What NextAct cannot do

It can miss a real fraud, and it can raise concerns about something entirely legitimate. Both happen. Neither is rare enough to ignore.

A missed fraud is the more costly error, so the system is built to say "I could not verify this" rather than to guess reassuringly. That means you will sometimes get an inconclusive result on a message that turns out to be fine.

NextAct tries to identify what a message is asking you to do from its wording. Unusual phrasing, slang, a request split across several messages, or one made only in a phone call can be missed.

When NextAct finds no request, that is not a sign that none was made. If you know you are being asked to pay, share a code or install something, treat it as that request whatever the result says.

Documents and messages sometimes contain text designed to manipulate automated checkers — instructions telling the system to report the content as legitimate.

No language model is connected in this version. Where you see an AI explanation marked as simulated, it was produced by a test stand-in, not a model.

NextAct is built so that this cannot lower a risk assessment. The assessment comes from rules. When an automated reading is switched on, what it proposes must quote the exact text it relies on, can only make the result more cautious and only by a limited amount, and anything it says about a risk level is thrown away. Where we detect such an attempt, we say so. It tells you what the text contains, not on its own who sent it or why.

NextAct checks the public phishunt feed, which reports automated suspicion and can be wrong. A fresh medium, high or critical listing can justify elevated caution; it is not confirmation of fraud. Optional PhishTank community-verified coverage requires a configured credential. A stale feed or failed download produces no reputation verdict.

We compare up to 20 distinct supported extracted links, by exact address, against a fresh downloaded snapshot without sending your links to the feed operator. Links beyond that budget are not covered. A match concerns that exact address, not an entire domain. No match never establishes safety. Links missed during extraction and unlisted scams may be missed; structural and domain Deep Checks still concern the primary link.

NextAct examines a link’s structure, its domain registration, its DNS records and its certificate. It does not load the page.

That is a deliberate security decision, and it has a cost: we cannot tell you where a shortened link finally lands, and we cannot compare a page’s appearance to the brand it claims. A link that survives our checks may still lead somewhere hostile.

Criminals register domains days before using them, which makes domain age a genuinely useful signal. But real businesses also launch, rebrand and move.

NextAct treats registration age as one input among several, never as a verdict on its own. If a result rests mostly on domain age, the assessment will say so.

Certificates are free and automatic. A phishing page has the same padlock your bank does. It proves the connection is encrypted, not that the operator is who they claim.

If you have ever been told to "check for the padlock", that advice is out of date.

SPF, DKIM and DMARC tell you a message really came from the domain it claims. They tell you nothing about whether the sender is trustworthy.

A criminal who registers their own domain passes all three. So does a legitimate company whose account has been taken over.

Confirming that a company exists, that its website is genuine, or that its phone number is real tells you nothing about whether the message in front of you came from them.

This is why our recommendations always route you through a channel you already trust, never through a contact detail contained in the suspicious message itself.

NextAct picks out the names, addresses, phone numbers and account details a message contains. That tells you what the message says — not who sent it.

A sender name NextAct does not recognise is shown as “named in the message, not checked”, and it never lowers an assessment.

The checks are written for English. When most of a message is in another script or in Roman Urdu, the result says it is incomplete rather than assessing words it cannot read.

That test is itself a rule of thumb: a short message, or a few lines in another language inside a long English thread, can pass unnoticed. Other romanised languages are not recognised at all.

Text recognition is switched on for this service. It reads English (Latin-script) text, and it can misread low-quality images, unusual fonts and handwriting; one wrong character can change an address or an account number. Urdu or Arabic writing in a picture is not read.

NextAct shows what it read so you can compare it with the image, and treats a difference found in a low-confidence reading as unconfirmed. Pasting the message as text is still the most reliable way to have the wording checked.

Holding a payment change keeps it waiting inside NextAct until your team confirms it. NextAct is not connected to any bank: it cannot stop, recall or reverse a payment.

Your own payment controls still decide what is paid. A change your team confirms in NextAct is only as sound as the route used to confirm it.

NextAct does not yet run scheduled backups of its database. If the database were lost, saved checks and Business records could not be restored from a NextAct backup.

The database provider may keep its own copies; NextAct has not verified how long. When scheduled backups begin, this page and the privacy notice will say so — and how long backups are kept.

The strongest statement NextAct makes is that no material risk was observed and that specific facts were independently verified. That is not the same as safe, and we will never word it as though it were.

Absence of evidence of fraud is not evidence of legitimacy. A brand-new scam has no history anywhere.

You will not find a percentage anywhere on this site. Publishing one would require a labelled test set that fairly represents the messages real people receive, and an honest account of what that set contains.

Until that exists and can be published alongside the number, any figure we quoted would be marketing rather than measurement.