Email Scam Checker: Quishing & AI Phishing Detection

On-device AI email scam checker that detects phishing, quishing & QR code scams in your inbox. 100% private, no data collection.

On-device AI protection that helps you spot phishing emails and provides advanced email security with email fraud detection. This email scam checker flags phishing scams, quishing (QR code phishing), fraud, and fake emails directly in your inbox. No message content ever leaves your browser. All scanning runs locally on your device. 100% on-device — nothing is uploaded to any server. 🛡️ Learn how to spot a phishing email Every scam attack follows patterns. How to spot phishing emails is simple once you know what to look for. It teaches you exactly what to identify in each message. Open any message and it immediately scans the sender, content, links, and attachments. A colored badge appears — green for safe, yellow for suspicious, red for scam. Click to see what triggered the alert with clear explanations and the specific text that raised each flag. 🔍 Real phishing patterns detected This advanced detection system runs 30 heuristic checks on every message, identifying patterns used in real attacks: 🔹 Sender impersonation — domains that spoof banks, exchanges, or well-known brands 🔹 Suspicious links — hidden URLs, redirects, and link mismatches 🔹 Shortened & masked links — links that hide their real destination behind a short or redirected URL are checked against where they actually point, so phishing links can't slip through unnoticed 🔹 Quishing & QR code scams — malicious QR codes hidden in emails, document attachments, and image attachments that point to phishing sites 🔹 Urgency language — pressure tactics, threats, and fake deadlines 🔹 Generic greetings — mass attacks use "Dear customer" not your name 🔹 Dangerous attachments — executable files disguised as documents 🔹 Grammar errors — poor language that professional companies never use 🔹 Spoofed anti-phishing codes — mismatched security phrases from your services 🔹 Financial scam patterns — invoice fraud, wire transfer requests, and CEO-impersonation phrasing used in business email compromise (BEC) attacks 🔹 Sender-history signals — a first-time sender from a domain you've never received mail from gets a caution (a common sign of BEC and spoofing), while a domain you hear from regularly gets a small trust boost 📊 Real-time inbox security scanning The checker works automatically in the background. No clicking, no manual checks, no uploading anything. As you browse your inbox, every message gets a risk score from 0 to 100 based on the combined weight of all findings. Positive signals like unsubscribe links and physical addresses reduce the score — genuine messages don't get flagged. 🤖 Advanced AI phishing detection — on-device scanning For deeper detection beyond heuristics, use the built-in AI phishing detection model for advanced on-device analysis. This DistilBERT detector runs entirely on your device via WebAssembly — a one-time 67 MB download, then works offline forever. It provides its own verdict, confidence percentage, and detailed reasoning. With both rule-based detection and AI analysis, you get two independent verification methods in one extension. 🔐 Anti-phishing code verification Services like Proton Mail, Coinbase, Gate, and Binance include a personal security phrase in every legitimate message. Add your anti-phishing codes in the popup. If a message claims to be from your bank or exchange but the code doesn't match — critical red flag. If it matches — green confirmation. No other tool offers this layered verification. ⭐ Why users choose the best phishing protection ➤ 100% local analysis — zero data sent anywhere ➤ Advanced AI-powered phishing email checker with offline capability ➤ Quishing & QR code phishing detection — flags malicious QR codes before you scan ➤ Security code matching for banks and exchanges ➤ Real-time email security scanning with immediate visual feedback ➤ No account, no subscription, no data collection 📈 Your security dashboard Open the popup to see your stats — messages checked, threats caught, all-time totals. It keeps records without storing your message content. Only anonymous counts are tracked. 🌍 Built for privacy-first phishing protection Built for people who want phishing protection without compromise. The AI model, heuristic rules, and security code verification all run locally in your browser. No server, no API calls, no logging. Usage stats are anonymous counts only — never message bodies or addresses. 🧾 Frequently asked questions ❓ What is phishing? 💡 Whether you ask what is phishing, what is a phishing attack, or what is a phishing scam, the phishing definition is the same — and the phishing meaning matters to everyone. A phishing attack is an online scam where attackers send fake emails that look like they come from legitimate companies or people you trust. The goal is to trick you into revealing passwords, credit card numbers, or personal information — or to install malware — usually through a phishing link to a fake login page or a phishing text. Phishing emails use urgency, lookalike domains, and copied branding. It automatically detects these tactics so you don't have to spot them manually. ❓ What are the types of phishing? 