The ‘REVIEW PROJECT’ link led to a phishing page which imitated a Google login. Luckily, Jacana protected her with a timely alert:

“I was expecting a quote for some research from a vendor I work with all the time. I received this. But I didn’t click! Thank you Jacana!”

I’d like to highlight three things about this scam:

1. The message was realistic, and it was customized. The adversary had access to the vendor’s email account, which means they had access to the vendor’s entire email history. With AI, scammers can read that history and build a targeted approach for every single person the compromised account has ever talked to. And they can do this in just seconds. This email was written specifically for Jen, from someone she knew, with his normal signature.

2. These scams are very easy to make. The email is automatically tailored to maximize the chance you click the link. Everything after that is off the shelf. Last month I wrote about an event invitation from a colleague. After the click, the rest of that scam was identical to this one: a phishing page impersonating Google to collect login credentials, then the account gets used to send similar phishing emails to everyone the victim has ever talked to. Each compromised account produces more than one new compromised account, so it grows virally until nearly everyone with an email address has been targeted.

3. This was not a one-off. Jen received emails from additional vendors whose accounts had also been compromised. Scammers can try again and again, automatically and for free, until one lands. And once one lands, your email address goes on a list that records exactly what you fell for, which then gets sold to other scammers running their own schemes.

What happened next

Later that afternoon, the vendor sent Jen a followup email:

It was a great email. The subject line named the exact email so recipients could find it. He said plainly that it was fraudulent and not to click. He explained what had already been fixed on his end (password reset, all sessions signed out, attacker access removed). He gave recovery steps for anyone who had already entered a password. And he included a small, human line at the end: “it’s really me this time.”

But it was too late. The phishing email went out at 12:12 PM. The notice arrived at 4:29 PM. That is a normal, even fast, human response time for discovering a compromise, securing your account, and writing a careful note to your contacts. It is also four hours in which every person on that list was unprotected. The followup helps, but most of the damage was already done by the time it landed. Jen was only safe because Jacana warned her in real time.

“The scam spreads from inbox to inbox – I received it from a trusted contact whose account had been taken over the same way.”

The vendor was unfortunately a victim of the same scam, one link back in the chain. His day became locking down the account, reconstructing who got hit, and writing these emails. He had to absorb the reputational hit of telling every client he works with that his account was taken over. And he still doesn’t know what was read, copied, or kept from years of his email, or what it will be used for later.

What you can do to stay safe

Turn on passkeys. A passkey is tied cryptographically to the real website, so a fake login page cannot use it even if you try to hand it over. Google and Apple both support them and setup takes seconds.

If you see something weird, pause and verify. The name, the address, and the signature were all real, and the message was plausible. But there were subtle parts of the message that may have felt off – for example, the opener “Dear Vendor/Contractor,” the use of bcc list for a personal business email, or the link pointed somewhere unrelated to the company it claimed to be from. If something feels off, run a scam check for a second opinion, and if you’re still not sure, call the supposed sender to verify it’s authentic before clicking.

Use software to stay safe. These scams are getting really hard to spot on our own. Jen didn’t recognize this one. She was safe because Jacana was checking the page in real time, four hours before anyone told her to be careful.

Why the browser?

Dan and I founded Jacana to solve scams for everyone. Our mission is to protect regular people from cyber harm, because right now, we’re all on our own.

The browser is a significant surface area where we interact with the Internet, especially on our computers. It’s where many of us check email, browse, do social media, and message every day. It’s where scammers direct you to from scam texts and calls, because it’s where the actual theft happens: a fake bank login page, a counterfeit store, or a form asking for your card details.

Download the Chrome Extension

What the extension does

The Jacana Chrome Extension brings always-on protection to your Chromium-based browser. This means that it works on Google Chrome, Brave, Opera, and Microsoft Edge. Here’s a list of Chromium-based browsers.

• Always free: Manual Scans. If you are suspicious of a webpage or something in your browser, click “Scan,” and we will check it for you and let you know if it’s a scam.

• Paid plan: Always-on protection with Autoscan. Autoscan runs in the background looking for scams. When it finds one, it will alert you. The reason we become victims of scams is that we don’t recognize a scam until it’s too late. Autoscan solves that. By the way, on a paid Jacana plan, you get access to all of our features on all your devices.

Download Jacana on all your Devices

A quick note on privacy. The Jacana Chrome Extension scans pages you browse to keep you safe from scams. We give you full control of your data, and we only use any data you choose to share to improve our scam detection systems to help protect everyone. We don’t sell your data, and we never will.

Just like the Jacana App, the extension is simple and easy to use. Install it in a couple of clicks, and it quietly does its job in the background. No settings to fiddle with, no alerts unless something is actually wrong.

How it fits with the Jacana App

Scammers come at us from many angles, which is why one Jacana plan covers all your devices and apps. If you do a lot of work in your Chrome or Chromium-based browser, the Jacana Chrome extension is a great option, because it improves Jacana’s effectiveness in the browser. Your plan also covers desktop (Windows and MacOS) and phone (iOS and Android).

Download Jacana on all your Devices

Get started

Head to the Jacana Extension Page, click “Add to Chrome,” and you’re protected in under a minute. You can also download the Jacana App for your whole desktop (Windows and MacOS) or phone (iOS and Android coming soon) from the Jacana download page.

If you have ideas, comments, suggestions, questions, or need help with a scam, please email me at talktotate@hellojacana.com or support@hellojacana.com.

Stay Safe,

Tate Jarrow

Cofounder & CEO of Jacana

Subscribe now

Download Jacana

We are on a mission

Dan and I founded Jacana to solve the problem of scams for everyone.

Our mission is to protect regular people from cyber harm, because right now, we are all on our own. Our friends and families are left to fend for themselves against sophisticated AI-powered attackers, and nearly 1 in 4 of us lose money to scams each year.

What Jacana does and why we are different

Jacana is a simple and easy-to-use App that installs on your computer or phone. Starting today, you can download Jacana on your Mac or Windows computer, and Android and iOS will be available in the coming weeks. One plan covers all your devices and any App running on them, which is critical because scammers come from many angles.

Download Jacana

We offer 3 types of plans

Always free

• Run unlimited manual scans to check if something is a scam.

• Unlimited Trust Check verifications. Trust Checks are your defense against AI deepfake impersonation scams by allowing you to verify whether someone contacting you, claiming to be a friend or loved one, actually is. Add your friends and family to the Jacana App to get protected.

Individual plan

• Always-on protection that runs in the background on your device, and covers all of your apps. If it identifies a scam, it sends you a warning. With always-on protection, the onus is no longer on you to identify scams on your own. It’s like having a digital safety expert like me giving you personalized advice.

Family Plan

• Provides always-on protection for up to 6 adults, enough to protect your significant other and both sets of parents. Add more than 6 for just a few dollars more a month.

• Family dashboard notifies you if someone on your family plan receives a scam alert. The scam alert is generic (to preserve privacy), but it provides enough information to give you peace of mind or check up on them if needed.

Jacana puts people first. People like you and me are expected to be suspicious all the time and figure out for ourselves whether incoming texts, emails, and phone calls are real or scams, which is basically impossible these days. If one slips through, nobody is picking up the bill or helping us recover. We built Jacana so that it doesn’t have to be this way.

What’s an “open beta”?

