Find out if an SMS, email or WhatsApp message is a scam — analysis in seconds
ORTSLAB is a digital message forensic analysis engine built by a court-appointed IT expert. Paste the text of any suspicious SMS, email or WhatsApp message and the engine checks over 40 fraud signals: the sender's real origin, hidden links, domain authenticity and the language patterns scammers use. No registration and nothing to install: we don't store the original text of your message.
What is the SMS and phishing scam detector for?
Every day, millions of people in Spain receive fraudulent messages impersonating their bank, the postal service, the traffic authority, or services like Netflix or Amazon. These messages — known as phishing (by email) or smishing (by SMS) — are designed to get you to click a fake link or hand over your personal and banking details.
ORTSLAB analyzes the message in real time and precisely determines whether it's legitimate or a scam, explaining exactly which signals it detected. If the result confirms fraud, you can download an expert report valid for submission to the authorities or in judicial proceedings.
Most common SMS and email scams in Spain
- Fake SMS from your bank — Santander, BBVA, CaixaBank, ING — warning of a suspicious charge or account block.
- Email from the postal service about a held package asking you to pay customs fees.
- SMS from the traffic authority (DGT) about an outstanding fine with a link to pay it.
- Email from the tax office promising a refund or threatening an audit.
- Message from Amazon or Netflix asking you to update your payment method.
- WhatsApp from a relative sent from an unknown number asking for urgent money.
- Job offers or prizes that ask for personal details or an upfront payment.
- Invoices or PDF attachments with malicious code that activates when opened.
How does forensic message analysis work?
ORTSLAB's forensic engine checks the sender's authenticity in real time (SPF, DKIM, DMARC), verifies whether links redirect to fraudulent domains, cross-checks them against the history of cases already analyzed, and analyzes domain age via RDAP. It also detects advanced evasion techniques such as Unicode homoglyphs, newly registered domains and malicious QR codes.
The result includes a forensic score, a clear verdict and a detailed list of the evidence found. Professionals can export the report as a PDF in expert-report format.
What should I do if I confirm the message is a scam?
Don't reply, don't click any links, and don't call any number that appears in the message. If you've already shared banking details, contact your bank immediately. You can report the scam to the National Police, the Civil Guard, or INCIBE via the free phone line 017.
If you need to document the fraud for a formal complaint or judicial proceedings, request a signed expert report from Oscar Orts, a registered court-appointed IT expert.
or paste the text directly
Check it in seconds, no registration.
Forensic groundwork before going to court.
BEC, CEO fraud and brand impersonation.
What can we find out about this?
The Scanner answers one question: is this message a scam? Here we answer another: what public information is there about a stray piece of data — with no message involved at all? Type or paste a domain, an IP, a URL or a phone number, or drag in a file.