Corrections Policy

• Anything that could cause harm is fixed first and fast. A wrong reporting route, an expired deadline, or a claim that would send someone to the wrong authority gets corrected as soon as we confirm it, ahead of anything else we are doing.
• We correct the claim everywhere it appears — not only the sentence you found. A single fact on this site can also live in a page summary, a structured-data block, a downloadable dataset and a related article. A correction is not finished until every one of those agrees.
• We change the date when we change the substance. Pages carry a review or updated date, and it moves when the content genuinely moves — never to look fresher than it is.
• If a correction changes the meaning, we say so on the page rather than editing quietly. A reader who acted on the old version deserves to know it changed.

21 October 2026: fourteen entries in our Impersonation Index said more than their source does.

We re-read all 28 entries in our Impersonation Index against each organisation’s own page. Fourteen were wrong or overstated and are now corrected to the current wording:

• IRS. We quoted “A letter or notice is the first way the IRS will contact a taxpayer.” That sentence is not on the IRS pages we cited. The IRS says “We never email without your permission” and “We don’t send text messages without your permission.” The same quote appeared on our US scam-text checker and is corrected there too.
• HMRC. We said HMRC never texts a link. HMRC says it does text some customers, and a genuine text may link to GOV.UK information or HMRC webchat.
• Coinbase. We said Coinbase has no access to your password, recovery phrase or keys and cannot move money for you. Its page says no such thing. It says it will never ask for your password or 2FA codes, or tell you to move funds to a new address or wallet.
• FedEx. We said FedEx never makes unsolicited requests for payment. FedEx says it may email or text a secure link to pay duties and taxes on an international package.
• DHL. We said genuine DHL mail comes only from @dhl.com or @dpdhl.com, never from Gmail or Yahoo, and that DHL never charges job applicants. None of that is on DHL’s page. DHL says customs duties and taxes are the only payments it requests by email or SMS.
• UPS. We listed three UPS text short codes and a fraud reporting address. Neither appears on UPS’s page, and both are removed.
• Meta. We said genuine mail comes only from @facebook.com, @fb.com or @meta.com. Facebook lists seven domains, including facebookmail.com and instagram.com.
• Google, Microsoft and PayPal. Our wording was broader than what each company says, and the pages we linked no longer carried it. Each entry now quotes the company’s own page.
• Zelle, Venmo & Cash App, Interac and the Austrian tax and customs entry. We removed claims their sources do not make: that Zelle won’t text you about a reversal, that payment-app support never messages first, a sentence about Interac Request Money, and claims about German authorities and Austrian Post that rested on a consumer watchdog’s homepage. Venmo, Cash App and the Austrian entry now cite the organisations’ own pages.

Four more entries (the CRA, Amazon, An Post, and Australia Post with Linkt) linked to pages that had moved or no longer existed, and are re-sourced. The An Post entry now also notes its one payment-link exception, for items sent to the USA. The remaining entries were checked and tightened to each organisation’s wording. We found this in our own review, when two entries could not be confirmed before we cited them elsewhere.

19 October 2026: Cash App does publish a support phone number, and four other errors in our Cash App guide.

Our Cash App legitimacy guide said Cash App has no public phone-support number, that its only official channels are the app and its help site, and that any number found by searching is almost certainly a scam. That was wrong. Cash App's own contact page lists 1 (800) 969-1940, every day from 8 AM to 9:30 PM ET. The guide also said Cash App ran no live phone line until January 2025; the CFPB's order finds no live phone support from 2016 until February 2021. It gave 56 million monthly users and 23 million Cash App Card users; Block reported 57 million and 25 million for December 2024, and 59 million monthly transacting actives in June 2026. It said Cash App's terms call scam payments “final and non-refundable”; the terms instead warn that scams “may result in the loss of your funds with no recourse”. And it called the CFPB order the second-largest Cash App action, which we cannot support: we found none larger. We corrected the header, summary, body, questions and structured data, and added the July 2026 settlement between Block and 46 state attorneys general. Found in a fact-check of the guide against Cash App's, Block's and the CFPB's own documents.

