# Scam detection API for apps and AI agents

Each call returns a `verdict` and its `reason_codes` for a single link, domain, phone number, email, wallet or IBAN.

Bewary is a scam detection API and MCP server for apps and AI agents. It looks up links, domains, phone numbers, SMS short codes, email addresses, IP addresses, crypto wallets, IBANs, mobile apps and payment handles, assesses a new account's contact points in one call, and finds related domains. Every lookup returns `verdict`, `reason_codes` and typed facts. The verdict is `scam`, `suspicious`, `safe` or `unknown`. Unknown is never safe. A free key gets 1,000 credits a month without a card.

Get an API key: https://bewary.app/account. Docs: https://bewary.app/docs/index.md. Updated 2026-11-02.

## Lookup API endpoints

Each lookup returns a verdict, the signals that decided it and typed facts. The answers below were recorded from the live API.

| Endpoint | Call | Credits | Speed |
|---|---|---|---|
| [Phishing link checker API](https://bewary.app/docs/url.md) | `GET /v1/url` | 1, deep 30 | median 477 ms |
| [Domain age and lookalike domain API](https://bewary.app/docs/domain.md) | `GET /v1/domain/{host}` | 1, deep 30 | median 449 ms |
| [Phone number scam lookup API](https://bewary.app/docs/phone.md) | `GET /v1/phone/{number}` | 1 | median 115 ms |
| [SMS short code lookup API](https://bewary.app/docs/shortcode.md) | `GET /v1/shortcode/{country}/{code}` | 1 | median 113 ms |
| [Disposable email check API](https://bewary.app/docs/email.md) | `GET /v1/email/{address}` | 1 | median 211 ms |
| [IP address lookup API](https://bewary.app/docs/ip.md) | `GET /v1/ip/{ip}` | 1 | median 260 ms |
| [Crypto wallet scam check API](https://bewary.app/docs/wallet.md) | `GET /v1/wallet/{chain}/{address}` | 1 | median 127 ms |
| [IBAN validation API](https://bewary.app/docs/iban.md) | `GET /v1/iban/{iban}` | 1 | - |
| [App store lookup API](https://bewary.app/docs/app.md) | `GET /v1/app/{store}/{app_id}` | 1 | - |
| [Payment handle lookup API](https://bewary.app/docs/payment-handle.md) | `GET /v1/payment-handle/{provider}/{handle}` | 1 | - |
| [Related domains API](https://bewary.app/docs/related.md) | `GET /v1/domain/{host}/related` | 5 | - |

| Endpoint | Call | Credits | Speed |
|---|---|---|---|
| [Seller and profile risk API](https://bewary.app/docs/assess.md) | `POST /v1/assess` | 1 per field | - |
| [Bulk scam lookup API](https://bewary.app/docs/batch.md) | `POST /v1/batch` | 1 per item | - |

Recorded answers, the fields a caller reads:

- `GET /v1/url?u=http://paypal-login-secure.top/verify?account=update`: scam, `final_url` http://paypal-login-secure.top/verify?account=update, `shortener` false, `domain.lookalike.brand_id` paypal, `domain.lookalike.technique` brand_word
- `GET /v1/domain/chase.com`: safe, `registered_at` 1995-10-11T04:00:00Z, `age_days` 11342, `registrar` MarkMonitor Inc., `expires_at` 2027-10-10T04:00:00Z
- `GET /v1/phone/+12013408962`: unknown, `e164` +12013408962, `country` US, `original_carrier` LEVEL 3 COMMUNICATIONS, LLC - NJ, `complaints.ftc.count` 12
- `GET /v1/shortcode/US/86006`: safe, `code` 86006, `country` US, `status` legitimate, `operator.name` Bank of America
- `GET /v1/email/signup@mailinator.com`: suspicious, `disposable` true, `free_provider` false, `role_account` false, `mx` true
- `GET /v1/ip/1.1.1.1`: unknown, `version` 4, `asn` 13335, `as_org` CLOUDFLARENET - Cloudflare, Inc., US, `country` AU
- `GET /v1/wallet/eth/0x098B716B8Aaf21512996dC57EB0615e2383E2f96`: suspicious, `chain` eth, `caip2` null, `sanctioned` true, `listed` false
- `GET /v1/iban/DE89370400440532013000`: unknown, `print_form` DE89 3704 0044 0532 0130 00, `country` DE, `valid` true, `sepa` true
- `GET /v1/app/google_play/com.whatsapp`: unknown, `store` google_play, `app_id` com.whatsapp, `name` WhatsApp, `developer` WhatsApp LLC
- `GET /v1/payment-handle/venmo/venmo`: unknown, `provider` venmo, `handle` venmo, `status` active, `status_checked_at` 2026-10-31T21:06:41Z

## Response schema

The shared response schema lets a single parser read answers from every endpoint.

