Free tool
Check a message
Paste a suspicious email, text message, or link. We will tell you what looks wrong with it, and why. Nothing you paste is stored.
What this can and cannot do
This tool looks for specific, checkable problems: a link that goes somewhere other than it says, a sender that failed the checks proving they own the address, a website registered last week, a request for a payment that cannot be undone.
It will never tell you a message is safe. Plenty of scams have none of these signs. A message from a real, compromised account asking you for money is a lie that passes every technical test there is. If something feels wrong after we find nothing, that feeling is still worth acting on.
We are also describing the message, never making an accusation about a company named inside it. A scammer choosing to impersonate a bank tells you nothing about the bank.
How to read a web address yourself
This is the single most useful thing to know, and it takes a minute to learn. Read an address from the right, not the left.
In commbank.com.au.secure-verify.top, the part that decides where you actually go is secure-verify.top. Everything before it can be set to anything at all by whoever owns that domain. It says the bank’s name because somebody typed the bank’s name there.
Compare secure.commbank.com.au, where the deciding part is commbank.com.au. That one really is the bank.
Common questions
- Will this tell me if a message is safe?
- No, and no tool honestly can. It can point out specific things that are wrong with a message. It cannot confirm that a message is genuine, so we never say that it is.
- Do you keep what I paste in?
- No. The message is checked and then discarded. We do not store it, log it, or keep the links in it. We keep only a count of how many checks were run, with nothing in it that could identify you.
- What is an .eml file and why is it better?
- It is an email saved to a file, including the hidden headers that travel with every message. Those headers record whether the sender really owns the address they claim, which is the strongest evidence there is. Pasted text and screenshots do not carry them. Most email apps can save a message as .eml, often through "Save as" or by dragging the message to your desktop.
- Is anything sent to another company?
- Links are checked against Google Safe Browsing, which means the link is sent to Google. We also look up when the linked website was registered, using public domain records. Nothing else leaves this site.
This tool is provided for general information and education. It is not advice about your specific situation, it is not a guarantee, and ShieldMate is not an emergency service. If you are in immediate danger, contact your local emergency number. If money has already moved, contact your bank first, then see Get help.