Zala Secure
Is this a scam?
Paste the message, or add a screenshot or a voice note. Then press Check.
Before you act
Before you pay, click or share — check with Zala.
Or choose a specific check
Sign in for this check
This check uses live lookups, so it needs a Zala account — the same one as Zala Savings. QR codes, email headers and app files are read in your browser without one.
Which country do you live in?
Asked once, before the first check. Zala Secure is not offered to people living in the European Union, the European Economic Area, the United Kingdom or Switzerland.
What are you unsure about?
Paste the message or the link. Or add a screenshot — the sender and time in it help, and a QR code in it is read too.
Checked, then discarded. Nothing is kept unless you choose to share it afterwards.
What does this QR code do?
Parking meters, restaurant tables and parcels get fake stickers over the real code. Point your camera at it, or upload a photo — it's read in your browser, and nothing opens until you decide.
Is this shop real?
Paste the shop's address. I look up when it was registered, when its first security certificate appeared, whether it's on scam blocklists, whose brand it uses, and how it wants to be paid.
Only the address is looked up. Usually 5–15 seconds.
Before you pay this invoice
Invoice fraud sends a real-looking invoice with one line changed: the bank account. Check the IBAN — whether it's real, which country the account is in, and whether it's the account this supplier used last time.
Sign in and I'll also remember this supplier's account — as a fingerprint, never the number — and warn you the day it changes.
Or check the invoice file itself
Totals that don't add up, a VAT rate nobody charges here, a PDF made in an image editor or edited after it was created, a QR code inside. Needs an account; the file is checked and not kept.
Who really sent this email?
The “From” line is typed by the sender. The headers are written by the mail servers. In Gmail: ⋮ → Show original. In Outlook: ⋯ → View → View message source. Copy it all and paste it here — it's read in your browser, not sent.
What can this app do?
A “parking fine” or “bank security” app sent as a file is how many accounts here are emptied. Choose the .apk and I'll read what it's allowed to do — in your browser, without installing or uploading it.
A number, an account, a wallet or a website
Paste what you were given — a phone number, an IBAN, a crypto wallet address or a website. I'll say what it is and whether other Zala users reported it. A report count is people's reports, not proof.
Sign in to see reports from other people and to check wallets against sanctions and scam lists. What's worked out in your browser is shown either way.
Does the SMS sender match its story?
In the UAE and Saudi Arabia, organisations text from registered names, and marketing senders are marked: “AD-Name” in the UAE, “Name-AD” in Saudi Arabia. Type the sender exactly as your phone shows it. Worked out in your browser.
Buying or selling online
Nobody needs your card details to pay you, and a transfer screenshot isn't money. Answer what happened, check a payment link, or check a receipt someone sent.
A payment or courier link they sent
A transfer receipt they sent
Save the image as it was sent to you, then choose it here — the file is checked as it is, so what saved it can be read. Needs an account.
Is this job or visa offer real?
A famous employer, an interview on WhatsApp, then a fee for the visa, the medical or the attestation. In the UAE the employer pays for your visa — a job never starts with you paying.
Is this flat real?
A price below market, a landlord abroad, and a deposit “to hold it” before any viewing. Answer what happened, and check the listing link.
The listing or payment link
Is this job or investment real?
These scams are a conversation, not one message: a friendly recruiter, a small first payout that really arrives, then a deposit to “unlock” more. Answer what happened. Worked out in your browser; nothing is sent.
On this device
Install Zala Secure on your home screen, and get alerts here — a new breach of your email, a relative's high-risk check, a change on a domain you watch.
Forward emails to check
Forward a suspicious email to check@zala-me.com from the address on your Zala account, and the answer comes back by email. Forward it “as attachment” so who really sent it is checked too.
Being switched on soon.
Has a password leaked?
Checked in your browser against Have I Been Pwned. The password never leaves this device — only the first 5 characters of its fingerprint are sent, shared by hundreds of thousands of passwords.
Is your email in a breach?
Checks the verified email addresses on your Zala account against Have I Been Pwned — which means the address itself is sent to them. Nobody can check someone else's address here.
Sign in on the Check tab to use this.
WhatsApp checkup
Most account takeovers here start with WhatsApp. Two minutes, with your phone in your other hand.
Does this number match its story?
Worked out in your browser. Useful when a call or message claims to be a bank, the police or a government office.
Watch your domain
For a business or a family domain: I check who can send email as you, whether your DNS or certificate changes, and whether anyone registers a look-alike — daily, reporting only changes. Connect Telegram below to be told as it happens.
Sign in on the Check tab to watch a domain.
Alerts on Telegram
The app can't reach you when it's closed. Connect @zala_secure_bot and new breaches of your email arrive there.
Sign in on the Check tab to connect.
Your security plan
Answer what you can. You get an ordered list of what to fix — not a score. Worked out in your browser; nothing is sent.
Not on the web
- Checking a Wi-Fi network — it has to run on the device that's connected, and a website can't.
- Watching your domain for changes and look-alikes — send
/watch yourdomain.comto @zala_secure_bot.
Set up a parent's phone in one link
Send one link. When they open it, Zala Secure opens in simple mode, in their language, with your number behind “Call my family” — and your invitation to be told about serious scams ready for them to accept.
Be told about the serious ones
The people most targeted by scams are often the least likely to tell anyone. With their agreement, you're told when something they check comes back high risk — never what it was — and they can end it any time.
Sign in on the Check tab to use this.
A family safe word
A few seconds of someone's voice is enough to fake a call in it. Agree a word only your family knows, and ask for it whenever a call about money sounds like one of you. It's made on this device and never sent anywhere.
A call that sounds like family
“Mum, I've been in an accident — don't tell Dad, just send the money.” If it's urgent, secret and about money, do this:
Someone sent you a code?
Sign in on the Check tab to accept it — or open their link in Telegram.
Who is told about you
Nobody yet.
Zala Secure for a business Free in the pilot
Invoice fraud works because the person paying this month isn't the one who paid last month. A team shares one memory of every supplier's bank account, one list of watched domains, and a feed of what members ran into — never messages or account numbers.
Sign in on the Check tab to create or join a team.
For teenagers and parents
Gaming scams, and what to do if someone threatens to share private images. You're not in trouble.
I just got scammed
Paid, shared a code, or installed something? The first hour matters most. Press this for the steps in order.
On a suspicious call right now?
Keep this open while you talk.
Someone got into an account
The first hour matters most. Choose the account for the steps in order — every link goes to the service's own recovery page. Anyone offering to recover it for a fee is a second scam.
Report it for me
Lost money, or gave away a code? Fill in what you know and get the text to send your bank and the police — and what to do, in order. Built in your browser; nothing is sent or kept.
What you shared
Warn the next person
Report the number, account, wallet or website that scammed you. Once three different people report the same one, anyone who checks it on Zala is told. It's stored as a one-way code, and removed with everything else you shared if you ask.
Sign in on the Check tab to report.
Playbooks
Watch the investigation
Choose what you want to investigate. Every detection engine runs in front of you, in order — what it checks, what it found, and how long it took.
Warn people: share an alert card
A picture for your WhatsApp Status or a story — one scam, the one thing to notice, what to do. Made on your phone.
Real scams, shared by people who received them
Shown only with the permission of the person who shared it, after names and anything that could point to them were removed.
Loading…
Spot the scam
Twelve messages written for this quiz, in the styles going around here — some real, some not. Share it with someone who won't install anything.
What's going around
Scam patterns from this week's checks — counted by type, never messages, senders or links. A pattern appears only once at least three different people ran into it.
Loading…
Want it every Sunday? Send /weekly on to @zala_secure_bot.