- `verdict`: scam, suspicious, safe or unknown. Unknown is never safe.
- `p_scam`: The probability that it is a scam, from 0 to 1.
- `reason_codes`: Stable codes that decided it, strongest first. Codes are added, never renamed.
- `entities`: The value and what it resolves to, such as a link's domain, each with its verdict and typed facts.

Act on a verdict in Python:

```python
import requests

r = requests.get(
    "https://api.bewary.app/v1/url",
    params={"u": "https://usps-redeliver.top/fee"},
    timeout=20,
).json()

if r["verdict"] == "scam":
    print("Scam:", r["reason_codes"])
elif r["verdict"] == "safe":
    print("No scam signs found")
else:  # suspicious or unknown: never wave it through
    print("Be careful:", r["reason_codes"])
```

## MCP server for AI agents

The MCP server's 15 tools run the same code as the REST API. An agent can call a tool before opening a link, calling a number or sending money.

MCP server (streamable HTTP): https://api.bewary.app/mcp. Tools: `lookup_url`, `lookup_domain`, `related_domains`, `lookup_ip`, `lookup_phone`, `lookup_shortcode`, `lookup_email`, `lookup_wallet`, `lookup_iban`, `lookup_app`, `lookup_payment_handle`, `watch`, `unwatch`, `list_watches`, `list_events`. Setup for each client: https://bewary.app/mcp. Framework examples: https://bewary.app/docs/ai-agents.md

```bash
claude mcp add --transport http bewary https://api.bewary.app/mcp
```

## Data coverage

1,934,038 records Bewary answers from, read from GET /v1/datasets on November 4, 2026 (the live figures: https://bewary.app/data). Data from FTC, FCC, OFAC, Federal Network Agency, CERT Polska, 165 anti-fraud line, NANPA, Certificate transparency logs, RDAP, Deutsche Bundesbank, Banca d'Italia, Oesterreichische Nationalbank, Banka Slovenije, National Bank of Belgium, European Central Bank, Banco de España, Czech National Bank, Národná banka Slovenska, Croatian National Bank.

### Worldwide

- DNS history: 864,153 domains. Addresses, name servers, mail servers and change history.
- Phishing and malware feeds: 371,543 live domains. Read hourly. Each domain is re‑checked weekly, and dead ones stay as history.
- Disposable email domains: 51,431 live domains. Disposable address, free provider or role mailbox.
- Crypto wallet reports: 28,604 wallets. Addresses named in scam reports.
- Stablecoin issuer freezes: 11,318 wallets. Addresses Tether and Circle froze on chain.
- National bank code lists: 10,365 banks. Banks with their BICs and addresses in 25 countries, free of charge from each publisher.
- Platform takedowns: 1,449 links. Pages a hosting or form platform took down itself, each listed as the exact link.
- US sanctions list: 805 wallet addresses. The US Treasury's OFAC list of sanctioned crypto addresses.
- Banks on sanctions lists: 252 banks. Banks on the OFAC and EU sanctions lists, by BIC or as an office the list names, read daily.
- IBAN formats: 89 countries. ISO 13616: registry country, length, BBAN structure and check digits.
- Brand registry: 43 brands. Domain lookups flag lookalikes of these brands.

Also behind every answer: RDAP registration, Certificate transparency logs, Web archive, IP networks, App Store and Google Play, Cash App, PayPal and Venmo profiles.

