Calibrating ScamOrNot: Tuning a Browser Scam Detector

Following the launch of ScamOrNot, a risk-checking tool for text, links, and crypto wallet addresses available at scamornot-app.netlify.app, the creator shared insights into the toughest part of the build: tuning the engine to spot actual scams while staying quiet for ordinary messages.

The core of the utility is a single JavaScript file running entirely inside the user's browser without uploading pasted content anywhere. This architectural choice prevents the checker itself from becoming a privacy risk. Inside the engine, 15 pattern families are assigned specific weight scores.

Additional smaller weights stack up, such as 28 points for an upfront fee to unlock funds or 22 points for guaranteed daily returns. A single weak signal is not enough to convict anyone, but three or four signals combined will trigger a warning. For links, the system performs structural checks rather than simple pattern matching, looking out for misplaced brand names, punycode, or raw IP addresses.

In rule-based security systems, managing false positives is a critical challenge. If a detection engine is overly sensitive and flags legitimate bank notifications, users quickly lose trust and ignore warnings altogether. Executing detection logic entirely on the client side also mitigates privacy concerns associated with handling sensitive text inputs.

A near-fatal edge case involved a security article stating "never share your seed phrase." Initially, the engine interpreted those exact words as attack bait and scored the article like a malicious payload. This forced the developer to implement a protective framing guard to distinguish between text warning about a threat and the threat itself.