Open Beta means that the product isn’t perfect yet, so there are still some improvements to be made. However, scams are getting worse, and we don’t want to wait for perfection before starting to protect people. This is why we are launching with a 50% discount! Send us feedback using the feedback button in the App!

What’s the Jacana name all about?

Our company name, Jacana, is inspired by a bird known for its caregiving instincts, its alert calls when danger nears, and its steady footing on unstable ground. This name reflects our vision for digital safety built around people, not just software.

Get started

Head to hellojacana.com, download the App, and you’ll be protected in a couple of minutes. Let’s get safe and stay safe, together. Check out a video from our teammate, Medha, for a quick overview of how the App works.

If you have ideas, comments, suggestions, questions, or need help with a scam, please email me at talktotate@hellojacana.com or support@hellojacana.com.

Download Jacana

Stay Safe,

Tate Jarrow

Cofounder & CEO of Jacana

Subscribe now

The email in question was from “Daniel Nelms.” That’s me!

The subject line read “Arrangement for Reunion / Gathering June 2026 Daniel Nelms.” I’m flying to see my mom tomorrow and the whole family is coming. So this checks out.

The body of the email said “I just thought those photographs might be of interest to you,” which is plausible as we share photos all the time.

The answer to her question, of course, was “yes” this is spam. The link and from address were red flags. My mom noticed and was suspicious… but clicked anyway. Luckily, the webpage had been taken down by the time she got there.

To disarm her, the spammer just needed one true detail (she knows me) and one good guess (that we’re getting together this month for some kind of reunion or gathering).

It’s very easy for scammers to get this information. There are over 3,000 data breaches a year, so most emails in use are on a list somewhere. Data brokers and fraudsters buy and sell your information. Public records and social media enrich it with true details like your name, address, phone number, and who you know.

That’s all it takes to build a believable story. And they can try hundreds of narratives until one works. And, once one works, scammers log the conversion so they can run the same playbook on you again.

It’s impossible to catch 100% of these. And all it takes is one to disrupt your life.

What you can do to stay safe

Be careful with vague emails. A reunion, a package, a photo, an invitation… Scammers guess at the things you care about, and sometimes they guess right. If it’s vague, check twice before you open it.

The sender’s address is harder to fake than the name. A sender can put anything they want in the name field. The email address is a more reliable signal (though not foolproof as a scammer could have compromised my account, or registered one that’s a single character off.)

When something feels off, don’t click. Verify it another way first. My mom forwarded the email to me to check if it was spam. That’s a good idea, just check before clicking next time!

Use software to help you. We’re all bombarded with scam attempts, and the stakes are too high to rely on intuition alone. Our app flags scams like this proactively, saving you the time and risk of being your own scam filter. Our mobile app is coming out next week – I’ll help my parents get set up on the reunion trip!

At a glance, the email was convincing. It looked like an invitation from her dentist’s office. The logo was right and it used their standard signature. It looked legit to me too.

After clicking the link, a loading page promised an “exclusive eCard” would download automatically, and three seconds later a file landed in her Downloads folder. That raised her alarm; invitations don’t download files. Instead of opening it, she came and found me. I’m a software engineer, so I could figure out what the file was without running it. Most people aren’t so lucky!

What was in the file?

The file contained a remote-access tool that IT teams use to control computers from afar. The software is real and properly signed. But it wasn’t needed to open an invitation from the dentist.

If she had double-clicked and followed the wizard, as the page politely instructed, a fraudster would have obtained control of her laptop. Her email, her bank, all of it.

When something felt wrong, my partner did what most people do – she asked someone she trusts. But we’re bombarded by scam attempts nearly every day, and this approach is far from reliable, and the stakes are too high to rely on catching every scam attempt.

What you can do to stay safe

My partner had an antivirus running, but it never made a sound. It wasn’t designed to. It analyzed the file and checked whether it was real, signed software, and it was. But today’s biggest risk is deception, and that needs context. An invitation from my partner’s dentist shouldn’t be asking her to install remote-control software.

My partner stayed safe the way most people do these days. She recognized something was wrong, and she asked someone she trusts (me!). But this approach isn’t reliable. We’re bombarded by scam attempts nearly every day, and the stakes are too high to count on catching them all.

I’m building Rebound AntiScam, an always-on scam protection app, so she doesn’t have to be suspicious all the time. She didn’t have it running that night, but went back and ran the email through our desktop app and it flagged the scam right away. Everyone should have protection like this, so staying safe doesn’t depend on catching every scam yourself.

What the industry can do to keep you safer

Remote-access vendors can make this harder. The remote access tool used in this scam was a real product. Legitimate remote-management tools should verify who signs up, throttle brand-new accounts, and add real friction before allowing unattended-access agents to operate on a stranger’s machine.

I opened it. I knew the sender, and the email was even marked “important” in my inbox. Inside was a Punchbowl invitation. I didn’t know what it was for, but friends send me invitations like this all the time.

I clicked “Open invitation.”

The next page asked me to verify I wasn’t a robot. If I had done that, a Google login page would have appeared asking me to sign in. If I had entered my credentials, my Gmail account would have been compromised. And if my account had been compromised, similar phishing emails would have been sent to my friends and colleagues.

Luckily, a warning popped up from our AntiScam app before I got that far. The “verify you’re human” step was there to lower my guard and to hide the fake page from traditional security filters. And that page was hosted by onyzforbidden.com, not google.com.

This simple scam has been around forever, but it still works. It uses compromised accounts to gain trust and compromise more accounts, spreading virally until the scammer has access to thousands of accounts. From there, the scammer either abuses that access for profit or sells the credentials to the highest bidder on the dark web.

What you can do to stay safe

1. Enable Multi-Factor Authentication (MFA) and Use Passkeys

MFA ensures that after entering your password, you must verify your identity, typically via a mobile app notification or a temporary code. It is a critical security upgrade over a password alone, and you should enable it on every account that supports it.

While MFA is stronger than passwords alone, sophisticated scammers have found ways to intercept standard SMS or app codes as well. Passkeys offer stronger protection. A passkey is stored securely on your laptop or phone, and unlocks instantly with your face, fingerprint, or device PIN. Because it is cryptographically tied to the legitimate website, a fake phishing page literally cannot steal or use it. Major platforms like Google and Apple fully support passkeys, and they take just seconds to set up.

2. Use a password manager.

Password managers generate and store strong passwords for you, with built-in options available from both Google and Apple. An additional benefit is that password managers will only fill in your login on the real website. If you land on a fake page and your password manager doesn’t offer to fill anything in, that’s a cue that the page may not be what it claims to be.

3. Download our AntiScam for Chrome browser extension.

Nearly half of Americans say they get a message they suspect is a scam every single day (2026 U.S. News survey). It’s helpful to educate yourself and stay vigilant, but it only takes one tired moment or one particularly clever scam to cause a big headache. Our AntiScam extension protects all your browsing – and warns you before you click, reply, or send money.

What the industry can do to keep you safer

1. Make it easier to flag compromised accounts.

Because this phishing email was sent from my friend’s real, hacked address, the danger didn’t stop with me. By the time I opened it, the scam had already been blasted to her entire contact list. How do I let my friend know that her account is compromised? How does she know what to do next, to recover her account and make sure her contacts are safe?

In this case, I had to reach out to my friend over WhatsApp to sound the alarm, and then call her to walk through account recovery steps. While every email client has a “Report Phishing” button to protect yourself, the industry lacks a seamless way to protect the sender.