💡 The main types of phishing include email phishing, spear phishing, quishing (QR code phishing), and smishing. What is a phishing email? A fake message sent to your inbox. What is spear phishing? A targeted phishing attack aimed at one specific person or company. A phishing email example might mimic your bank — a sample phishing email is designed to look identical to a real message. The checker recognizes all of these phishing examples automatically. ❓ What is quishing (QR code phishing)? 💡 Quishing — also called QR phishing or QR code phishing — is a phishing attack that uses a QR code instead of a clickable link. The quishing definition is simple: a scammer hides a malicious QR code in an email, or in a PDF or image attachment, and scanning it opens a fake site or starts a download. It detects these quishing attacks automatically so you don't get scammed by scanning a QR code. ❓ Can you get scammed by scanning a QR code? 💡 Yes. A fake QR code — often printed over a real one or hidden in an email — is at the heart of QR code scams. Scanning a fake QR code can send you to a fake login page or trigger malware. Good QR code safety and QR code security means checking the destination before you open it, and understanding the QR code dangers and QR code risks (including QR code hacking) keeps you safe. The checker inspects QR codes in your emails and flags malicious QR codes before you scan them. ❓ How to prevent QR code phishing? 💡 Don't scan QR codes from unexpected or urgent emails, check the destination URL before opening it, and use an email scam checker that detects quishing scams and malicious QR codes automatically. Are QR codes safe? Only as safe as the link they hide. ❓ Is my data sent anywhere? 💡 No. All analysis — heuristic checks, AI phishing detection, anti-phishing code matching — happens entirely locally. Zero data leaves your browser. ❓ Is this email legit — how can I tell if it's a phishing scam? 💡 Open the message and it automatically scans the sender, content, links, and attachments. A colored indicator instantly shows if it's safe (green), suspicious (yellow), or a scam (red) — the fastest way to check if an email is a scam or tell if an email is real without guessing. ❓ What do phishing email examples look like? 💡 Common phishing email examples impersonate banks, crypto exchanges, or shipping companies with urgent subject lines like "your account has been suspended" or "payment failed — verify now." Real patterns include lookalike sender domains, generic "Dear customer" greetings, links that don't match their visible text, and — for services like Proton Mail, Coinbase, Gate, or Binance — a missing or mismatched anti-phishing code. It recognizes these exact phishing examples automatically instead of asking you to memorize examples. ❓ Which email providers does it support? 💡 It works automatically across every major webmail inbox, right in your browser — everything runs 100% on-device. ❓ What is security code verification? 💡 Banks and exchanges include a personal security phrase in messages. Configure yours in settings, and any mismatch gets flagged as critical. ❓ Is this a real email or a phishing scam? 💡 This protection tool instantly determines if an email is legitimate by analyzing sender, content, and links. It's not just verification — it's full threat detection using 30+ analysis methods. ❓ How is this different from email verification tools? 💡 Email verification checks if addresses exist. This detects phishing content — scams, fraud, impersonation — using 30 rules plus optional AI analysis. ❓ Does it detect business email compromise (BEC) or invoice fraud? 💡 Yes — invoice fraud and wire transfer requests are caught under financial scam patterns, while CEO-impersonation phrasing and reply-to mismatches are dedicated checks. Together they cover how BEC attacks actually work. ❓ Does the AI model need internet? 💡 Only for the first download. After that, it runs entirely offline in your browser. ❓ What to do if I clicked on a phishing link? 💡 Act fast: change passwords immediately, enable two-factor authentication, monitor accounts for fraud. Then use this protection to prevent future attacks. ❓ How to detect phishing emails? 💡 Look for red flags: suspicious sender, urgent language, mismatched links, poor grammar, requests for credentials. It catches all of these automatically. ❓ How to recognize phishing emails? 💡 Check the sender's actual email address (not display name), hover over links to see real URLs, look for generic greetings, and watch for urgent requests. The best email security identifies these patterns instantly. ❓ How to report and block phishing emails? 💡 To report a phishing email, use your provider's "Report phishing" option or forward it to their abuse address, then mark it as spam and block the sender. Better: use an email scam checker that flags phishing before it reaches you — protection works preventively, not after the fact. ❓ Does it catch government and bank scam emails (HMRC, CRA, ATO, MyGov, Interac e-transfer)? 💡 Yes. The same sender mismatch, suspicious domain, and financial scam pattern checks catch tax and government impersonation — HMRC phishing in the UK, CRA and Canada Revenue Agency scams, ATO and MyGov impersonation in Australia — plus Interac e-transfer fraud and other bank-transfer scams, just like every other spoofed brand. Get real-time email security and phishing protection with zero data sharing — privacy that actually works.