Check before you Click, Pay, or Reply
Got a suspicious WhatsApp link, a "KYC update" message, or want to know if your email leaked in a breach? Paste it below.
Free. No sign-up. Nothing is saved — this is a one-time check.
Built by people who secure real businesses, not a side project
ACH Security runs penetration testing and round-the-clock vulnerability monitoring for companies across India — the kind of work where getting a breach wrong has real consequences for someone else's customers. This page runs on the exact same scam- and breach-detection engine behind that work, made free for everyday people instead of locked behind an enterprise contract.
Not a one-page tool thrown together — built on the same detection engine that protects paying business customers every day.
Made for the scams you actually see
Fake delivery texts, lucky-draw WhatsApp forwards, lookalike payment links — built around what's really hitting Indian phones.
No sign-up needed
Paste and check — no account, no email verification, no waiting.
Nothing is stored
A check here is one-time. We don't save what you typed or start monitoring it.
Works for both
One box — paste an email to check breaches, or a link to check for scams.
Built in India
Made for the scams Indians actually see — fake KYC links, lucky-draw messages, cloned shopping sites.
Takes 2 seconds
No external lookups to wait on for link checks — the answer is instant.
Backed by professionals
Built by ACH Security, the same team that secures real Indian businesses.
What most scams in India look like right now
Based on real, reported patterns — the GSMA India Consumer Scam Report found online-shopping fraud is the single biggest category, ahead of fake prizes and fake jobs.
Fake "KYC update" messages
A WhatsApp or SMS says your bank account/KYC will be blocked unless you click a link and enter details immediately. Real banks never ask for this over a message — they ask you to walk into a branch or use their official app.
Fake refund / cashback calls
Someone claims to be bank or wallet support and asks you to install a screen-sharing app “to process your refund.” Once it's installed, they can see your screen the moment you open your UPI app and enter your PIN.
UPI “collect request” tricks
You get a payment request disguised as something else — sellers on resale apps are a common target, asking you to “accept” what's actually a request to pay them, not receive money. A collect request should never need your PIN to receive cash.
Shopping sites that vanish
A site advertises huge discounts, takes payment, and either never ships or disappears within days — common during festive sales, often cloned to look almost identical to a real brand's site.
“Digital arrest” calls
A caller claims to be police, CBI, or a court official, says you're under investigation, and pressures you to stay on a video call and transfer money to “clear your name.” Real law enforcement never arrests or investigates over a phone call.
“You won a lucky draw” forwards
A forwarded message claims a cash prize and asks you to click a link or share an OTP to claim it. There was never a draw — and no real prize ever needs your OTP to “release” it.
Nearly all of these work the same way underneath: they manufacture urgency ("act now or lose access") and borrow trust from something real (your actual bank, an actual court, an actual festive sale) so you act before you think to check. Slowing down for the ten seconds it takes to check here is usually the whole defense.
Already sent money or shared an OTP? Move fast.
Speed matters more than anything else here — most recovery outcomes depend on how quickly a transaction gets flagged, not on tracking the scammer down afterward.
01 — Call 1930 immediately
India's national cybercrime helpline. If you act within a few hours of a fraudulent transaction, banks can often freeze the money before it's moved out — every minute matters.
02 — File a report at cybercrime.gov.in
The National Cyber Crime Reporting Portal — this creates an official record, which your bank or the police may ask for later.
03 — Tell your bank or wallet provider
Report the fraudulent transaction through their app or helpline too, separately from the police report. Ask them to flag the receiving account.
04 — Change your passwords
Starting with your email and anything reused elsewhere. If the scam involved a link you clicked, assume anything you typed there is compromised.
05 — Don't delete the evidence
Keep the message, call recording, or screenshot — investigators need it. Deleting it to “move on” makes it harder to trace later.
06 — Warn whoever shared it with you
If it came from a family WhatsApp group or a forward, let them know — the same message is very likely circulating to others in the group right now.
Three steps, no account
Paste it
An email address or a link — whichever you're unsure about.
We check it
Against known breaches, or for signs of a scam or fake site.
Get a clear answer
Safe, or not — in plain language, right away.
A one-time check is good. Ongoing protection is better.
SafeHoon Plus watches your email in the background and alerts you the moment a new breach appears — you don't have to remember to check.
- ✓Check any email or link
- ✓No sign-up
- ✓Nothing saved
- ✓Watches your email continuously
- ✓Instant alert on a new breach
- ✓Reminders to change exposed passwords
- ✓Covers parents, spouse, kids — not just you
- ✓Each person alerted on their own breach
- ✓Only ₹25/email — cheaper than checking alone
Common questions
Yes. Checking one email or link here costs nothing and never needs a signup. We built it because too many breach-checkers hide the real answer behind a paywall.