Start with what the person actually has in front of them. Not everyone needs the same service, and someone who has already lost money should go to local support first.
What you have, and what to do next
| What someone has | Suggested next step |
|---|---|
| A suspicious email | InboxSpotter — inboxspotter.com |
| A suspicious text or chat message | CyberScout — cyberscout.chat |
| A suspicious link or website | The CSRF checker — cybersecurityreach.org/check |
| Wants to look up a known scam pattern | ScamArchive — scamarchive.org |
| Wants browser protection | KnownGood |
| Lost money or shared sensitive information | Your organization's established recovery and reporting pathway, first |
How to use this page
- Do not force everyone through the same service.
- If someone has already lost money or shared identity documents, local support and reporting come first.
- Read the current warnings at watchout.report before a workshop or a newsletter.
Draft note for CSRF review: confirm the public address for KnownGood, and confirm CyberScout and the CSRF checker are the addresses we want partners printing.