Blazenumenhir/scam-story-checker

Alibi (repository name scam-story-checker) is a Windows desktop app for checking whether a seller, recruiter, landlord or shop's story matches public records before you send money or sign anything. You choose the kind of person, enter a nickname, email, phone number or link, and optionally paste what they told you; the app returns one verdict, a few reasons, and the exhibits behind each reason. It is aimed at one-off due diligence on people you are about to deal with, not at screening tenants or job applicants.

What it does and how it works

Alibi reads public profile pages and public APIs across more than 3,400 sites listed in sources/sites.toml, plus domain registration via RDAP/WHOIS, certificates via crt.sh with CertSpotter as fallback, mail setup via DNS over HTTPS, Gravatar avatars, and Have I Been Pwned for breaches. Results are grouped into a three-level verdict — holds up, doesn't add up, or red flags — and each reason links to the exhibits it came from; the README says a reason with no exhibit is never shown.

Two features carry the evidence trail. First, every find is saved when it is seen: a local page snapshot, an optional Wayback Machine copy, a UTC timestamp and a SHA-256 hash, so a deleted page stays provable. Second, Follow the lead chains discoveries automatically — a profile photo appearing on other accounts, a phone number on other listings, a shop domain registered recently — with a stated reason for each step and a user-set depth of 1 to 3 steps. A timeline puts all found dates on one line, and a one-click PDF combines the verdict, reasons, exhibits, hashes and case log for a bank, marketplace or police report.

Requirements and installation

The documented download is a portable Windows 10/11 ZIP from the latest release; there is no installer, no admin rights and no account. The README notes that Main.exe is code-signed and that the alibi component must be kept beside it. Building from source instead requires Rust 1.85 or newer and the Tauri prerequisites for your system. No paid API keys are required; an optional Have I Been Pwned key enables email breach search.

AI is optional: checks, verdicts, proof, leads and the timeline work without it, and summaries can run locally through Ollama or be switched off entirely. Nothing leaves the PC unless an online model is selected.

Privacy and use limits

The README states the app reads only public information, opens pages like a browser, does not notify the checked person, and does not log in anywhere, look up home addresses, face-match photos, show live location or probe password-reset pages. Because Wayback Machine copies are public on archive.org, cases can be kept local-only by disabling them in Settings.

The author sets explicit legal boundaries: it is not a consumer reporting agency, and must not be used to screen tenants or job applicants or for credit, insurance or hiring decisions (US FCRA); checking a landlord or recruiter before dealing with them is described as fine. Someone checking on a client's behalf is the data controller under GDPR and needs a legitimate-interest reason. Verdicts are summaries of the public trail, not judgments about a person — the README advises opening each exhibit and deciding yourself. Nothing in the supplied material reports independent accuracy testing, so the 30-second and 3,400+ source figures are author descriptions, not verified benchmarks.

License

MIT licensed. The bundled fonts are under the SIL Open Font License 1.1, and the project states it is not affiliated with the sites it checks.

Project source and documentation