About ScamLens

ScamLens looks at a message, wallet address, UPI ID or handle you paste and shows the evidence it can find, sorted into three separate groups. It never gives a verdict about a person and it is not legal or financial advice. A high risk level means "stop and verify", not proof of anything.

It does not see your bank account, your phone or the other person's identity. No known reports. This does not mean safe.

There are no accounts. Each report is tied to a network fingerprint: a keyed hash (HMAC) of the IP address the report came from. We never store the IP itself.

An identifier appears in the Reported tier only when at least 2 different fingerprints reported it within 90 days and nobody has contested it. One fingerprint counts once per identifier, and can file at most 5 reports per day. Graph links (for example a UPI ID and a Telegram handle connected through one wallet) also need two different reporters, and wallets with more than 25 counterparties (such as exchanges) never link people.

What this implies, honestly: people sharing one network (an office, a college, some mobile carriers) count as one reporter, and one person who switches networks (mobile data, Wi-Fi, a VPN) can count as more than one. Treat a Reported badge as a reason to verify, not as proof.

The examples under “Common scams in India” on the home page are invented, use demo identifiers only, and follow scam types that the public pages below describe. They say nothing about how common each type is. The demo campaigns in the link graph follow the same pages (docs/DATASET.md in the repository).

• Digital arrest: A caller poses as police or a central agency, says a parcel with drugs was seized, keeps you on a video call and asks for a "verification" transfer. Source: The Tribune (PTI), report of an I4C advisory, “Advisory to curb 'digital arrest'” (2024-10-07), tribuneindia.com.
• Telegram task job: Paid "like" or rating tasks that pay a little at first, then ask for a joining fee or bigger deposits. Source: CareerIndia, “Fake job offers on Telegram and WhatsApp” (2026-09-17), careerindia.com.
• Fake KYC / bank block: An SMS says your account will be blocked unless you update KYC through a link and share an OTP. Source: Reserve Bank of India, “RBI cautions against frauds in the name of KYC updation” (2021-09-13), rbi.org.in.
• Crypto investment group: A contact builds trust, then moves you to a "mentor" group and a trading site that shows profits but blocks withdrawals. Source: The News Minute, “Chennai man loses Rs 10 lakh in 'pig butchering' fake crypto scam” (2022-05-05), thenewsminute.com.
• P2P "bank freeze": After a peer-to-peer crypto sale, the "buyer" says their account was frozen because of a fraud complaint and demands the money back. Source: Siasat, report of a Hyderabad police advisory, “Police advisory warns against P2P crypto trading frauds” (2024-05-03), siasat.com.

• Your check is never stored. If you choose to contribute a case, we store structured facts and, only if you tick it, a redacted excerpt you reviewed, visible only to the moderator, deleted with your delete code or after 90 days.
• Checks: your text is processed in memory and not stored or logged.
• Screenshots: Screenshot reading is off. Paste the text instead.
• Reports: for each identifier a keyed hash (HMAC) and a masked display (for example +91 98******10), the scam type you chose, the network fingerprint hash, and the date. There is no free-text note field. Reports expire after 90 days.
• Contributed cases (only if you choose to add one): the reports above, plus the category, channel, loss band, month and which patterns fired; the optional redacted excerpt; and a keyed hash of your delete code. Cases expire after 90 days.
• “Was this right?” answers: scam, genuine or not sure, with fixed reasons you tick, per identifier (as a keyed hash) and network fingerprint hash. No free text. Kept for 90 days.
• Usage limits: a hashed network key and a daily count, deleted after about 7 days. Daily limits per network: 40 checks, 100 link lookups.
• Your browser: one flag in this tab's session storage so the “New:” line on a result shows only once. It holds no text and is gone when the tab closes.
• Server logs hold only an event name, a status and a duration.
• Browser security rules (Content Security Policy): the page may only load scripts, styles, fonts and data from ScamLens itself, never from another website. Small scripts written into the page are allowed, because the framework we use needs them to start the app; scripts from any other site are blocked.

The sample messages and the seeded link graph are invented and always marked "Illustrative demo data - not a real investigation" or "Illustrative demo data". One sample uses a wallet that really is on the OFAC list, so the Verified tier can be shown with live data; the chat around it is made up.