Malwarebytes Scam Link Check: free tool rates risky URLs
Malwarebytes has released Scam Link Check, a free web tool that tells users whether a link is safe before they open it.
The tool is designed for the suspicious URLs that arrive by text message, email, chat apps or social media. Users paste the link into the tool and get back a safety result, an explanation of why the link was rated that way, and advice on what to do next.
Scams now outweigh traditional crime
Malwarebytes is launching the tool as online fraud reaches a very large scale. An estimated $442 billion was lost to scams worldwide in 2025, and Americans alone lost roughly $21 billion that year.
At the 2026 UN Fraud Summit, governments reported that cyber-enabled fraud run by organized crime is now bigger than the global trade in weapons, drugs and human trafficking combined.
According to Malwarebytes, fake websites are the main way much of this fraud reaches victims. Its research found that malicious websites, including phishing pages, counterfeit shops and malicious ads, outnumber every other scam delivery method, ahead of email and text messages. Fake stores are a familiar tactic, as shown by kits such as the Milk Dragon phishing kit, which lures shoppers with fake discounts.
The company also found that 85% of people say they can no longer reliably tell a scam from the real thing. A year earlier, that figure was 66%.
"The thing most likely to drain your bank account today isn't a virus. It is a link that looks like it came from your bank, a delivery service, or a friend," said Mark Beare, Head of Consumer at Malwarebytes.
"We've spent years asking people to become scam experts, and it hasn't worked, because scams evolve faster than anyone can track. Instead, we flipped the model. Rather than asking people to spot the scam, we give them an expert," he added.
How the link check works
The process is short. A user pastes or types a URL into the tool, and Malwarebytes scans it using its threat intelligence ecosystem.
The analysis looks for known malicious sites, phishing pages, newly registered domains and redirect chains that hide the real destination of a link. Within seconds, the user receives a verdict of safe, dangerous or unknown.
The verdict comes with several extra pieces of information:
- a screenshot of the website, so users can see the page without visiting it
- a plain-language explanation of the reasons behind the verdict
- recommended next steps, including what to do if the link was already clicked
- an option to report a website, which feeds new data back to Malwarebytes
- a direct entry point into Malwarebytes Scam Guard for more help
The screenshot feature lets users check a page without loading it in their own browser. The reporting option is meant to help protect other users who come across the same site later.
Part of a wider anti-scam toolkit
Scam Link Check is one of several Malwarebytes consumer tools aimed at fraud. The company describes the set as following three steps: see what is exposed, reduce the attack surface, and get an answer in the moment.
Malwarebytes Digital Footprint is a free scan that shows what personal information has already leaked through breaches and the dark web, based only on an email address.
Malwarebytes Personal Data Remover looks for personal data being sold on data-broker and people-search sites and automates the removal process.
Malwarebytes Scam Number Check is a free tool that rates whether a phone number is safe or potentially harmful. Users can also report suspicious numbers.
Malwarebytes Scam Guard is a scam detector built into the company's Windows, Mac, web and mobile products. It combines an AI chatbot interface with Malwarebytes threat intelligence and offers help around the clock. It is free on iOS, Android, Windows and macOS, in the Browser Guard extension, on the web, and inside ChatGPT and Claude, where users can ask "@Malwarebytes, is this a scam?"
Our Take
The most telling number in this launch is not the size of global losses but the jump from 66% to 85% of people saying they cannot reliably spot a scam. If that trend is accurate, it suggests that the long-standing advice to "look for warning signs" is losing value, and that outside verification tools may become a normal part of everyday browsing.
This fits a wider pattern of scams arriving through trusted channels. Recent cases such as the hijacked Nikkei account that sent phishing emails and the rise in employment scam victims show that a familiar sender is no guarantee of safety.
Readers should keep in mind that an "unknown" verdict is not the same as "safe", especially for freshly registered domains. It is worth watching how quickly the tool flags new phishing sites, and whether user reports meaningfully improve detection over time.