DecoySignal

Send us a scam

If something landed on your phone and you think other people should see it, we would like to look at it. Read this page first. It takes a minute and it protects you.

Before you send anything

Never send us these

Not in a first email, and not later. We will never ask you to email any of these. If something cannot be verified without them, we will find another way or decline the submission — the answer is never for you to send them.

  • Social Security numbers
  • Full bank account or card numbers
  • Passwords, PINs, one-time codes or recovery codes
  • Photographs of driving licenses, passports or other identity documents
  • Full bank or card statements
  • Medical records, insurance or pharmacy paperwork, or anything else about your health — Medicare and health-plan scams are common, and the scam message is the part we need, never the health information around it
  • Anything belonging to someone else who has not agreed to it

If you have already sent us something in this list, email submit@decoysignal.com and say so. We delete it from our working systems and confirm to you in writing. We cannot reach inside our mail provider's backups, which clear on their own schedule, and we will not claim otherwise — but nothing in this list is ever used, published or licensed.

If you are under 18, please do not send us a submission. If we learn that something came from a child under 13 we delete it rather than reply further, and it is never published or licensed.

How it works

We do not want the evidence in your first message. Email is not a safe place to put it, and we would rather tell you what we actually need than have you send more than you should.

  1. You tell us what happened

    Email submit@decoysignal.com and describe it in your own words. What arrived, roughly when, how it reached you, and what it asked you to do. Do not attach anything yet.

  2. We reply and tell you what we need

    Usually that is one screenshot with parts of it already covered up, and sometimes nothing at all. We will also set out, in that reply, exactly what you would be agreeing to, so you can decide with it in front of you.

  3. You decide, in writing

    Two separate questions, and you can say yes to one and no to the other. We keep that reply as the record of what you agreed to and when.

  4. We redact, and usually we do not use it

    Sending something does not mean we will use it. We look for patterns that will affect a lot of people, not one-off cases, and that is not a judgment on what happened to you.

What you would be agreeing to

Sending us a message is not permission to publish it. Permission is a separate step, and it is two questions rather than one, because these are different acts with very different reach.

Our own channels

We may show the redacted artifact in our videos, on this site, and on the social accounts we publish to. This is the narrower of the two.

Institutional licensing

We may include the redacted artifact in material we license to banks, credit unions and other institutions to use in their own fraud education. This reaches further, and we cannot see every place a licensee puts it. You can decline this and still say yes to the first.

In both cases you keep ownership of the material and you will not be paid. We publish submissions anonymously unless you explicitly ask to be credited.

What we do before anything is shown

Changing your mind

Email submit@decoysignal.com at any time and we will stop using it.

We are working on a proper submission form that records consent with a date and a version, which is better than an email exchange for everyone. Until it exists, this is the process, and we would rather say that than imply a system we do not have. Questions about any of this go to service@decoysignal.com.