// tool reference · Incident & Response
AI Scam & Message Inspector Free
Paste any suspicious message — SMS, chat, marketplace, dating — and get a verdict.
Open AI Scam & Message Inspector →
What it does
Paste any suspicious message — SMS, LINE, WhatsApp, a marketplace listing, a dating-app opener — and get a plain-language verdict with the specific manipulation techniques identified. Built for the messages that are not email and therefore have no headers to analyse.
When to use it
- A text or chat message feels off and you want a second opinion before replying.
- Helping a family member who is unsure about a message.
- Triaging a smishing report where there are no headers to work with.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| message | textarea | required | The message text, as received. |
| use_ai | checkbox | optional | AI analysis of the pretext. |
What you get back
A verdict with per-technique findings and what to do next.
Worked example
Input
Hello, I am Officer Tanaka from Tokyo Police. Your bank account has been used for money laundering. To prove your innocence you must transfer your balance to a safe government account today. Do not tell anyone -- this is a confidential investigation.
Output (abridged)
VERDICT: SCAM -- high confidence. This is a known playbook.
CRITICAL Authority + isolation + urgency, together
'Do not tell anyone' exists to stop you asking someone who
would recognise this. That instruction is the tell.
CRITICAL 'Safe account' does not exist
No police force or bank anywhere asks you to move money to
prove innocence. This request has one purpose.
HIGH Unsolicited contact claiming authority
Real investigations do not open by demanding a transfer.
WHAT TO DO
- Do not transfer anything. Do not reply.
- Hang up / stop replying and contact your bank on the number
printed on your card -- never a number from the message.
- Japan: report to the police via #9110.
- Tell someone. The secrecy demand is the attack.
How it works
Deterministic pattern detection first (urgency, payment rails, contact-channel switching), then AI analysis of the social-engineering pretext. It reads text only — it never opens a link.
Limits
Read live from the platform configuration.
| Rate limit | 30 requests / 60s (platform default) |
Limitations — what it does not do
It reads text, not links or attachments — deliberately, so checking is always safe. A novel pretext with no familiar markers may score lower than it deserves. A "probably fine" verdict is not permission to send money to a stranger.
Privacy
The message is sent to the AI provider when AI is enabled and is not retained. Redact your own personal details before pasting.
Standards
MITRE ATT&CK (T1566 Phishing)