17 October 2026: a Zelle claim without a source, and a Wi-Fi study stated too broadly.

Our Facebook Marketplace guide said that “since the 2025 settlement pressure” some banks reimburse Zelle impostor-scam claims they previously refused. We could not source that: the CFPB's 2024 lawsuit over Zelle was dismissed in March 2025, with no settlement. It now cites Zelle's own statement that qualifying impostor scams may be eligible for reimbursement through your bank or credit union. Our World Cup guide said a Kaspersky drive-test across host-region cities found 10% to 12% of networks open; the study covered only the three Mexican host cities, which the guide now says. Found during a site-wide check of our own corrections.

17 October 2026: Kaspersky did not tie the Massiv and Perseus trojans to World Cup apps.

Our World Cup streaming piece and our World Cup ticket guide said Kaspersky had tied fake World Cup streaming apps to the Massiv and Perseus banking trojans, and that the malware intercepts one-time codes. Kaspersky's 29 May 2026 post says fake IPTV apps spread Massiv (found in February) and Perseus (reported in March), and warns World Cup viewers about the tactic; it does not report World Cup-branded apps and does not describe code interception. We merged the streaming piece into the ticket guide's streaming section, which now reports only what the source says. Found during a site content audit.

17 October 2026: the FBI's $1.4 billion recovery-scam figure is for cryptocurrency-related recovery scams.

On 23 September we narrowed this figure in our recovery scams guide, but five other places still presented it as the total for all recovery scams: our Venmo refund guide, our tech support scam guide and three summary cards (the third, on our UK reporting guide, was found and corrected later the same day). In the FBI's 2025 IC3 report, the 10,516 complaints and $1.4 billion in losses sit in its cryptocurrency fraud section, and the FBI notes that the losses may include the earlier scams that led to the contact. We corrected all five. The same audit found a summary card that still promised “the path that actually works” for Zelle refunds, a promise we had already removed from the Zelle guide's own headline; it now matches that headline. Found during a site content audit.

16 October 2026 — Ireland labels scam texts "Likely Scam". It does not block them.

Our Scam-Text Protection Index placed Ireland in the Blocked tier and said that since October 2025 an unregistered branded text was not delivered there at all. That was wrong, and it was already wrong when we published on 14 July. ComReg scheduled blocking for 3 October 2025, but in Information Notice 25/62, dated 16 September 2025, it deferred the blocking phase "until it can be satisfied that the outstanding matters are resolved". (When this entry was first published we gave the date as 19 September, which is the date of ComReg's web update rather than of the notice; amended the same day.) Its SMS Sender ID Registry page, updated 15 October 2026, still says unregistered sender IDs "will be blocked at a later date". What happens today is that, since 3 July 2025, such texts arrive with the sender changed to "Likely Scam", and ComReg says some registered sender IDs are being wrongly labelled too. We had sourced the row to a July 2025 trade report of the scheduled date rather than to the regulator. Ireland is now in the Flagged tier alongside Singapore and Australia; the Blocked tier holds Spain, India, Italy and Finland. The counts, table, prose, FAQ, search description, alt text and graphic have all moved with it, and an out-of-date summary of the index in our llms.txt file, which still listed Finland as having no scheme, was corrected at the same time. A corrected version 1.1.0 of the archived dataset, which also carries the July Finland correction, was deposited on Zenodo the same day (10.5281/zenodo.23425706). Found by us while re-checking the index against ComReg's own page.

16 October 2026 — the CFPB's Cash App order was a $55 million fine, not a $175 million one.

Our Cash App legitimacy guide, its search description, our Zelle guide and two summary cards said the CFPB “fined” Block $175 million. The CFPB's 16 January 2025 order totals up to $175 million, but only $55 million of it is a civil money penalty; the rest is at least $75 million and up to $120 million in redress to consumers. We corrected the description, headline, FAQ and summaries to separate the penalty from the redress. The body of the article already stated the split correctly. Found during a site audit review.

