What we store, and what we never store

What this is

Veriguard is a free scam checker built for Australians, with local coverage for the UK, US, New Zealand and Ireland as well. Paste a suspicious link, text, email or phone number and get an instant best-effort verdict — no account, no tracking, no data sold. It's an independent project by Aleks Linde (opens in a new tab) ↗, not a government service.

It gives a best-effort check only — it can't guarantee it catches every scam. For official reporting, use Scamwatch (scamwatch.gov.au) and ReportCyber (cyber.gov.au/report).

Where we work

Anyone, anywhere can paste a message here. The universal checks — links, shorteners, redirects, tracking, and requests for personal details — run the same way everywhere, because those tricks don't respect borders.

What varies is local knowledge: the brands scammers impersonate, the tax deadlines they exploit, the phone-number formats that signal a fake. We cover Australia, the UK, the US, New Zealand and Ireland in full, Canada in part, and fall back to country-neutral checks everywhere else.

To pick the right set we use a two-letter country code, and nothing finer — derived from your connection by the network, never read from your IP address by us, and not stored when you run a check. If it guesses wrong, because you're travelling or on a VPN, you can change the region yourself and check again.

Outside the countries we cover properly, “nothing found” can just mean “we have no local rules to find it with”. You'll see a note saying so — treat a quiet result as “not checked”, not “safe”.

Threat radar & scam calendar

The threat radar lists campaigns doing the rounds in the last few weeks, and the scam calendar shows when scams spike through the year — tax time, Black Friday, the Christmas parcel rush. Both are hand-written from published threat intelligence and read nothing about you; they're the same pages for everyone in your country.

Both are there to teach, and neither changes a verdict. The date is never part of the score: a tax scam in March is still a scam, and a genuine ATO email in July is still genuine. The radar also says plainly which campaigns we catch and which we don't yet.

Email is the one exception

You can forward a suspicious email to our check address instead of pasting it. What happens to the message is the same: read in memory, never stored, never used to train anything. The reply comes back to you and that's the end of it.

The difference is everything around it. Email has to be delivered before we can read it, and ours is delivered by Cloudflare Email Routing — which, like every mail service, keeps a record of each message it handles for about a month: your address, the subject line, the time, whether the message passed its authentication checks, and whether our reply went out. Not the body. Not the scam you forwarded.

We can't switch that off. It's part of how mail gets delivered, not a setting we chose, and no paid plan removes it — your own email provider is keeping a similar record at the other end. We'd rather tell you that than let “never stored” quietly cover something it doesn't.

So if you'd rather leave no record of having asked, paste the message here instead — nothing about a paste touches a mail server. Forwarding exists because it beats retyping a whole email on a phone. That's a fair trade, but it should be yours to make.

Replies aren't guaranteed, either. Whether we're allowed to answer depends on how your email provider vouches for the forward, and for some accounts we simply can't. If nothing comes back within a few minutes, don't read the silence as “probably fine” — check the message here instead.

When you report a scam

A report stores exactly these things, and nothing else:

• The scam content and identifiers you submit — with tracking parameters stripped, your own email headers removed, and personal details (emails, phone numbers, tax file numbers and the like) automatically scrubbed before storage. Everything shown publicly is also “defanged” so it can't be clicked or dialled by accident.
• A coarse location, never your IP address. At submission time we derive a region from the connection — state level for Australia (e.g. “NSW, Australia”), country level elsewhere — and store only that string. It's shown on the public report so people can see where a scam is circulating. Your IP is used in memory for rate limiting while the request is processed and is never stored by the application; city-level detail is deliberately not used.
• Your email, only if you choose to give it. It's used solely to follow up on your report. It is never published, never shared with anyone, and never used for anything else.

Public reports are community-submitted and unverified. Want one removed or have a question about your data? Use the “Report a bug” button (bottom-right) with your report reference and your email — we'll sort it out.

Why the rules are public

Detection logic is intentionally open source. Transparency lets the community improve it, and obscuring keyword lists wouldn't stop sophisticated scammers — it would only stop you from checking our work.

The browser extension

The extension carries the whole detection engine inside it, so what you check never leaves your device. There is no server call to score a message — not to us, not to anyone. Paste something with the browser offline and it still works.

It makes one network request, and it is not about you: it downloads a list of known malicious websites, on a timer, so it can recognise them offline. That request carries no query and no body — every copy of the extension asks for the same list in the same way, and the server learns only that someone asked. There is deliberately no “is this site dangerous?” lookup, because that would tell us exactly which sites you are checking.

It asks for no access to the pages you visit. No host permissions, no content scripts, nothing reading a tab. The only text it ever sees is text you typed into it, or selected and sent to it with a right-click.

Reporting a scam opens this website with the scam link or number filled in — the extension never submits anything itself. You see the form, edit it, and send it yourself. The message you pasted is not carried across; that field is left for you to describe in your own words, because it is the one most likely to contain your own details.

What it keeps on your device: the region you picked, and the downloaded site list. No history of what you checked is stored anywhere, by us or by it — there is nothing to request a copy of, because nothing is kept.

How many people use it, as the stores report it:

• Chrome (opens in a new tab) ↗Newly published — the store has not reported a user count yet.
• EdgeThe Chrome build runs on Edge unchanged, but it has not been submitted to Edge Add-ons.
• Firefox (opens in a new tab) ↗Newly published — the store has not reported a user count yet.
• SafariBuilt for macOS but not yet submitted to the App Store.

Those come from the store dashboards, which anyone can open and check against what we say here — each one is dated with the day it was read, because a count without a date quietly becomes a claim about today.

There is no figure for how many checks it has run, and there never will be. Scoring happens on your device, so no check is reported to us — there is no event to count, and creating one would mean the extension phoning home about the thing it promises never to send. We would rather publish a missing number with the reason attached than collect the data to fill it in.

None of this is a promise you have to take on trust. The extension ships unminified so it can be read, and the tests that enforce these claims (opens in a new tab) ↗ run against the built file — they fail if a second network call, a request body, or a way to inject markup ever appears in it.

Bug reports & tracking

A wrong verdict is a bug worth knowing about, in either direction. If something breaks we may offer to send diagnostics, but nothing is ever sent without your explicit consent — you see the exact details (page, browser, error message) before deciding. The scam content you pasted and any files you uploaded are never included.

No analytics scripts, no advertising pixels, no cookies for tracking. Your language preference and view settings live in your own browser's storage and never leave it. The site's security policy prevents pages from talking to any third-party server at all.

Blocking & reporting spam

Step-by-step guides for blocking and reporting spam — in Gmail, Outlook, Apple Mail and Yahoo, and on iPhone, Android and messaging apps — live on the Learn page.