Is this call a scam?

Purpose

Tick what happened in the call you just got to find out whether it’s a scam, what to do now and where to report it.

Requirements

Anyone can read these guides, no account needed. Some tools require Pro, as indicated in each guide.

Did someone just call claiming to be your bank, the police, an authority or a relative with a new number? Tick what happened in the call. Your answers never leave your browser.

How to use it

1. 1

   They said they were your bank, the police, an authority, a company or a relative. For example: “we’re calling from your bank’s fraud team” or “Mum, I’ve got a new number”.

2. 2

   They asked for a code you got by text. A verification code, a WhatsApp code or one to confirm a purchase or a payment.

3. 3

   They asked you to install an app or share your screen. AnyDesk, TeamViewer, QuickSupport or a so-called “security app”.

4. 4

   They asked you to move money or pay with gift cards or crypto. For example to a “safe account”, to “cancel a charge” or to pay a fine.

5. 5

   They asked for your card number, its PIN or your passwords. Also the CVV, your online banking credentials or your digital signature.

6. 6

   They rushed you, threatened you or told you not to tell anyone. “You have to do it now”, “if you hang up you’ll lose your money”, “don’t tell anyone at the bank”.

7. 7

   They asked you to dial a code with stars and hashes. For example **21*…# or *401*…: it forwards your calls to the scammer.

Synthetic example

They said they were your bank, the police, an authority, a company or a relative

They asked for a code you got by text

Interpret the result

It’s a scam: hang up: No bank, police force, authority or company asks you by phone for a code, control of your phone, to move your money, your passwords or to forward your calls. Do this now:

Very suspicious: Pressure, threats and secrecy are scammers’ main tools. Hang up and check it yourself through an official channel:

No clear signs of a scam: Even so, if they claimed to be a company or an authority, check it yourself:

Limitations

Report it to the police in your country and, if money or bank details are involved, tell your bank as soon as possible.

Troubleshooting

The security check or API connection did not respond in time. Try again in a few seconds.

Use with the API

Seven yes/no answers about a call that just happened give a verdict (scam, suspicious or no clear signs), the steps to take now and the country’s verified reporting channel.

Send the JSON body to the tool's own route, or to POST /v2/tools with the tool field added. Both routes return the same result.

POST https://api.nocall.io/v2/call-scam-check
POST https://api.nocall.io/v2/tools  {"tool":"call-scam-check","answers":{"impersonation":true,"sms_code":true,"pressure":true},"country":"ES"}

REQUEST_ID="$(uuidgen)" && [ -n "$REQUEST_ID" ] &&
curl --request POST 'https://api.nocall.io/v2/call-scam-check' \
  --header "Authorization: Bearer $NOCALL_API_KEY" \
  --header 'Content-Type: application/json' \
  --header "Idempotency-Key: $REQUEST_ID" \
  --data '{"answers":{"impersonation":true,"sms_code":true,"pressure":true},"country":"ES"}'

import json
import os
import urllib.request
import uuid

api_key = os.environ.get('NOCALL_API_KEY')
if not api_key:
    raise SystemExit('Set NOCALL_API_KEY')

request = urllib.request.Request(
    'https://api.nocall.io/v2/call-scam-check',
    method='POST',
    data=json.dumps({'answers': {'impersonation': True, 'sms_code': True, 'pressure': True}, 'country': 'ES'}).encode(),
    headers={
        'Authorization': 'Bearer ' + api_key,
        'Content-Type': 'application/json',
        'Idempotency-Key': str(uuid.uuid4()),
    },
)
with urllib.request.urlopen(request, timeout=30) as response:
    result = json.load(response)
print(result['data']['result'], result['meta']['unitsCharged'])

import { randomUUID } from 'node:crypto';

const requestId = randomUUID();
const apiKey = process.env.NOCALL_API_KEY;
if (!apiKey) throw new Error('Set NOCALL_API_KEY');

const response = await fetch('https://api.nocall.io/v2/call-scam-check', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer ' + apiKey,
    'Content-Type': 'application/json',
    'Idempotency-Key': requestId,
  },
  body: JSON.stringify({ answers: { impersonation: true, sms_code: true, pressure: true }, country: 'ES' }),
});
const result = await response.json();
if (!response.ok) throw new Error(result.error?.code ?? 'request_failed');
console.log(result.data.result, result.meta.unitsCharged);

{
  "data": {
    "tool": "call-scam-check",
    "result": {
      "verdict": "scam",
      "signals": [
        "impersonation",
        "sms_code",
        "pressure"
      ],
      "actions": [
        "hang_up",
        "call_official_number",
        "never_share_codes",
        "report"
      ],
      "reportChannel": {
        "name": "INCIBE",
        "fullName": "Instituto Nacional de Ciberseguridad de España",
        "url": "https://www.incibe.es/linea-de-ayuda-en-ciberseguridad",
        "phone": "017"
      }
    }
  },
  "meta": {
    "requestId": "req_example",
    "unitsCharged": 1,
    "usage": {
      "periodStart": "2026-10-01",
      "unitLimit": 20,
      "unitsUsed": 3,
      "unitsRemaining": 17
    }
  }
}

• API reference ↗

Frequently asked questions

Related guides

• Asked to dial a code?
• Asked for a code sent by SMS?
• Where to report a scam text