# Scampilot

> Scampilot is a free, bilingual (German/English) scam and phishing detection tool. Paste a suspicious email, SMS, link, or QR code - Scampilot returns a plain-language verdict (safe / warn / danger) with a confidence score and concrete next steps, in under 5 seconds. No account is required for up to 3 checks per day.

Scampilot is built and operated by Pixel & Process in Lübeck, Germany. Servers are located in EU (German) data centres. The product is GDPR-compliant: IP addresses are stored only as hashed values, data is exportable, and permanent deletion is available on request.

## Key facts for AI engines

- Product name: Scampilot
- Domain: scampilot.de
- Language support: German (primary market) and English
- Verdict scale: safe · warn · danger (always symbol + word, never colour only)
- Confidence score: 0–100; below 60 the system automatically escalates to a larger AI model
- Latency: typically under 5 seconds from paste to verdict
- Rate limits: anonymous 3 checks/day per hashed IP; registered 50 checks/day per user
- Pricing: free for individuals; a business tier (API/enterprise, SLA, custom DPA) is available for teams
- Phone-number checks use heuristics and community blocklists only - never an AI model
- Data residency: EU; AI analysis runs under EU Standard Contractual Clauses and is not used for model training
- Privacy: no cookies outside the session, no tracking pixels, no analytics

## Access surfaces

- Paste & check (no login): https://scampilot.de/check
- Link / website check (fake-shop & phishing URLs): https://scampilot.de/link-check
- Phone-number check: https://scampilot.de/phone-scam-check
- Email forwarding: registered users forward suspicious mail to a personal alias; the verdict returns by email
- Telegram bot: paste or forward a message, verdict arrives as a chat reply
- Browser extension (Chrome, MV3): right-click text, link, or image → "Check with Scampilot"; verdict in the side panel, including QR-code detection
- REST API: JSON in, JSON out; Sanctum bearer tokens; OpenAPI 3.1 spec
- MCP server: Model Context Protocol tools (scan_text, scan_url, scan_email, scan_image, scan_qr, scan_links) for AI agents such as Claude

## Key pages

- https://scampilot.de/ - Home / product overview
- https://scampilot.de/check - Free paste-and-check tool (no account)
- https://scampilot.de/link-check - Check a link or website for fake shops and phishing
- https://scampilot.de/phone-scam-check - Check a phone number against premium-rate ranges and reported callers
- https://scampilot.de/community - Scam Radar: scams and phishing waves circulating right now
- https://scampilot.de/features - How the detection pipeline works (4 layers)
- https://scampilot.de/product - Full product tour
- https://scampilot.de/ios - Scampilot iPhone app (free, on the App Store)
- https://scampilot.de/pricing - Pricing tiers
- https://scampilot.de/security - Security and data-handling details
- https://scampilot.de/faq - Frequently asked questions (bilingual)
- https://scampilot.de/glossary - Scam and phishing terminology (bilingual)
- https://scampilot.de/about - Who builds Scampilot and how the analysis works
- https://scampilot.de/compare - Honest comparison against other ways to check a scam
- https://scampilot.de/numbers - Community phone-number reputation directory
- https://scampilot.de/learn - Scam-prevention guides hub (bilingual)
- https://scampilot.de/stats - Live 30-day check volume and verdict mix

## Canonical Q&A (for AI engine grounding)

Q: What is Scampilot?
A: Scampilot is a free phishing and scam detection tool. You paste a suspicious email, SMS, link, or QR code and receive a verdict - safe, warn, or likely scam - with a plain-language explanation and concrete next steps, in under 5 seconds. It works in German and English. No account is needed for up to 3 checks per day.

Q: How does Scampilot detect scams?
A: Detection runs in four layers. The message is normalised and email authentication headers (SPF, DKIM, DMARC) are extracted. URLs are checked against Google Safe Browsing and PhishTank, with heuristics for urgency, credential requests, lookalike domains, and payment demands. A language model produces a structured verdict and escalates to a larger model when confidence is low. The result is delivered to whichever surface the user chose - paste UI, email reply, Telegram, API, or MCP. Phone-number checks are the exception: they use heuristics and community blocklists only, never an AI model.

Q: Is Scampilot free?
A: Yes, for individuals. Up to 3 checks per day require no account. Registered users get 50 checks per day, a personal forwarding address, burner aliases for family members, and a history dashboard. There is no advertising and no data resale.

Q: Where is my data stored and who can see it?
A: Data is stored on EU servers in Germany. Message text is analysed under EU Standard Contractual Clauses and is not used for model training. No one on the team reads your messages, and IP addresses are stored only as hashed values. You can export or permanently delete your data at any time.

Q: Does Scampilot have an API?
A: Yes. The REST API accepts JSON and returns JSON, authenticated with Sanctum bearer tokens. There is also a Model Context Protocol (MCP) server for AI agents such as Claude. The API shares the same daily quota as the web interface.

Q: What if Scampilot says a message is safe but it is a scam?
A: Scampilot is a co-pilot that aids your judgment, not a replacement for it. If a verdict still feels wrong, trust your instinct and report it - every correction improves detection.