Email platforms should consider a “Report Compromised Account” option. With a single click, it could securely alert the account owner via out-of-band channels (like SMS) and provide them with a clear, step-by-step account recovery playbook.

2. Shift from static blocklists to adaptive AI

Tech platforms protect millions of users daily, but inconsistently flag attacks like this one. Gmail marked this phishing email as “important” in my inbox, and Chrome failed to trigger a Safe Browsing warning on the phishing page.

With modern AI, it’s possible to catch 99% of scams that are falling through the cracks in existing filters, without overflagging. Yet, most of the industry still relies on traditional blocklists, which are simply too static and slow to intercept fast-evolving scam techniques. Safety requires adaptive technology that protects all your apps and devices, all the time.

Our AntiScam app successfully warned me about the phishing page, though it missed the initial email. The email featured a red flag – an “open invitation” link pointing to onyzforbidden.com – alongside subtler indicators like the use of BCC and a typo in the subject line (”Your Invited” instead of “You’re invited”). AI is fully capable of catching this. We are actively learning from every one of these missed opportunities, and are committed to building the most proactive and effective scam detection in the industry.

Bitcoin Depot, the largest Bitcoin ATM operator in the US, just filed for Chapter 11 bankruptcy (https://www.globenewswire.com/news-release/2026/05/18/3296277/0/en/bitcoin-depot-initiates-voluntary-chapter-11-process-to-facilitate-an-orderly-wind-down-and-sale-of-the-company-s-assets.html).

The numbers tell the story

• Last September, DC’s Attorney General sued Athena Bitcoin (https://wjla.com/news/local/dc-attorney-general-schwalb-sues-athena-bitcoin-crypto-atm-cryptocurrency-scams-washington-seniors-fraud-financial-exploitation-hidden-fees-teller-machines-consumer-protection-lawsuit-investigation), another major Bitcoin ATM operator. 93% of deposits into Athena’s seven DC machines over five months were the direct result of scams. The median victim was 71 years old, and the median loss was $8,000.

• Iowa’s Attorney General ran a similar investigation and found 95% of transactions on Bitcoin Depot and CoinFlip machines were fraudulent (https://www.aarp.org/advocacy/crypto-atm-fraud-protections/).

• The FBI reports Americans lost more than $388 million to Bitcoin ATM scams in 2025, a 58% increase over 2024 (https://www.ic3.gov/PSA/2026/PSA260515-2).

Bitcoin ATM companies are making almost all of their revenue from victims and scams. Once some States started forcing operators to take basic anti-fraud steps, the business model collapsed, meaning the vast, vast majority of transactions were facilitating scams. Which is why we say, if you’re asked to use a Bitcoin ATM, it’s almost certainly a scam!

Why these machines are the perfect tool for bad actors

Bitcoin ATMs let someone who has never owned cryptocurrency convert cash into crypto in five minutes, with no account setup, no identity verification, and minimal friction. Once that cash becomes crypto, the transaction is irreversible, and the money is gone forever.

The scam pattern is always the same: a bad actor calls pretending to be the IRS, your bank, Microsoft tech support, or a family member in trouble. They create a heightened emotional state and sense of urgency. They tell you to withdraw cash. They direct you to a specific Bitcoin ATM. They send you a QR code (which directs the funds to their wallet). They stay on the phone the whole time. Then your money is gone.

What to do

1. Never use a Bitcoin ATM. For most people, there’s no legitimate reason to use one.

2. Talk to your family today. Especially older relatives. Tell them: no legitimate person, business, or government agency will ever ask you to pay through a Bitcoin ATM. If anyone tells you to, it’s almost certainly a scam.

3. Download and use Rebound AntiScam! You can sign up to be an Alpha Tester here to get early access to our Scam Protection software. This is an App that runs on your device and alerts you when it detects an inbound scam.

Alpha Tester Signup

At Rebound, we’re building tools to protect families from exactly this kind of scam. Follow along as we build.

Subscribe now

Stay Safe!
Tate

Sign up to be an Alpha Tester

Why we’re building this

Scams are a problem for all of us.

The fake USPS “package undeliverable” text. The “your bank account has been compromised” email that wasn’t from your bank. The Instagram DM offering you a job that was just a little too good. Your mom getting a call from “your nephew” who’d been “arrested.” Your friend’s dad spending six months chatting with a “financial advisor” who turned out to be a scammer crew running out of Southeast Asia.

Scams are hitting all of us, all the time. And they’re getting worse. Bad actors used to need real human effort to run these plays. Now they’re using AI to scale, and they’re getting faster, better, and more personal every month. The same way a phishing email used to be easy to spot (”Dear Customer, kindly verify your information”), now you get a perfectly-worded text from your “CEO” that knows your name, your role, and what project you’re working on.

I’ve spent the better part of a decade obsessed with this problem, first as a Special Agent investigating cybercrimes at the US Secret Service, then building consumer protection products at Google.

Finally a real solution

Every couple of months, your bank (or your phone carrier, or the FTC, or your HR department) sends you an email with “5 tips to spot a scam.” These are some of the most technologically advanced organizations on the planet, with lots of funding, and the best they’ve come up with to protect you is an email telling you to “be cautious.”

It’s wild that nobody has built actual technology to help us in real time, on the device, when we need it. Well, that’s what we built.

What Rebound AntiScam does

Rebound AntiScam runs quietly on your devices and watches for scams in real time, across the apps you actually use and where scams can come in (your browser, your email, your messaging apps, you name it). When something looks off (a fake support page, a link from “your bank” that isn’t, a payment request that doesn’t smell right), Rebound flags it before you click, pay, or share.

This is an early alert system to notify us of scams that we would otherwise miss. In the age of AI-generated scams, none of us can do this on our own. We need technology to help us identify these scams. That’s what Rebound does!

A note on privacy: you stay in control of what Rebound sees and saves, and none of your information is ever or will ever be sold to anyone, ever! No ads here!

Why be an alpha tester?

1. It’s free during the alpha. Alpha Testers get the full paid product for free. No card on file, no trial timer counting down, completely free as long as you are an active Alpha Tester.

2. You shape what we build. This is the most important part. I read every piece of feedback we get. You’ll help us make the most useful product that protects you and your family.

3. You get it before anyone else. First-wave testers get the earliest look and the most direct line to the team and me.

4. Access to our Tester Slack community. This is where we share updates, get feedback, and engage with all of our awesome Alpha Testers!

5. Keep it between us. As an Alpha Tester, please don’t post about Rebound publicly, share screenshots, write it up, or give it to our competitors. You trust us to protect you, and we trust you to be a responsible Alpha Tester.

There will be bugs, the user experience and visual design won’t be perfect. We’re rolling access out in waves, so spots are limited and you may not get in on day one, but be patient!

Sign up to be an Alpha Tester

How to sign up

Head to trustrebound.com/alpha-tester-signup and drop your email. If you’re selected for the next wave, you’ll get an email from us with download instructions.

In the meantime, if you need help with a scam (or just have ideas), email me. I read everyone.

Stay Safe,

Tate

Subscribe now

Here’s a sample voicemail greeting for me (no, I don’t actually have one, and neither should you; just use the default).

“Hey, you’ve reached Tate’s phone. I’m not here right now. Leave a message, and I’ll call you back.” - my actual voice.

