTrace does not intentionally persist either.
Facts before inference
Observable excerpts and technical findings remain separate from model interpretation and confidence.
Honest uncertainty
Low detected risk means few implemented signals matched. It never becomes a claim that the content is safe.
Evaluation without the victory lap.
The repository includes 26 authored synthetic cases spanning scams, benign messages, suspicious URLs, and deliberately ambiguous content. These results test the deterministic engine only.
Synthetic testing does not demonstrate real-world fraud detection effectiveness. No hybrid AI benchmark is claimed, and the two false positives remain documented.
Rules-only / synthetic / 2026-10-10
npm run evaluateCases
26
Accuracy
92.3%
Precision
87.5%
Recall
100%
Confusion matrix
| Labeled | Flagged | Low |
|---|---|---|
| Risky | 14 TP | 0 FN |
| Not risky | 2 FP | 10 TN |
Failure review
Both false positives are ambiguous cases: a benign recruiter identity claim and an unencrypted HTTP page. They land in the product’s “uncertain—verify” band, not a malicious verdict. No false negatives appeared in this authored set.