16 October 2026 — Tangerine alerts, account assurances and refund rights.

Our Tangerine guide extended a warning about unexpected login links into a universal rule about bank messages, treated a suspicious text as proof that no breach or account access had occurred, and said Canada had no law compelling reimbursement. Tangerine's published suspicious-spend alerts have specific sender numbers and a Y/N text reply; its fraud team may also call to follow up. Bank Act section 627.33 limits liability for unauthorized credit-card use, subject to its stated exception; that protection must not be presented as a guarantee for transfers a victim was deceived into approving. We corrected the body, FAQs, structured data, illustration and summary, and replaced assurances with independent verification and payment-specific guidance. Found during the morning source review.

12 October 2026 — remaining Australian framework timing contradiction.

Our Australian reporting guide still said digital platforms already had direct duties to act under the Scams Prevention Framework, despite the 27 September correction elsewhere on the page. The ACCC's implementation timetable distinguishes AFCA membership from 1 September 2026 from the 31 March 2027 start of most obligations and AFCA handling of eligible framework complaints. We corrected the marketplace directory, introduction and structured-data descriptions, and preserved the existing bank-complaint route, historical publication date and loss statistics. Found during the morning primary-source review.

11 October 2026 — toll-message scope and genuine Canadian reminders.

Our US toll-impersonation guide described every unpaid-toll text as a scam. That wording was broader than the campaign evidence and contradicted 407 ETR's published genuine-reminder practices. We narrowed the opening, verification guidance, first FAQ and matching metadata to the documented US impersonation campaign and independent verification of individual messages. The new 407 ETR guide distinguishes real Canadian reminders from an unverified payment route. Found while checking that new article's inbound links. Historical publication, statistics and source dates remain unchanged; this correction does not certify every US operator's current contact policy.

11 October 2026 — bank-text recovery warning and institution count.

Our bank-text guide classified every later recovery offer for a fee as a scam. We narrowed the visible warning and matching FAQ schema to unexpected recovery offers requiring an upfront fee, following the FTC’s recovery-scam guidance. We also corrected a list of five unverified institutions that was counted as four. Found while reviewing the page for a search-performance checkpoint; the short-code register and its verification dates are unchanged.

11 October 2026 — genuine FTC refund emails and recovery-service impersonation.

Our FTC impersonation article said an unexpected offer to return money was itself proof of fraud. Our compensation tracker said genuine programmes never contacted people unexpectedly. Both were too broad: the FTC’s refund FAQ explains that official emails can precede PayPal refunds and that most cases do not require consumers to file a claim.

We corrected the visible guidance, FAQs and matching structured data. Verify the named case, administrator and payment method independently at ftc.gov/refunds; an unexpected message alone does not establish fraud or authenticity. The FTC does not require an upfront fee or sensitive financial information to receive its refund. Found while checking the agency’s 8 October Cleo AI refund announcement. Programme rows, archived dataset files and DOI identifiers are unchanged; this is a correction to verification advice.

9 October 2026 — Canadian reporting routes, credit freezes and genuine messages.

Our Canadian reporting guide wrongly called OBSI recommendations binding and described Ontario as the first province with credit freezes. OBSI recommendations are not binding; Quebec freezes began in February 2023, and TransUnion now offers freezes to eligible Ontario and Quebec residents. We corrected the bank-complaint route and its 56-day and 180-day limits, clarified that the national reporting portal does not replace contacting local police or the affected institution, and removed an unsupported estimate of total Canadian losses.

We also overstated restrictions on genuine CRA contact. The CRA can make phone calls and send letters or certain emails, and may request identity documents after suspected account compromise. Its sign-in text codes are distinct from fake refund messages. We removed an unverified reporting email address and replaced it with the CRA's published reporting route.

Our Canadian text checker and the reporting guide implied that Interac deposit links always proved fraud and that every sent transfer was irreversible. Genuine notifications for recipients without Autodeposit can include deposit links. Cancellation may be available before deposit through the sender's bank; a deposited transfer cannot simply be cancelled. The checker now asks whether an apparent deposit actually requires an outgoing payment, and gives verification guidance instead of declaring a message fraudulent from a link alone. An expected message or familiar sender name still does not authenticate it, and reporting or disputing fraud does not guarantee a refund.