Using these 7 seconds of audio, I generated 2 deepfakes of my voice that can be used in scams. It took less than 30 seconds to create these.

Mixed in here is 1 actual recording that I did. Can you pick which one is real and which is a deepfake?

Sample 1:

“Hey mom, it’s me. I’m okay, but I’m in a bit of trouble and I really need your help right now. I got into a small accident, my phone is busted. That’s why I’m calling from a different number. I’m fine, I promise, but I need you to send me $2,500 on Zelle as soon as you can. Please don’t tell dad yet or anyone. I’ll explain the whole thing when I see you. I just need to handle this fast. Can you send it right now? I’ll text you where in a minute.”

Sample 2:

“Hey Dan, it’s Tate. I’m jumping on a call with the lead investor in like 5 minutes and I just realized I’m missing something. Quick favor, can you forward the master credentials doc to my personal Gmail? I need to pull a couple of numbers before this call starts. Also, Sidecar is asking us to wire the closing fees today, it’s 12 grand. I can’t do it from this phone, just kick it off and I’ll send the wire details over Signal in 2 minutes. Thanks man, you’re saving me.”

Sample 3:

“Yo, it’s me. So dumb story, my phone got lifted at the bar last night and I’m using a buddy’s right now. Long story short, I’m trying to get a flight home in the morning and I’m short on cash. Can you Venmo me 400 bucks? I swear I’ll pay you back the second I land. I just don’t want to bug mom and dad with this one. Send it to a different handle though. This guy is letting me use his account so I’ll text you the username in a sec. Appreciate it bro, I owe you.”

The right answer is at the bottom of the post!

These voice fakes become even more effective the longer the sample is that the AI can use to generate the deepfake. In this case, it took only 7 seconds of audio. Imagine what can be done with a longer sample, like an Instagram post, a video, a podcast, etc. Voice samples are everywhere now.

I used a voicemail greeting as my example because it’s extremely common and most people have one.

Why This Matters For All of Us

For years, the way we verified that “this is really my dad on the phone” came down to two things:

1. The voice sounds like him.

2. The number is his number.

Both of those pillars are broken now.

Voice cloning is trivial (you just heard the proof). Caller ID is also easily defeated. Phone numbers have been spoofable for a really long time. A bad actor can make your phone display your mother’s name and number while a stranger is on the other end of the line.

Even if you’ve trained yourself to do the right thing (hang up and call your loved one back at their real number), bad actors have a ready-made answer. “I was in a car accident, I don’t have my phone, I’m calling from a stranger’s phone.” It’s a perfect excuse. It explains why the number doesn’t match. It adds urgency. It pulls on the exact emotional response the scammer is trying to create.

So now we have a voice that sounds exactly like your loved one, a plausible reason they aren’t calling from their normal number, and an emergency that demands immediate action and money. These scams work really well, and any one of us is susceptible.

What You Can Do Right Now

I’ve written about family emergency scams before, and the playbook hasn’t changed. What HAS changed is how good the fakes are getting. The advice still holds.

1. Pause and Verify. Always. There is time. Even in a real emergency, there is time. Slow down, hang up, and verify through a different channel. Text the person directly. Call their normal number. Call another family member who would know.

2. Set up a family codeword. Pick a word that only your immediate family knows. It should be something not used in everyday conversation. If you ever get a call from a “family member” claiming an emergency, ask for the codeword. If they can’t say it, it isn’t them. (Bonus tip: agree on a “duress” codeword too, for the rare situation where someone is being forced to call.)

3. Delete your custom voicemail greeting. That cheerful “Hi, you’ve reached Tate, leave a message” recording is the perfect 7-second voice sample for a bad actor. Switch your voicemail back to the default robotic greeting. While you’re at it, lock down your social media so videos with your voice aren’t public.

4. Have the conversation with your family today, especially with parents and grandparents. The single most protective thing you can do is make sure everyone in your family knows this is possible. An informed family member has a much higher index of suspicion. That is the difference between “I sent the money” and “Wait, this doesn’t add up.”

5. Stay tuned for Rebound’s Trust Check product, which is designed specifically to help us verify the people we trust. It will be free, and it’s coming soon. If you want to be an early tester, you can sign up here.

The hard truth is that the old tools for verifying a loved one (their voice, their phone number) are no longer reliable. We need new ones. We are actively working on solutions that give families a way to verify each other in moments that matter, without relying on signals that bad actors can fake.

Sign up to be a Rebound Alpha Tester

The Reveal

Ready?

Sample 2 was Me.

The point isn’t if you were right or wrong, it’s to demonstrate how easy and how good these deepfakes are. And this was a very simple and crude example. Personalized scams like this are only going to become more widespread.

If you got it right, don’t get overconfident. Hopefully, you won’t experience this type of scam, but if you do, you won’t be able to compare the voice to anything but your memory. And again, these are only going to get better and better.

Have the conversation with your family this week. Pick a codeword. Delete your custom voicemail.

Subscribe now

Stay Safe,

Tate

If you haven’t tried it out yet, you should. It provides always-on protection against scams by notifying you of inbound scams in your browser, and it’s free!

Download Rebound AntiScam for Chrome

A video breakdown of the updated features (bonus: it comes with relaxing background music!):

You can now pause Rebound or turn it off for specific sites

These controls will feel familiar if you’ve used an ad blocker like uBlock Origin:

• Pause scanning for 15 minutes, 1 hour, 8 hours, or until you resume. A live countdown shows in the pop-up with a Resume button so you can flip it back on at any time.

• Disable on this site. A per-site toggle in the pop-up turns autoscanning off for that domain only. It stays off across browser restarts and Chrome updates until you turn it back on.

• Scan on demand. “Scan Current Page” works even when Rebound is paused or disabled for the site, useful for a one-off check without re-enabling everything.

• Clear “off” state on the toolbar icon so you always know whether Rebound is actively protecting the page.

Smarter detection, fewer false positives

We’ve taught Rebound to stop flagging sites that aren’t actually dangerous:

• New or unfamiliar websites. A site you’ve never heard of is no longer treated as suspicious by default. Rebound now looks at what the page is doing, not just whether the domain is obscure.

• Personal documents and notes. Pages in Google Docs, Google Keep, OneDrive, Notion, and similar tools no longer get flagged just because they contain unusual text.

• Email detail pages. Long, randomized URLs in Gmail (inbox, drafts, search results) are now correctly recognized as your own email, not as suspicious redirects.

• Corporate portals and SSO logins. Pages like Shareworks, Vanguard secure messages, banking portals, and other “looks weird but is legitimate” enterprise sites are no longer mistaken for phishing.

Subscribe now

Please try our Rebound AntiScam and give us feedback on how we’re doing! Feedback buttons are easy to find in the extension and on any alerts that pop up.

Download Rebound AntiScam for Chrome

Stay Safe!

Tate

Rebound Scam Assistant is live as an App inside ChatGPT. You can open it directly here, or read more about it at https://www.trustrebound.com/antiscam-for-chatgpt. If you use ChatGPT, you can now paste any suspicious text (a weird email, a sketchy DM, a pushy “your package is delayed” message) and get a real scam analysis in seconds, powered by the same detection engine that runs our AntiScam software.

