Frequently asked questions

Yes. No account, no payment and no trial that runs out. There is a daily limit on the number of checks so the capacity is enough for everyone. If you hit it, you can check again the next day.

Chrome and Firefox. It also works in the browsers built on top of Chrome, so Edge, Brave, Opera and Vivaldi. Safari is not supported yet.

Open the page you are unsure about, click ScamZam in the toolbar, and press the button. After a few seconds you get one of four verdicts along with the reasons. To see the figures behind it, open the full report with "Read more".

The extension does nothing on its own. It only looks at a page when you ask it to.

No. The extension only has access to the single page you press the button on, and only at the moment you press it. It does not ask for access to your browsing history and cannot see the other tabs you have open.

That is not a promise, it is a technical limit: the extension only asks for the activeTab permission, which grants access to one tab at a time after a click.

The domain and an extract of the page's visible text. The address is cut down first, so shop.com/order/1234?token=abc becomes shop.com before anything leaves your browser. We only use the domain for the lookups anyway, and the rest is exactly where personal details tend to hide.

Email addresses, phone numbers and long strings of digits are stripped from the text in your own browser before it is sent. It is all set out in the privacy policy.

Because there are no cookies. No analytics, no ads, no third parties. The typeface is on our own server rather than Google's, and there is no embedded video or map.

You only have to ask permission if you store something on the visitor's machine. We do not, so there is nothing to ask about.

No. The list of what you have checked lives in your own browser and is never sent anywhere. You can delete it in the extension's history, and then it is gone.

We measure it, and we will publish the figure once it has been measured on the code that is running now. The measurement runs 200 perfectly ordinary websites through, drawn from the Tranco list without cherry picking, and counts how many of them get a warning they did not deserve.

The number is not zero, and it never will be. A security tool that claims it is never wrong is lying.

Partly, and it is worth knowing which half is which.

The first half is fixed rules applied to facts from public registries: when the domain was registered, whether it appears on a blocklist, whether the VAT number exists, whether the address is written with letters that merely resemble the real ones. Those rules do not guess.

The second half is two language models that read the page text for the language of scams. If they disagree, we ask a third. The models can move the overall verdict, but only within limits, and they cannot clear a site that is on a blocklist.

No. It means we found nothing that argues against it. It is an advisory assessment and not an approval, and you should still use your own eyes, especially before typing in card details.

The usual reasons are that the domain is new, that there are no company details on the site, that the domain has no mail server, or that the name resembles a well known brand. None of that means you have done anything wrong, but all of it is common on fake shops.

The verdict can be reviewed by a person. See the page for site owners or write to us. We correct it when it is wrong.

No, and it will never be possible. The second a verdict can be bought, it is worth nothing to the person reading it.