The checker also treated small customs charges as inherently fraudulent. Canada Post does collect genuine duty and taxes and offers opted-in notices and payment through its tracking page or app. We clarified that process alongside its warning about unsolicited parcel-release payment texts, and removed blanket claims that all Canadian banks never include links or telephone numbers in alerts.

The same Interac and generic bank rules remained in the live Impersonation Index. We corrected those entries and the page's matching summary, FAQ and verification steps. The archived dataset files, DOI and version are unchanged; the live page now identifies these corrections as another difference from the archive.

Found during a Canadian content review and checked against current Interac, TransUnion, CRA, Canada Post, RCMP, FCAC and OBSI primary guidance. The guide retains its original publication date and both pages display this review and correction date.

7 October 2026 — Zelle disputes and fake-payment verification.

Our Zelle refund guide gave outdated standalone-app instructions, overstated reimbursement and response deadlines, and told readers to describe every scam payment as unauthorized. We replaced that advice with current bank reporting routes, accurate distinctions about who initiated a transfer, and qualified Regulation E and CFPB timelines. We removed an unsupported annual-loss estimate and speculative recovery promises.

Our fake-payment screenshot guide wrongly implied that pending payments were inherently suspect and that cleared or available funds made shipping or refunding safe. Genuine payments can be pending; an available balance is not proof of irreversible payment. We corrected the text, FAQ, structured data and illustration, and added provider-specific verification and seller-protection guidance. These errors were found during a content and indexing review.

27 September 2026 — scam-ad liability and Australian framework dates.

The scam-ad article said only banks could owe compensation. That was too broad: liability depends on the jurisdiction, conduct and legal claim. We corrected the article, FAQs and search summary and removed the diagram carrying the same claim. We also removed an unsupported inference that missing keyword data proved nobody searched for accountability.

The Australian reporting guide gave incorrect June 2026 and January 2027 dates, while the scam-ad comparison implied the new complaints route opened in September. The ACCC distinguishes AFCA membership from 1 September 2026 from the 31 March 2027 start of most obligations and eligible framework complaints. Both articles now make that distinction and preserve the existing bank-complaint route.

23 September 2026 — substantive corrections to our first ten posts and original guides.

Our launch-content review found advice stated more confidently than the evidence allowed. The subscription guide said replacing a card stops recurring charges; card updater services can keep them running. The task-platform and investment guides treated a successful withdrawal as proof of legitimacy, although payouts can be bait. The AI guides presented visual challenges as reliable authentication. These claims have been corrected. Two older recovery illustrations also overstated official-contact rules; a new verification diagram replaces them.

We also corrected recovery statistics and legal distinctions: the FBI’s $1.4 billion figure concerns cryptocurrency-related recovery scams; its 58% Financial Fraud Kill Chain figure describes funds frozen in selected incidents, not refunds for all victims. We removed an invalid overall recovery-rate calculation and blanket 24–72-hour cutoffs. The payment guide now distinguishes transactions initiated by a fraudster from payments the victim personally sent.

Other corrections address genuine unclaimed-property outreach, optional finders, legitimate advance legal fees and real official contact such as Operation Level Up. We removed unverified quotations and unsupported casework claims, labelled illustrative scenarios, and separated broad fraud-category statistics from claims about task scams, family impersonation or AI. Matching advice in the original guides, FAQs and search summaries has been revised. The about page now agrees with the free consultation offer, and an obsolete Stripe consultation-payment disclosure was removed.

Some of these problems recur in subjects covered by earlier entries in this log. Those entries did not establish that every current occurrence was correct. We found the present errors by reading the live-version source against primary guidance, and have preserved this record rather than silently treating them as cosmetic edits. The affected first ten posts retain their original May publication dates and show the September review date; original-guide metadata that incorrectly said 1 May now reflects the 20 May launch.