Add Rebound to ChatGPT

What it does

Inside ChatGPT, you say something like:

“Hey @Rebound, can you check this text I just got? USPS: Your package is being held. Please pay a $2.99 redelivery fee at usps-redeliver-fee[.]com”

ChatGPT calls Rebound Scam Assistant, and we analyze the message and send back:

• Risk level: scam, suspicious, or not a scam

• Scam type: the category it fits (phishing, package delivery scam, impersonation, etc.)

• Red flags: the specific signs that made it suspicious

• What to do: concrete, plain-English next steps

If the message is a scam and you want to go further (get help reporting it, notifying your bank, etc.), we include a one-click link into our full Scam Assistant at trustrebound.com, pre-populated with the details of the scam you just analyzed. You don’t have to retype anything.

Why I built this

Helping people protect themselves from scams has been my obsession for over a decade, first investigating cybercrime as a Special Agent in the U.S. Secret Service, then building consumer-protection products at Google, and now running Rebound. Based on a decade of watching bad actors operate, I know that they are organized, funded, operating at scale, and getting better every day.

And the defense against all that? Your gut feeling, in a distracted moment, while you are walking out of the grocery store with a screaming kid and a text that says your account is locked. That is not a fair fight. That is why people are losing their savings every single day.

ChatGPT is now where millions of people go when they have a question they do not know the answer to. “Is this real?” is one of those questions.

If you connect Rebound to your ChatGPT (one-click, takes just a few seconds), every time you ask ChatGPT about a suspicious message, it routes the question to us and our specialized scam detection engine. You install it once, and from then on, it is just there, on duty, whether you remember it or not. The next time a weird text shows up, and you paste it into ChatGPT, Rebound is an “@rebound” away to help you.

It’s better than just asking ChatGPT because our detection engine is specifically trained to identify scams, and we provide guidance and an easy way to get a personalized action plan.

What it looks like

Rebound In the ChatGPT App Directory

How to connect Rebound to your ChatGPT

Click here to open Rebound Scam Assistant in the ChatGPT App directory, then click Connect. That is the whole setup. Takes about 10 seconds.

Add Rebound to ChatGPT

If you prefer to find it yourself rather than use the link above, open ChatGPT, go to Apps in the toolbar, search for Rebound, and click Connect.

Once connected, you use it like this:

1. Open ChatGPT (the App or chatgpt.com).

2. Type “@rebound”, and then paste the suspicious message. ChatGPT will automatically route the question to Rebound.

3. Read the analysis. If it is a scam, click the link in the response to jump into the Scam Assistant on our site for full recovery help.

It is free. No account required. The full privacy notice for the ChatGPT App lives at trustrebound.com/legal/chatgpt-app.

One note on the current version: it currently only handles text-based messages. File uploads (e.g., screenshots of text) are on the roadmap once the ChatGPT file-passing APIs are stable. If you have a screenshot, paste the message text, and we will work with that, or head over to Scam Assistant on our webpage.

What’s next

Wouldn’t it be great if you didn’t have to upload or copy and paste a suspected scam manually? If you are taking the time to check something manually, you are already 90% protecting yourself. It’s the scams that you don’t realize are scams until it’s too late that are dangerous.

That’s why we built Rebound AntiScam for Chrome, which is live and provides always-on background protection. We will soon be launching Desktop apps for Mac and Windows, as well as our mobile apps for iOS and Android. The goal is simple: wherever a bad actor can reach you, Rebound is there protecting you.

You can pre-order Rebound AntiScam at a deep discount by visiting our website or clicking the button below.

Pre-order Rebound AntiScam

Stay Safe!

Tate

Subscribe now

To a bad actor, your name and address are a great opportunity. It is the first key that unlocks almost everything else about you. And once they have everything else, they can build a scam that feels personal, local, and real.

And if a bad actor only has one of those two pieces, getting the other one is trivial. If they have your name, they can type it into any data broker site (Spokeo, BeenVerified, Whitepages, and dozens of others), and your home address will come back in about 5 seconds, usually for free. That doesn’t even include the additional information that scammers can find on the dark web.

If they have your address, it works the same way in reverse. Type the address in, and out pops the name of everyone who has lived there, usually along with their ages and relatives. These sites exist because scraping and selling public records is a legal business in the US.

Subscribe now

What a Bad Actor Can Do With Just Your Name and Address

Here is other data that is easy to find using just your name and address.

• Your phone number and email, pulled from data broker sites like Spokeo, BeenVerified, and Whitepages (these companies scrape public records and sell them for a few dollars).

• Your approximate age and date of birth, often listed right next to your name on the same data broker pages.

• The names of your relatives, including your spouse, your kids, and your aging parents.

• The value of your home, your mortgage lender, and when you bought the place, all from public county property records.

• Your political party, from voter registration records (which are public in most states).

• Photos of the front of your house, from Google Street View.

• Where you work, from LinkedIn (which is usually the first result when someone searches your name).

• Your social media profiles, where you’ve probably posted about your last vacation, your pets, and your kids’ names.

How They Turn That Into a Scam

Many scams use impersonation to fool people. A bad actor pretends to be someone you’d normally trust (your bank, your utility company, the IRS, a delivery service, a family member, even a local police officer) and uses that trust to pressure you into paying, clicking, or sharing information.

Impersonation is far more effective when the story feels real. Another way to say that the scammer uses real information to make you trust that what is happening is real. And the story feels more real if the details check out. This is where your name and address become fuel. The more a bad actor already knows about you before they make contact, the more convincing the impersonation gets. A call from “your bank” that references your actual street, your actual lender, and your spouse’s first name is a lot harder to hang up on.

What one of these scams sounds like

Here is an example of an AI-generated impersonation voice scam that uses my name and address to build believability, combining it with urgency and fear to get me to call a phone number (where the scam will commence). This was created in seconds for less than a penny.

Here are some other examples.

The fake property tax notice. You get a letter in the mail (or an email, or a text) that says you owe back taxes on your home. It uses your real name, your real address, your real county, and even the correct estimated value of your house. It requires payment by gift card or wire transfer. It looks completely legitimate because every detail checks out.

The family emergency scam. Your mom gets a phone call. The voice on the other end says, “Mom, it’s me, I’m in trouble.” It uses your name. It mentions your spouse by name. It says you were in an accident near your actual neighborhood. Your mom panics and wires money. The bad actor never met you. They just looked you up.

The fake utility shutoff. You get a call claiming to be from your local power company. They know your address. They know which utility serves that address (also public). They threaten to shut off your power in one hour unless you pay immediately with a prepaid card.

The “your package is delayed” text. They know you live at that address. They know you almost certainly order things online. So they send a text with a fake tracking link that steals your login credentials when you click it.

The pattern is always the same. Public information makes the scam feel personal. Personal makes it feel real. Real makes you act before you think.

What You Can Do

You can’t pull your name and address completely off the Internet. So the real question isn’t “how do I become invisible?” It’s “how do I protect myself when a bad actor inevitably uses what they already know about me?”

This is why we’ve built, and are building, tools that help people detect these scams, even when they seem real.

1. Use Rebound AntiScam. This is exactly what we built it for. Our free Chrome extension scans the actual content of the messages, emails, and web pages you see, not just the URLs. That matters because impersonation scams almost always live inside content. A convincing email from “your bank,” a Facebook Messenger note from “your cousin,” a LinkedIn DM from a “recruiter” at a real company, a text about a “delayed package.” Content analysis catches them.