### By country

| Country | Scam domains | Reported phone numbers | Number blocks | Banks for IBAN checks | SMS short codes |
|---|---|---|---|---|---|
| United States (NANPA, FTC, FCC) | - | 381,173 | 202,774 | - | 26 |
| Taiwan (165 anti-fraud line) | 65,328 | - | - | - | - |
| Poland (CERT Polska) | 61,405 | - | - | - | - |
| Germany (Federal Network Agency, Deutsche Bundesbank) | - | 10,013 | - | 3,432 | - |
| Italy (Banca d'Italia) | - | - | - | 1,201 | - |
| Switzerland (SIX Interbank Clearing) | - | - | - | 1,071 | - |
| Austria (Oesterreichische Nationalbank) | - | - | - | 874 | - |
| Slovenia (Banka Slovenije) | - | - | - | 821 | - |
| Belgium (National Bank of Belgium) | - | - | - | 782 | - |
| France (European Central Bank) | - | - | - | 504 | - |
| Spain (Banco de España) | - | - | - | 425 | - |
| Ireland (Deutsche Bundesbank) | - | - | - | 248 | - |
| Lithuania (Bank of Lithuania) | - | - | - | 230 | - |
| Luxembourg (European Central Bank) | - | - | - | 120 | - |
| United Kingdom (Deutsche Bundesbank) | - | - | - | 115 | - |
| Portugal (Banco de Portugal) | - | - | - | 104 | - |
| Netherlands (Deutsche Bundesbank) | - | - | - | 91 | - |
| Malta (Central Bank of Malta) | - | - | - | 63 | - |
| Czechia (Czech National Bank) | - | - | - | 47 | - |
| Cyprus (Central Bank of Cyprus) | - | - | - | 42 | - |
| Greece (European Central Bank) | - | - | - | 39 | - |
| Slovakia (Národná banka Slovenska) | - | - | - | 38 | - |
| Romania (Deutsche Bundesbank) | - | - | - | 26 | - |
| Bulgaria (European Central Bank) | - | - | - | 23 | - |
| Croatia (Croatian National Bank) | - | - | - | 22 | - |
| Latvia (Deutsche Bundesbank) | - | - | - | 22 | - |
| Liechtenstein (SIX Interbank Clearing) | - | - | - | 20 | - |
| Gibraltar (Deutsche Bundesbank) | - | - | - | 5 | - |

## Use cases

- [AI agents](https://bewary.app/mcp): Give an agent the MCP server and it checks a link, number or wallet before it opens, calls or pays. The tools return typed JSON, not prose.
- [Payouts and payments](https://bewary.app/docs/iban.md): Before a payout, Bewary checks an IBAN's check digits and, in 25 countries, names its bank and BIC. It matches wallets against US sanctions and says whether a Venmo, PayPal or Cash App handle is active.
- [Messaging and SMS platforms](https://bewary.app/docs/shortcode.md): Your SMS router uses short code and URL lookups to pass legitimate short codes and block lookalike links before delivery.
- [Trust and safety](https://bewary.app/docs/batch.md): Your queue sends up to 1,000 reported values in one POST /v1/batch call. Each answer carries the reason code that decided it.
- [Seller and account onboarding](https://bewary.app/docs/assess.md): One POST /v1/assess call reads a new seller's website, email, phone, other links and payout wallet, returning a single deny, review or pass decision.

## Pricing

The API, CLI and MCP server share one credit balance.

- Free key: Free keys get 1,000 credits monthly without a card. Lookups cost 1 credit. Every call needs a key.

| Pack | Credits | Per 1,000 credits |
|---|---|---|
| $20 | 10,000 | $2.00 |
| $100 | 60,000 | $1.67 |
| $500 | 375,000 | $1.33 |
| $2,000 | 2,000,000 | $1.00 |

Credits never expire.

Packs and credits per call: https://bewary.app/pricing

## Free tools

Free domain age, link, phone number and QR code checkers use the same API.

- [Is this link safe?](https://bewary.app/check/link)
- [Is this QR code safe?](https://bewary.app/check/qr)
- [Is this number a scam?](https://bewary.app/check/phone)
- [Has my email leaked?](https://bewary.app/check/email)
- [Domain age checker](https://bewary.app/check/domain-age)

## Questions

### Is there a free scam detection API?

Yes. A free key gets 1,000 credits a month without a card, enough for 1,000 lookups on any endpoint. Prepaid credit packs start at $20 and never expire.

### What does the scam detection API check?

Bewary looks up links, domains, phone numbers, SMS short codes, email addresses, IP addresses, crypto wallets, IBANs, mobile apps and payment handles. Assess checks a new account's website, email, phone and wallet in one call, and related domains finds the other domains on the same setup.

### Is there an MCP server for AI agents?

Yes. The MCP server at https://api.bewary.app/mcp has 15 tools for Claude, ChatGPT, Cursor, VS Code and other MCP clients over streamable HTTP. They run the same code as the REST API, declare an `outputSchema` and return `structuredContent`.

### What is the API latency?

Lookup medians ranged from 113 to 477 ms, measured from Europe on October 23, 2026 with first-time inputs. Lookups use no language model.

### What request data does Bewary store?

A lookup keeps no record of who asked. It can add the value itself to Bewary's data: a looked-up domain is queued for its web-archive history, and a looked-up app is recorded as seen on its store. API keys are stored as SHA-256 hashes.