CallCheck
Someone contacted you claiming to be a company or an agency. This will never tell you they are real — nothing can, on a phone call. It tells you what the organisation itself has published about how it contacts people, so you can test the call against their rules instead of your instinct. Everything runs on your device.
Caller ID proves less than you think
Since 2020 US carriers have had to implement STIR/SHAKEN. The FCC describes it as letting “the phone company of the consumer receiving the call verify that a call is in fact from the number displayed on Caller ID.” Read that closely: it authenticates the number. It says nothing about who is holding the phone, and someone who lawfully rents a number gets a valid signature like anybody else. The number is signed. The claim is not. FCC
Make them prove it to you
You are asked to prove yourself to callers constantly. Nobody teaches you to make the caller prove themselves to you, and the whole fraud runs on that asymmetry. A real organisation can answer these. An impersonator cannot, because the real one already holds the relationship.
- “I’ll call you back on the number on my statement.”
A real organisation will say yes without hesitating. This is the single most effective sentence available to you, and it needs no technology. - “What are the last four digits of the account you’re calling about?”
They contacted you, so they should already hold the relationship. Never confirm it for them — if they read it out wrong, or ask you to supply it, that is your answer. - “What is the reference on the letter you sent me?”
Most organisations write before they call. Someone who cannot name a letter they never sent has told you something. - “Give me our family word.”
For a caller claiming to be a relative in trouble. Agree one word in advance, in person, and never write it anywhere. A cloned voice does not know it.
Look them up in the record
If a name has already been through a court, that is a fact you can check rather than a feeling you have to trust. Fraudbase is a searchable record of 66 prosecuted and charged cases and the 168 people and organisations named in them, every entry carrying the status of what has actually been established — proven, charged, or alleged — so the label travels with anything you carry out of it.
Finding nothing means nothing. Sixty-six cases is a record, not a census, and the overwhelming majority of fraud is never charged at all. A clean search result is not a clean company — it is an empty search result, and the two are easy to confuse at exactly the moment it matters most.
What the directory holds
Every line below is quoted from the organisation’s own public page, with a link. Nothing is paraphrased into a rule they did not state, and an entry that cannot be sourced does not go in — which is why this list is short. It is a directory of real quotes, not a registry of enrolled companies: no organisation has enrolled, because there is nothing yet to enrol in.
Microsoft
Microsoft says it does not contact you first about a problem with your computer.
- “Microsoft error and warning messages never include phone numbers.” source
- “Microsoft does not send unsolicited email messages or make unsolicited phone calls to request personal or financial information, or to provide technical support to fix your computer.” source
- “Microsoft will never ask that you pay for support in the form of cryptocurrency like Bitcoin, or gift cards.” source
Internal Revenue Service
The IRS says it normally contacts people first by U.S. mail.
Social Security Administration
Nothing you type here leaves your device. This page makes no claim to detect a scam, and never will — the one move that reliably works is the one it keeps pointing you back to: hang up, and dial a number you found yourself.