If a message is trying to impersonate someone and pressure you, Rebound AntiScam will flag it before you act. You can learn more about it here, and if you’re ever unsure about a message the extension didn’t catch, paste it into our free Scam Assistant for a second opinion.

Download Rebound AntiScam for Chrome

2. Pause and Verify. If anyone contacts you out of the blue (a call, a text, an email, a letter, a DM) with an urgent demand, just take a pause. Do not click. Do not call the number they gave you. Do not reply. Instead, look up the real number for that company yourself and call them directly.

If it’s a “family emergency,” hang up and call your family member on the number you already have for them.

Bad actors win when you act fast. Slow them down, and you’ll win.

Subscribe now

Stay Safe!

Tate

We built the Rebound Scam Assistant not only to answer the question “Is this a scam?” but also to help users understand how to report it to authorities and how to maximize their chances of getting their money back.

The Scam Assistant goes one step further than all other tools I’ve seen. It helps you consolidate and collect all the data related to your incident in one place. You enter it once, and it will generate a Personalized Action Plan with a downloadable report that includes everything.

It’s free. It’s instant. And you don’t need to create an account to use it. Just go to trustrebound.com/scam_assistant and try it out.

Use Scam Assistant

Why We Built This

When people realize something might be a scam, they often don’t know where to turn. They Google it. They ask a friend. They stare at the message and try to figure it out on their own.

We wanted to build something better. Something that gives you an expert-level answer in seconds, not hours. The Scam Assistant is the answer to that problem.

It’s really hard for all of us to identify scams. It’s really hard to know what to do if you click on something you shouldn’t have, shared something you shouldn’t have, or sent money somewhere you shouldn’t have. Scam Assistant is here to help.

How It Works

The Scam Assistant is an AI-powered tool that analyzes anything suspicious you throw at it and tells you whether it’s a scam, what the red flags are, and exactly what to do next.

There are four ways to submit something for analysis:

1. Paste or type it in. Got a weird text message? A suspicious email? Just copy and paste the text directly into the Scam Assistant. You can also just type a description of what happened. “Someone called me claiming to be from the IRS and said I owe back taxes.” That works too.

2. Upload a screenshot. See something suspicious on Facebook? A too-good-to-be-true Instagram ad? A strange WhatsApp message? Take a screenshot and drag it right into the Scam Assistant. It reads the image and analyzes the content.

3. Upload a PDF. Got a suspicious invoice? A fake contract? An “official” letter that doesn’t look quite right? You can upload the PDF directly, and the AI will analyze it.

4. You can also use voice dictation if you’re on Chrome or Safari. Just click the microphone and describe what happened. This is helpful for those on a mobile device.

What Happens After You Submit

Once you submit something, the Scam Assistant runs through a three-step process. You’ll see a progress indicator so you know exactly where things stand.

Step 1: Analysis. Our detection engine examines everything you submit. It’s looking at language patterns, urgency tactics, impersonation signals, suspicious requests, and hundreds of other indicators that bad actors use to trick people.

Step 2: Risk Assessment. You get a clear verdict. Is this a scam? Is it suspicious? Is it safe? The Scam Assistant tells you what it found and explains WHY it flagged it. It breaks down the specific red flags so you understand what to look for next time.

Step 3: Your Personalized Action Plan. This is where the Scam Assistant really separates itself from everything else out there. Most tools stop at “yep, that’s a scam” and leave you hanging.

The Scam Assistant goes one step further than all other tools I’ve seen. It helps you consolidate and collect all the data related to your incident in one place. You enter it once, and it will generate a Personalized Action Plan with a downloadable report that includes everything: the summary, screenshots, other attachments, and all the details you put in. This is an important record for you to keep and is useful when reporting to various agencies or organizations.

Using this information, the Scam Assistant builds a personalized action plan tailored to YOUR specific situation. It builds a plan tailored to exactly what happened to you, what information you may have shared, and what you need to do RIGHT NOW to protect yourself.

Here’s what that looks like in practice. Let’s say you got a phishing email, clicked the link, and entered your email and password before realizing something was wrong. Your action plan won’t just say “change your password.” It will walk you through securing every account that uses that same email, enabling MFA (Multi-Factor Authentication) on your most important accounts, checking for unauthorized logins, reporting to the right agencies for your specific type of incident, and protecting yourself against the follow-up attacks that bad actors almost always send after a successful phish.

The plan also includes platform-specific reporting guides. If you got scammed on PayPal, your plan tells you exactly how to dispute on PayPal. Got hit through Zelle or CashApp? Different process, different steps. The Scam Assistant knows the difference and gives you the right instructions for Amazon, Apple, Google, Facebook, Venmo, CashApp, Zelle, eBay, your bank, and crypto exchanges.

Your Personalized Report (Download It, Keep It, Use It)

Everything the Scam Assistant produces for you, the analysis, the red flags, the risk assessment, and your personalized action plan gets consolidated into one report.

This is really helpful. If you’ve ever been scammed (or helped a parent or family member who was), you know the recovery process is chaos. You’re Googling “how to report fraud,” calling your bank, trying to remember what you clicked, what information you shared, and who you need to contact. It’s overwhelming, and most people give up before they finish.

The Scam Assistant puts it all in one place. One report. Everything organized. Everything is personalized to what happened to you.

You can download this report and use it when you:

File a police report. Having your incident organized with details, timelines, and evidence makes a massive difference. And it’s a lot easier when you already have it in one place.

Dispute with your bank. Banks want specifics. Your report gives you exactly what they need to process a fraud claim.

Report to the FTC or IC3. The report walks you through which agencies apply to your situation and what information they need from you.

Help a family member. If you’re the one helping your mom or dad navigate a scam, the report gives you everything in one document so you’re not piecing it together from memory.

What Makes This Different

It analyzes content, not just URLs. Most scam checkers are URL blocklists. They compare a web address against a database of known bad sites. The problem? Scammers change URLs constantly. And the most dangerous scams today happen INSIDE trusted platforms. A scam message on Facebook Messenger, a phishing link in a LinkedIn DM, a fake invoice in your Gmail. URL blocklists can’t catch those. The Scam Assistant reads and analyzes the actual content.

It gives you a real action plan. Other tools tell you “this is suspicious” and stop there. That’s not helpful when you’re panicking because you just gave someone your bank login. The Scam Assistant walks you through exactly what to do based on YOUR specific situation.

It collects incident data. If you want, the Scam Assistant will walk you through a quick incident form after the analysis. This data helps us (and helps you) build a record of what happened. If you need to file a police report or a bank dispute, having organized incident data makes a huge difference.

Want Always-On Protection?

The Scam Assistant is great for checking something suspicious on the fly. But what if a scam reaches you and you don’t even realize it’s a scam?

That’s what Rebound AntiScam for Chrome is for. It’s our free browser extension that runs in the background and automatically scans the pages you visit. If it detects a scam, you get an alert before you can interact with it.

But here’s what makes it different from other browser security tools. Rebound AntiScam doesn’t just check URLs against a blocklist. It analyzes the actual page content. This means it catches scams delivered inside Facebook Messenger, WhatsApp Web, LinkedIn DMs, Telegram, and Gmail that other tools completely miss.

It’s free to install and use. Learn more at Rebound AntiScam for Chrome.

Download Rebound Browser Extension

Share This With Someone Who Needs It

If you know someone who could use this tool, please send them this post or share the link directly: trustrebound.com/scam_assistant.