15 September 2026 — we gave the wrong date for Report Fraud replacing Action Fraud.

For about two hours after publication, our page on UK government texts said Report Fraud replaced Action Fraud on 12 December 2025. That is the date DVLA updated its scam-advice page to point at the new service. The replacement itself happened on 4 December 2025, as our UK reporting guide already stated from the City of London Police announcement. Corrected in all four places on the page, including the DVLA seal. Found by us, re-reading the DVLA page in full after a summary of it had been trusted for the date.

1 September 2026 — we said we had checked five absence claims. Three of them were wrong.

Yesterday's correction to the Dating App Safety Index brought the count of apps publishing no retention period from seven down to six, and stated that the remaining five claims, for Match.com, eharmony, Duet, PURE and SCRUFF, "were checked and stand". Three of them did not stand. Duet, PURE and SCRUFF each publish a retention rule. In every case we had read the wrong document.

Duet's privacy policy has a section headed Retention and Deletion: verification photos and videos are "retained for the lifetime of your account", and the face geometry is "not retained as a persistent biometric template after processing". PURE's privacy policy states that biometric data is permanently deleted when the account is deleted, that nothing is retained if verification is cancelled before it completes, and that Veriff session data "may be retained for 7 days in active storage and then for up to 3 months in secure archive". SCRUFF's operator, Perry Street Software, publishes a dedicated Notice and Consent to Process Biometric Data with a section headed Retention.

The pattern is identical in all three, and identical to Tinder: retention lives in a privacy policy or a dedicated biometric notice, and all three rows cited only help and safety pages. PURE is the sharpest case. Its own entry said the data was handled "in accordance with Pure's Privacy Policy and Veriff's Privacy Notice" and then reported that no retention period was stated. It named both documents and read neither, which is the Tinder failure repeated a day later, inside the revision written to prevent it.

Found by us, during a sweep of every citation in every dataset. The count is now three of twelve. Of those three, eharmony was re-read against its privacy policy and stands. Match.com and Plenty of Fish could not be re-read at all: both sit behind blocks that refuse us, and Plenty of Fish's privacy policy defers the question to a help article we cannot open. Those two are recorded as an absence in the pages we could review, and are explicitly not confirmed. The dataset is version 2.2.0, and the archived copy has not yet been updated to match.

31 August 2026 — we recorded an app as publishing no retention period, on the page where we tell you an absence is not a finding

Our Dating App Safety Index said that seven of twelve dating apps "publish no retention period at all", and counted Tinder among them. Tinder in fact publishes one of the most detailed schedules in the whole index. Its Photo Check privacy page states that the video selfie is promptly deleted, that the FaceMap and FaceVector derived from it are retained for the lifetime of the account and deleted within 30 days of closure, and that two audit images and the verification result are kept until 90 days after the account closes, or a year if the account is banned.

The per-app row was hedged honestly: it said no retention period was stated "in the pages reviewed". The summary sentence dropped that hedge and asserted a proven absence. That distinction is the entire subject of the "Absence of evidence is not evidence of absence" section further up this page, which makes this the second time we have published the error that section exists to prevent. The first was a background-check programme in July. What makes this one worse rather than better is that the page carrying Tinder's schedule was already listed in that row's own sources. It was cited and not read.

Re-reading all seven absence claims against the platforms' own pages corrected three more entries. Hinge was described only through Selfie Verification, which deletes within 24 hours, and was called the tightest deletion window in the index; Hinge also runs Face Check, which keeps the FaceMap for the life of the account. OkCupid's 24-hour purge is real but was attributed to "the Match Group family standard", which does not exist: inside Match Group, OkCupid purges within 24 hours while Tinder and Hinge retain for the account lifetime. Plenty of Fish rested on that same invented standard. The remaining five absence claims, for Match.com, eharmony, Duet, PURE and SCRUFF, were checked and stand. The count is now six of twelve.

Found by us, while researching an article that would have quoted the figure. The fix that matters is structural rather than textual: the retention field now carries its own citation list, the way our background-check field already did. A field that asserts an absence has to show the pages that absence was read from, or nobody can check it, ourselves included. The dataset is now version 2.1.0, and the archived copy is being updated to match.

