Security2 publishers2 min readPublished
Malwarebytes releases a free paste-in checker for suspected scam links
Malwarebytes launched Scam Link Check, a free web tool that rates any pasted URL as safe, dangerous or unknown before anyone clicks it. Security teams now have a no-login first stop to name in scam guidance for customers and for staff holding a suspect link.
The Watch · Security desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction
What happened
- The tool runs a pasted link against Malwarebytes threat intelligence, looking for known malicious sites, phishing pages, freshly registered domains and redirect chains that hide the real destination.
- Results include a screenshot of the page, plain-language reasons for the verdict, and next steps that cover what to do after a click has already happened.
- Digital Trends reported that the tool needs no account, download or payment.
- Malwarebytes says its research ranks malicious websites, including counterfeit stores and malicious ads, ahead of email and text as the most common way scams are delivered.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Help-desk or customer guidance that names the tool needs a written fallback for an unknown result, since that answer leaves the person where they started.
- decision Teams quoting the delivery ranking or the 85% figure are quoting a vendor survey, good enough for awareness material and too thin to carry a threat model or a budget case.
- exposure Sending customers to the tool routes their suspect URLs, and any site reports they file, to Malwarebytes, where the reports feed the company's threat intelligence.
An unknown verdict is the gap any guidance has to cover [3]. Digital Trends, writing as Amazon Prime Big Deal Days approached, said a link checker should not replace basic caution [14]. It noted that phishing sites can use HTTPS too, so a padlock does not make a site legitimate. It also said going to the retailer's official website yourself is still the safer option [14]. Its other advice was to check store domains for misspellings or extra characters and to be wary of shortened links that hide where they go [17].
The fake shops it described copy familiar brands and recreate convincing storefronts, using AI-generated images or polished copy [15].
The case for the tool rests on Malwarebytes' own research. The company says 85% of people can no longer reliably tell a scam from the real thing, up from 66% a year earlier [7]. That is a rise of 19 percentage points in a year [18]. Digital Trends reported a second finding, that 22% had been misled by AI-generated or enhanced product photos or reviews [10]. Malwarebytes also cites estimated scam losses of $442 billion worldwide and roughly $21 billion for Americans in 2025 [11]. Neither write-up says how the research was done or how many people took part.
Mark Beare, Head of Consumer at Malwarebytes, pitched the tool as a substitute for training people to spot scams. "We've spent years asking people to become scam experts, and it hasn't worked, because scams evolve faster than anyone can track," he said [12]. "Rather than asking people to spot the scam, we give them an expert," he said [13].
In my view the tool fits one job for a security team. It takes links that arrive by text, email, chat or social media [1]. That makes it a usable named first stop for customers, and for staff holding a link on a personal phone. The URL is pasted or typed into a page at malwarebytes.com/scam-check/link [8]. Results link into Malwarebytes Scam Guard, which the company offers free on iOS, Android, Windows and macOS, in its Browser Guard extension, on the web and inside ChatGPT and Claude [16].
What to watch
- Whether Malwarebytes publishes the method and sample size behind its delivery-method ranking and the 85% detection figure.
- How the checker rates freshly registered fake storefronts during Prime Big Deal Days: dangerous, or unknown.
- Whether Malwarebytes adds bulk or programmatic URL submission that fraud and SOC teams could wire into their own reporting flows.