This tool is free. It doesn’t require a download. It doesn’t require an account. It works on any device with a browser. They just go to the page, paste in whatever looks suspicious, and get an answer.

We built the Scam Assistant because we believe that everyone deserves access to expert-level scam protection, not just people who happen to know a cybersecurity professional. So please, share it, bookmark it, text the link to your family group chat. Send it to that person you’re always worrying about.

Try It Right Now

Use Scam Assistant

And remember: Pause and Verify. If something feels off, it probably is. The Scam Assistant is here to confirm your instincts and tell you what to do about it.

Stay Safe!

Tate

Subscribe now

By the time you realize something is wrong, you’ve already clicked, already entered your information, or already sent money. And unfortunately, in most cases, it is really difficult to get your money back. Data from GASA shows us that 78% of scam victims are unable to recover any funds.

That’s why we built Rebound AntiScam for Chrome. It’s a free browser extension that works silently in the background, scanning the websites you visit and alerting you before you get burned.

I’m excited to share that it’s now available for anyone to download from the Chrome Web Store.

Download Rebound AntiScam for Chrome

What It Does

Rebound AntiScam is like having a scam expert looking over your shoulder while you browse. It watches for tactics that bad actors use, including phishing pages, fake investment schemes, tech support scams, romance and impersonation fraud, gift card scams, and high-pressure urgency tactics designed to make you act before you think, among others!

The extension has two modes:

Autoscan runs quietly in the background. Every few seconds, Rebound scans the website and looks for indicators of scams. You don’t have to do anything. If a threat is detected, you’ll get an alert with a clear explanation of what’s wrong and a recommendation for what to do.

Manual Scan lets you scan any page on demand. If something feels off about a website, hit the scan button and let Rebound take a look.

When Rebound detects a scam, you’ll see a persistent alert (it won’t disappear after a few seconds like a typical browser notification). The alert tells you exactly what type of scam it is, what the red flags are, and gives you clear recommendations. You can click “Back to Safety” to navigate away, or choose to continue if you believe the alert is a false positive. If you think we got it wrong, please leave us feedback so we can get better!

Download Rebound AntiScam for Chrome

How It Works (And Why This Is Different)

Most security tools work by checking URLs against lists of known malicious websites or by examining attachments and links for malware. If the URL is on the list, you get a warning. If it’s not on the list, you don’t. That sounds reasonable, but it has a massive blind spot: it doesn’t work well for scams.

Bad actors constantly spin up new domains. A phishing page that went live an hour ago won’t be on any blocklist yet. And what about scam messages that show up inside platforms you’re already using? A romance scam in your Facebook Messenger. A fake job offer in your LinkedIn DMs. A “tech support” message in WhatsApp Web. An investment scam on Telegram. None of those will ever trigger these other tools because the URL is facebook.com or linkedin.com, both legitimate sites.

Rebound doesn’t scan URLs. Rebound reads the actual content on the page.

When you visit a page, the extension reads the visible text (including text that bad actors try to hide using tricks in the website’s code). It sends that text to our detection engine, which uses AI to analyze the content as a trained fraud investigator would. It looks for manipulation tactics, false urgency, impersonation signals, and deceptive patterns that are common across different types of scams.

This means Rebound catches scams that no blocklist-based tool can catch. A scam message that shows up inside your Gmail inbox, a fake crypto investment pitch on a social media platform, a tech support scam in a web chat window. Rebound reads what’s on the screen and evaluates whether the content itself is trying to deceive you.

The analysis is almost instantaneous. If a threat is detected, you get an immediate alert. If the page is safe, Rebound stays quiet, and you keep browsing without interruption.

You can view your scan history anytime inside the extension. It’s organized into tabs (Scam, Safe, All) so you can review what Rebound has found.

Your Privacy

I’ve spent over 15 years working in cybersecurity, and before that, I investigated cybercrimes as a Special Agent in the Secret Service. I’m also a deep advocate for individual privacy and security, and have been publishing a Substack on that topic for over 3 years. I deeply understand that respecting your privacy is critical for any product, and especially a security product. This is why we have built Rebound AntiScam with privacy at the core.

You Control What’s Shared

You are in complete control of what data is shared with Rebound. We give you three options:

“Threats Only” (Default): When Rebound flags something as a scam, that alert data is shared with us so we can improve our detection engine. Your normal browsing activity is never shared. This is the default because it helps us get better at catching scams while keeping your regular browsing private.

“All”: This shows scan results for all pages, including those that aren’t scams. This is the most helpful option for improving our detection, because understanding what a “safe” page looks like helps us reduce false alarms. Your data is used only to help us improve the product, and we never sell it.

“Off”: Nothing is shared with Rebound. The extension still works and still protects you. Your scan history is stored locally on your device and never leaves your browser.

You can change your sharing preference at any time in the extension settings. Anything shared with Rebound is marked with a cloud icon in your scan history, so you always know exactly what we can see (and you can delete it at any time).

You Can Delete Your Scan History At Any Time

Your scan history is stored locally on your device. You own it. You can open your scan history inside the extension and delete individual records, or delete everything in bulk. It’s your data, and you should be able to remove it whenever you want. No hoops to jump through, no “submit a request and wait 30 days.” Just delete it. You have total control.

Zero Data Retention (ZDR) Processing

When Rebound scans a page, the content is sent to our AI detection engine for analysis. But here’s an important detail: we use Zero Data Retention (ZDR) processing. This means the content of your pages is processed and then immediately discarded. It is not stored, logged, or used for any purpose beyond providing you with the result of that scan.

Our detection engine runs on Google Cloud’s Vertex AI, which supports Zero Data Retention at the infrastructure level. In other words, even the AI infrastructure we use is designed to forget your data as soon as it’s done analyzing it.

The Rest of It

• Rebound does not track your browsing activity.

• We do not sell your data. Period.

We are a Public Benefit Corporation with consumer protection built into our legal charter. Protecting your data isn’t just a feature for us. It’s the law that governs our company.

A Note on Why Sharing Helps

If you’re comfortable turning your sharing setting to “All,” it makes a real difference for us. We’re a small team building something that’s never been built before. Every scan you share, whether it’s a scam or a safe page, helps our detection engine learn. The more data we can train on, the better we get at protecting everyone.

If you realize you shared something you didn’t want to, you can just go to scan history and delete the record.

If you’re comfortable, turn it to “All.” If you’re not, “Threats Only” or “Off” is available to you, and you’re fully protected no matter what.

Every person who contributes data is helping us build something that protects the next person.

How to Get It

Getting started takes about 30 seconds:

1. Go to the Chrome Web Store and search for “Rebound AntiScam”, or click the link below.

   Download Rebound AntiScam for Chrome

2. Click “Add to Chrome.” The extension works with Google Chrome and Chromium-based browsers like Brave.

3. Create an account and log in with just one click.

4. Turn on Autoscan in the extension settings, and you’re protected.

That’s it. Rebound runs in the background from there, protecting you.

We’re Just Getting Started

This is our first publicly available product, and we’re building it with feedback from real users. If you try the extension and something doesn’t work as expected, or you get an alert about something that clearly isn’t a scam, use the Feedback button inside the extension and the thumbs up/thumbs down on alerts. That feedback goes directly to our team and makes the product better for everyone.