12 August 2026 — we told UK victims to report to a body that no longer exists, on a page where we claimed we had fixed exactly that

The UK replaced Action Fraud with Report Fraud (reportfraud.police.uk) in December 2025, and we did a pass to update our pages. Three places were missed, and all three were instructions rather than background: a step in our UK refund guide, the UK escalation advice inside our refund checker, and a step in that checker listing each country's reporting body. Anyone following them would have been sent to a service that had shut.

What makes this worth logging is where else it appears. Our about page uses this very rename as its worked example of how we handle a superseded source, and says we "corrected every page that referenced it". We had corrected forty of the forty-three places it appears, which is not the same claim. The three instructions now name Report Fraud, and note that it replaced Action Fraud in December 2025 so the change is not confusing to anyone who remembers the old name.

Found by us, while clearing an old to-do that we expected to already be closed. The forty we left alone were left alone deliberately: most of them say "replaced Action Fraud" or "formerly Action Fraud", which is correct, and four cite Action Fraud reports as the source of a 2022 to 2023 dataset, where renaming the body would misattribute the data. The lesson is that a rename is not one edit, and the sentences most likely to be missed are the ones telling somebody what to do.

11 August 2026 — we put a precise fraction on a qualitative FBI statement, and cited a page that predates the real numbers

Our flagship essay published "3 in 4" FBI-contacted victims did not know they were being scammed, and our recovery-scams guide published "3,780 of them in 2025" and 78%. All of it was credited to the FBI's February 2025 news story on Operation Level Up. That story contains none of those numbers. It says only that "most of the victims contacted by the FBI are unaware they are being scammed" — a qualitative statement, to which we had attached a precise-sounding fraction.

The FBI does publish the figures, on its own Operation Level Up victim-services page. As of December 2025: 8,103 victims notified, and 77% of them did not know they were being scammed. Both pages now carry those numbers, and both source links point at the page that actually holds them rather than at the older story. The summary file we publish for AI systems was carrying the same wrong fraction and has been corrected too.

Found by us, because we were about to use the figure somewhere public and checked it at source first. The general lesson we take from it: a rounded fraction reads like a summary and invites nobody to verify it, where a percentage invites a look. The number that was hardest to check was the one that turned out to be wrong.

2 August 2026 — Our phishing guide asserted a mechanism instead of citing it, and framed it as casework.

A note on the phishing page claimed personal review of hundreds of phishing emails from victim cases, and explained that the successful ones land at a moment of distraction. The underlying mechanism is real and documented, but we asserted it rather than sourcing it, and the framing implied direct casework we had not evidenced. The section now quotes Frank Stajano and Paul Wilson (University of Cambridge, Communications of the ACM) for what they actually wrote, the distraction and time principles, and marks the phishing conclusion as our inference rather than theirs. It also carries a link to the paper, which it previously did not. The same first-person framing was removed from five other guide pages in the same pass.

A reader raised it publicly. We changed it the same day. An unverifiable claim to authority is precisely the thing this site tells people to distrust, so it had no business being on ours.

28 July 2026 — Finland was listed as having no scam-text protection. It has one of the strictest.

Our Scam-Text Protection Index placed Finland in the "none identified" tier: no mandatory scheme found to block or label a text wearing a company's name. That was wrong, and it was already wrong when we published on 14 July. The Finnish regulator Traficom issued Order 28 L/2025, in force 4 May 2026, requiring organisations to obtain approval for every SMS sender ID in advance — either authorised through their messaging provider or reserved exclusively with Traficom — and Traficom's own guide states that traffic using a reserved sender name outside the agreed routes "will be blocked". Finland now sits in the Blocked tier alongside Ireland, Spain, India and Italy. The counts, the table, the alt text and the graphic have all moved with it.

