Docs

Static JSON over HTTPS. No key, no limit, CORS open. Text fields are objects keyed by language, like {"es": "…"}.

Quickstart

curl https://scamdb.dev/v1/ar/scams.json

const res = await fetch('https://scamdb.dev/v1/ar/scams.json');
const { data, version } = await res.json();
console.log(data.length, 'scams, dataset', version);

Endpoints

GET	What
`/v1/index.json`	Dataset version, build date, countries, counts
`/v1/countries.json`	Countries and their languages
`/v1/signals.json`	The warning-sign vocabulary
`/v1/{country}/scams.json`	Every entry for a country
`/v1/{country}/contacts.json`	Who to report to in that country
`/v1/scams/{country}/{slug}.json`	One entry
`/v1/scams.json`	Every entry, all countries
`/v1/scamdb.zip`	The full dataset as a download
`/v1/changes.json`	Recent additions and edits, newest first

The response

Every JSON file is wrapped in the same envelope. version is the date and commit of the dataset; it changes on every edit.

{
  "license": "CC BY 4.0",
  "attribution": "scamdb.dev · CC BY 4.0",
  "version": "2026-11-15.6009b03",
  "data": {
    "id": "ar/whatsapp-codigo",
    "country": "ar",
    "name": {
      "es": "Robo de WhatsApp con el código de 6 números"
    },
    "signals": [
      "impersonation",
      "asks_for_code",
      "urgency",
      "money_request"
    ],
    "…": "…"
  }
}

An entry

Field	What
`id`	<country>/<slug>
`country`	ISO 3166-1 alpha-2, lowercase
`status`	active · fading · archived
`channels`	whatsapp · sms · phone · online · in-person · email · social
`sender`	who the message claims to be
`name`	short recognisable name
`how`	how it works, 3–4 sentences
`steps[]`	{ text, signal? }: the script, step by step
`examples[]`	{ text, channel? }: invented sample messages
`phrases`	everyday phrases people use to describe it (≥ 5 per language)
`signals[]`	ids from /v1/signals.json
`redFlags`	warning signs in plain words
`whatToDo`	what to do, in plain words
`reportTo[]`	contact ids from /v1/{country}/contacts.json
`sources[]`	{ title, publisher, url, date }
`media[]`	{ type, url, title, publisher, date }: links, never copies (optional)
`story`	a real anonymous case (optional)
`related[]`	ids of related scams (optional)
`firstSeen`	YYYY-MM (optional)
`updated`	YYYY-MM-DD

JSON Schemas are in the repo under schema/.

License and attribution

The data is CC BY 4.0: use it for anything, including commercially, as long as you credit scamdb.dev · CC BY 4.0 and link to the license. Sources and media linked from entries belong to their owners.

Limits and privacy

Static endpoints have no key and no limit. They are cached for 5 minutes. We keep no logs of who reads the data beyond what our host keeps to serve it.

Coming next

Private reports: tell us about a scam you received.
Free API keys.
POST /v1/isitascam: send a message, screenshot or voice note and get a verdict, the warning signs and the matching scam.