Scam Assistant

If you have a suspicious message, email, or screenshot you want analyzed, check out our Scam Assistant. It’s a free tool (no account needed) where you can paste any suspicious content and get an instant AI analysis that tells you whether it’s a scam and what to do next.

This tool is also a great resource to help you figure out what to do if you think you might have been scammed.

We built Rebound because we believe everyone deserves real protection from scams, not just security theater. Our moms and dads, our friends and family, shouldn’t have to be cybersecurity experts to stay safe online.

If you want to get a deep discount on our paid products when they launch, you can sign up now on our website. You’ll keep that discount forever as a reward for being an early adopter.

Lock in Early Access Pricing

Stay Safe!

Tate

Cofounder and CEO, Rebound

Subscribe now

I then worked at Google for 5 years, where I built products in the consumer protection space, learned about abuse, fraud, and scams in the private sector, and enhanced my knowledge.

I can summarize what I’ve learned in over 15 years working on this problem in one sentence.

Americans reported over $12.5 billion in losses to online scams in 2024, according to the FTC. Globally, the number is closer to $442 billion. And 78% of scam victims never recover their money, despite their best efforts.

Here’s what happens when someone gets scammed. They call their bank. The bank says it was an “authorized transaction” because you sent the money yourself. They call the local police. The officer takes a report and is sympathetic, but the department doesn’t have the resources or jurisdiction to investigate online fraud. Nothing happens. They try to file with the FBI, but unless you lost millions, you aren’t a priority. The FBI’s Internet Crime Complaint Center receives hundreds of thousands of reports a year, and your case ends up in a pile that nobody comes back to. If you’re lucky, it might be rolled up into a bigger investigation that takes years. They try to report it to Google, Facebook, or whatever platform the scammer used to reach them. This is less useful than the government or the banks. It’s difficult to find someone who will help you.

So the victim is left alone, out of the money, with no one to call and no clear next step. Plus, if you withdrew money from a retirement account as part of the scam, you’ll get taxed by the government for it. That’s the reality for millions of people every year. This doesn’t even account for the human impact, the emotional impact that victims endure, which is very real.

Our website: trustrebound.com

Prevention matters

This is why prevention is so important. Dealing with the impacts of a scam as a victim is hard in so many ways. It’s hard to get money back, it’s hard to get help, and it’s hard emotionally. Prevention is much better than recovery. If we can prevent people from getting scammed, they won’t become victims and won’t have to deal with the painful things victims must.

Protection exists. It just doesn’t exist for regular people.

Big companies have entire security operations centers. They have fraud teams. They have cyber insurance policies that actually pay out. Wealthy individuals have private advisors and wealth managers who catch suspicious activity before it becomes a problem. The tools and the expertise are out there.

But if you’re a normal person? A retiree living on a fixed income? A busy parent who doesn’t have time to research every text message? You get nothing. There are few tools designed to protect everyday people from scams. Antivirus catches malware. Identity theft services monitor your credit. But when a scammer sends your dad a fake text from “his bank” or your mom a romance scam on Facebook, they are on their own.

The millions of people who need protection the most have the least help. Unprotected from the increasing amount of scams, which are getting more sophisticated because scammers are using AI to help them.

Billions of dollars in venture capital and cybersecurity investment have poured into protecting businesses. Enterprise security. Executive protection. Corporate fraud detection. B2B solutions for companies that can afford six-figure contracts. That’s where the money went, and that’s where the talent followed. Consumers were an afterthought. Normal people were left to fend for themselves.

Why we built Rebound

That’s why my co-founder, Dan Nelms, and I started Rebound. We wanted to bring our expertise and passion to help people solve a problem that isn’t being solved in the market right now. We didn’t want to build another enterprise security product. We don’t want to help protect Fortune 500 companies. We don’t want to only sell to high-net-worth individuals or executives.

We started Rebound to protect the people in our lives. Our moms and dads. Our friends. Our families. The people who don’t have a security operations center watching their back.

We’re a mission-driven company; in fact, we are a Public Benefit Corporation, which means we are required to pursue a public benefit (more about PBCs here). Our public benefit is proudly displayed on our website: “to mitigate cyber harm and its impact for individuals and society.”

We wake up every day thinking about how to keep people like us, our friends, our family, and you safe from the scams that are getting smarter, more targeted, and more personal every month.

What we are building

Rebound is AI-powered scam protection built for consumers. We’re building tools that do two things:

Prevent scams before they happen. Our AI analyzes suspicious content in real time, whether it’s a sketchy DM, a phishing email, or a fraudulent website. We flag the danger before you click, send, or pay. Because prevention is the best way to stop scammers in their tracks.

Help you recover when prevention isn’t enough. Because no system catches everything. When someone does fall victim, we help you navigate the experience and recover.

Try Rebound Antiscam for Chrome

Rebound AntiScam for Chrome is our browser extension that scans websites in real time as you browse. It flags scams that appear in your browser, such as a scam webpage, an email, or a DM on a social media site. It’s free to use, and you can download it here.

Download Rebound AntiScam for Chrome

Try Scam Assistant

Our first tool is live right now. It’s called Scam Assistant, and it’s free.

Here’s how it works: you paste in a suspicious message, upload a screenshot, or describe a situation. Our AI analyzes it and tells you whether it’s a scam, what the red flags are, and exactly what to do next.

But here’s what makes it different from anything else out there. If you are dealing with a scam, Scam Assistant doesn’t just tell you “be careful” and leave you on your own. It helps you collect all the important details in one place: who contacted you, what they said, how money moved, and what accounts were involved.

Then it builds a personalized action plan based on your specific situation. Not a generic checklist. A plan tailored to what happened to you, with the steps in priority order. And you can save everything to your account, so you don’t lose it.

Most people who get scammed don’t know where to start. Scam Assistant gives them a starting point and a path forward.

Try Scam Assistant Now

Try our Scam Wiki

Scam Wiki is a growing library of scam information, updated with real data from our detection systems. Think of it as a field guide to the threats that are actually circulating right now.

Check out Scam Wiki

What’s next

We are moving quickly to launch our AntiScam software on all your devices so you can have 24/7 protection. You can sign up for early pricing here if you like.

Rebound for desktop and mobile. We’re building software that protects you across your computer and phone, not just your browser. It’s like antivirus software, but for scams, which is why we call it Rebound AntiScam. Always-on scam detection on all your devices.

Family Watchtower. A monitoring dashboard that lets you keep an eye on the people you care about. If someone in your family or extended family (maybe mom or dad) encounters a scam, you’ll see it in the family watchtower, so you can have early warning. Remember, prevention is always better than recovery.

Why Substack

We are using Substack because it allows us to interact with our users easily. You can ask questions and engage with us on our Substack Chat. If you subscribe and follow us (always free!), you will get updates on the company and the products we are launching, as well as helpful tips to protect yourself and your family from online scams and other scam-related information.

Subscribe now

Thanks and Stay Safe!

Tate

Tate Jarrow is the Co-Founder and CEO of Rebound. He previously served as a Special Agent with the U.S. Secret Service and was a product leader at Google. He’s a West Point graduate, U.S. Army Ranger with 2 combat deployments to Afghanistan, and has an MBA from Cornell University.

Dan Nelms is the Co-Founder and COO of Rebound. He spent 13 years leading teams at Google Trust & Safety, responsible for the large-scale detection of abuse and the protection of billions of users. He is currently wrapping up a Master’s at Stanford Graduate School of Business.