TrustLens AI
Community intelligence

Scam campaigns in circulation

One person reporting one number proves nothing. When several people independently report messages that share a link, a number or a payment handle, that is a campaign — and it can warn the next person before they lose anything.

Everything on this page is simulated. No TrustLens user submitted any of it. The reports are invented to demonstrate the matching, but they run through the same grouping code as live input — the clusters, the counts and the staleness below are genuinely computed, not written by hand.

4 campaigns · 1 corroborated

Ordered by how many independent people reported them.

  • CorroboratedSimulated

    Bank KYC phishing using secure-hdfc.xyz

    Bank KYC phishing

    4independent reporters
    from 4 reports
    secure-hdfc.xyz98••••••10Wording pattern98••••••33Wording pattern

    First seen 6 days ago · last seen yesterday

  • PreliminarySimulated

    UPI refund scam collecting to refunds@okaxis

    UPI refund scam

    2independent reporters
    from 2 reports
    refunds@okaxisWording patternWording pattern

    First seen 5 days ago · last seen 2 days ago

    Not yet corroborated. Fewer than 3 independent reporters, so this is shown for awareness and is never pushed as an alert.

  • StaleSimulated

    Electricity disconnection from 97••••••11

    Electricity disconnection

    2independent reporters
    from 2 reports
    97••••••11

    First seen 2 months ago · last seen 2 months ago

    Nothing new for over 30 days. A number can be reassigned, so an old indicator should not keep accusing whoever holds it now.

  • PreliminarySimulated

    Digital arrest from 99••••••22

    Digital arrest

    1independent reporter
    from 1 report
    99••••••22Wording pattern

    First seen 2 days ago · last seen 2 days ago

    Not yet corroborated. Fewer than 3 independent reporters, so this is shown for awareness and is never pushed as an alert.

How a campaign is built

The rules are fixed and stated, so an alert can show its working.

  1. Nothing leaves your device by default

    Your message text is never uploaded. Only normalised indicators — a domain, a keyed token standing in for a number, a payment handle, a wording signature — are ever eligible to be shared, and only if you opt in.

  2. Variants are matched, not exact strings

    Subdomains collapse to the registrable domain, numbers normalise to the subscriber, and wording reduces to a weighted signature — so a reworded resend still lands in the same campaign.

  3. One voice is not consensus

    Corroboration counts distinct reporters, not reports. Submitting the same thing twelve times still counts as one, which is what stops a single actor manufacturing agreement.

  4. Indicators expire

    A campaign with nothing new for 30 days goes stale. Phone numbers get reassigned, and an indicator should not accuse someone forever.

Got a message like one of these?

Check it before you act. You will see the evidence and the next safe step.

Check a message

Production would hold the indicator key in a managed service, rotate it, and use a privacy-preserving set-intersection protocol so matching never requires the server to see a candidate indicator at all. That is the documented next step, not something built.