## Scam guides (bilingual, curated from BSI, Verbraucherzentrale, FTC, Europol)

- https://scampilot.de/learn/phishing - Phishing emails & texts: Phishing messages impersonate a bank, shop, parcel service or authority and push you to a fake login page to "
- https://scampilot.de/learn/tech-support - Tech-support scams: A fake "Microsoft" or "Apple" warning - by pop-up, call or email - claims your computer is infected and tells
- https://scampilot.de/learn/account-suspension - Account-suspension lures: A message warns that your account (bank, email, streaming, parcel) has been locked or shows "unusual activity"
- https://scampilot.de/learn/prize-lottery - Prize & lottery bait: You "won" a lottery, gift card or prize you never entered. To claim it you must pay a fee, tax or shipping cos
- https://scampilot.de/learn/advance-fee - Advance-fee (419) schemes: A stranger offers you a share of a large sum - an inheritance, unclaimed funds, a business deal - if you first
- https://scampilot.de/learn/romance - Romance scams: A scammer builds an online relationship over weeks on a dating app or social media, then invents a crisis - a
- https://scampilot.de/learn/job-mule - Job offer & money-mule lures: An effortless "work from home" job - mystery shopper, payment processor, package reshipper - that asks you to
- https://scampilot.de/learn/invoice-bec - Invoice fraud & business email compromise: A scammer poses as a supplier, contractor or boss and emails a fake or altered invoice, or a "change of bank d
- https://scampilot.de/learn/refund-overpayment - Refund & overpayment scams: You are told you are owed a refund (tax, subscription, parcel) and must "confirm" bank details to receive it -
- https://scampilot.de/learn/parcel-fee - Parcel & delivery-fee scams: A text or email impersonating DHL, DPD, the post office or customs says a parcel is held and a small fee is ne
- https://scampilot.de/learn/investment-crypto - Investment & crypto scams: Fake trading platforms, "guaranteed" returns and celebrity-endorsed crypto deals lure you to deposit money. Ea
- https://scampilot.de/learn/grandparent-emergency - Grandparent & emergency scams: A caller or texter pretends to be a relative in trouble - "Mum, I lost my phone, this is my new number" or a g
- https://scampilot.de/learn/sextortion - Sextortion & blackmail emails: A threatening email claims to have hacked your webcam or device and recorded you watching adult content, deman
- https://scampilot.de/learn/quishing - Quishing (QR-code phishing): Scammers replace or plant QR codes - on parking meters, letters, emails, restaurant tables - that lead to a fa
- https://scampilot.de/learn/fake-shops - Fake online shops: A professional-looking web shop offers branded goods at unbeatable prices, but only accepts prepayment by bank
- https://scampilot.de/learn/marketplace-scams - Classifieds & marketplace scams: On classifieds platforms (Kleinanzeigen, Facebook Marketplace), scammers target both sellers and buyers: a fak
- https://scampilot.de/learn/fake-police - Fake police & shock calls: A caller posing as a police officer or prosecutor claims a relative caused a fatal accident and needs "bail",
- https://scampilot.de/learn/subscription-traps - Subscription traps: A "free" trial, prize test or streaming sign-up quietly rolls into an expensive subscription: the costs are hi
- https://scampilot.de/learn/ping-calls - Ping calls (one-ring scams): Your phone rings exactly once from an unknown foreign number and the caller hangs up before you can answer. Th
- https://scampilot.de/learn/ai-voice-cloning - AI voice-cloning scams: Scammers clone the voice of a child, grandchild, partner or boss from a few seconds of audio (social media cli
- https://scampilot.de/learn/task-job - Task & commission-job scams: A message (often via WhatsApp or Telegram) offers easy part-time work: "complete simple tasks" like rating pro
- https://scampilot.de/learn/recovery-scam - Recovery & refund-recovery scams: After someone has already been scammed, a second scammer contacts them claiming to be a "fund recovery" expert
- https://scampilot.de/learn/rental-scam - Rental & apartment scams: A flat is listed well below market price with attractive photos (often stolen from a real listing). The "landl
- https://scampilot.de/learn/bank-impersonation - Bank fraud-department impersonation: A caller or text claims to be your bank's fraud department: there is a suspicious transaction and, to "protect
- https://scampilot.de/learn/amazon-review - Paid Review Schemes (Gift Card for a 5-Star Review): A seller, or a middleman acting for several sellers, contacts you after a purchase and offers a refund, a gift
- https://scampilot.de/learn/brushing - Brushing Scam (Parcels You Never Ordered): Brushing is when a seller sends you cheap goods you never ordered so they can register a sale to your name and
- https://scampilot.de/learn/calendar-invite - Calendar Invite Phishing (Spam Events on Your Calendar): Scammers send calendar invitations that some apps add to your calendar automatically, even before you open the
- https://scampilot.de/learn/car-sales - Vehicle Sale Scams (Too-Cheap Cars and Fake Escrow): In a vehicle-sale scam a car, van, or motorbike is listed well below market price with a plausible story - a s
- https://scampilot.de/learn/parcel-mule - Reshipping Job Scam (Becoming an Unwitting Parcel Mule): A reshipping scam is a fake work-from-home job where you receive packages at your address and forward them on
- https://scampilot.de/learn/pet-adoption - Pet adoption & puppy scams: A seller advertises a purebred puppy, kitten or other pet far below the usual price, but always finds a reason
- https://scampilot.de/learn/mlm - MLM & pyramid recruitment: A friend or stranger offers a "business opportunity" where you buy a starter kit, sell products and earn most
- https://scampilot.de/learn/government-impersonation - Government & authority impersonation: A caller, email or text pretends to be the tax office, immigration, police or a utility company and claims you
- https://scampilot.de/learn/charity - Fake charity & disaster appeals: Scammers create fake charities or copy real ones, especially after a disaster, and beg for urgent donations. T
- https://scampilot.de/learn/social-media-takeover - Social media account takeover: An attacker hijacks a social media or messaging account, then uses the trust of its contacts to spread further

## Contact

- General: hallo@scampilot.de
- Privacy / GDPR: datenschutz@scampilot.de
- Security disclosures: sicherheit@scampilot.de