This is the second time the same source class has failed in the same direction. On 17 July we moved Italy out of that tier for exactly the same reason: it was sourced to a commercial messaging aggregator's country-requirements page rather than to a regulator, and AGCOM was in fact running a mandatory register. An aggregator's matrix records what that company needs in order to route a customer's traffic, which is a different question from whether a regulator has mandated consumer-facing protection — and it can be silent on a rule that exists. So rather than only fix the row, we have added the weakness to the limits section on the index itself, naming the remaining rows in that tier as the weakest claims on the page.

Found by us, while checking a lead for something else entirely. Three further defects surfaced in the same audit and were fixed: the headline read "In five countries, it doesn't" when the blocked tier held four — a hardcoded number on a page where every other count is derived, so it is now derived too; the image alt text still named Italy among the countries with no scheme, ten days after Italy was moved; and a stray character in the page source rendered one sentence as "the $6 countries". The archived dataset on Zenodo still carries the pre-correction table and is noted as such on the page until it is re-deposited.

26 July 2026 — Verification of Payee is already in force, not arriving in 2027

Our Scam-Refund Index said that mandatory "Verification of Payee" — the name-and-IBAN check before a transfer — was coming with the EU's Payment Services Regulation (PSD3), with realistic application around 2027. That was wrong on both the instrument and the date. Verification of Payee comes from the Instant Payments Regulation (EU) 2024/886, and Article 5c(9) requires banks in euro-area countries to comply since 9 October 2025, free of charge. The 2027 date we published is real but belongs to EU countries outside the euro, which have until 9 July 2027. Both dates exist and apply to different countries, which is how they came to be merged into one wrong sentence. PSD3 is a separate, later package; what it would actually add is a refund right for bank-impersonation fraud.

Found by us, by noticing that our own guide to reporting scams in Europe already said the opposite — correctly. That page needed no change. The error was confined to the index, and it was corrected against the text of the regulation rather than by making the two pages agree with each other.

22 July 2026 — the Impersonation Index counts entries, not organisations

We described the Impersonation Index as covering "27 organisations". It holds 27 entries covering roughly thirty organisations: one row is generic (your bank, any bank) and five bundle several bodies together — Zoll, Finanzamt and Österreichische Post are a single row spanning two countries. The count therefore overstated and understated at the same time. Corrected on the page, in the structured data, and on the archived dataset record, and the page now explains what counts as an entry.

26 July 2026 — a "60% recovery rate" we could not source, on the page for people who have just been scammed

Our recovery guide stated that roughly 60% of money is recovered by banks if you act fast. We could not trace that figure to any source, and it contradicted our own guide to getting money back, which correctly says the odds depend on the payment rail you used. It was the worst error we have found on this site, because it sat on the page people read in the hours after losing money — the moment when false hope is most expensive.

Removed. The page now carries a figure we can source and that says something narrower: the FBI reports a 58% success rate for its Recovery Asset Team in freezing funds on fast-reported wire fraud, and $679 million frozen for victims in 2025. That is the FBI freezing a transfer, not a bank refunding a loss — a different thing from what we had published, and we would rather say the narrower true thing.

26 July 2026 — we cited a report that disagreed with our own figure

Our phishing guide published a statistic and credited it to Verizon's Data Breach Investigations Report. The report does not support that number. We were citing a source that contradicted us, which is worse than citing none. The figure now shown — that 62% of breaches involve a human element — is the one the report actually publishes.

26 July 2026 — arithmetic that contradicted itself on the same line

Our glossary gave a loss total and a complaint count for business email compromise and then concluded the average exceeded $160,000. Its own two numbers divided to about $129,000. The error was checkable by anyone reading the sentence. The entry now uses current FBI figures — $3,046,598,558 across 24,768 complaints — and states the average they actually produce, about $123,000.

26 July 2026 — three wrong figures in one identity-theft guide

The page said 48% of adults had experienced identity theft; that number came from an unrelated survey question about cases still unresolved after twelve months, not lifetime prevalence. It said victims spend 300 hours resolving it; that traces to a survey from the early 2000s which reported roughly 300 million hours in aggregate across all victims, not 300 hours each. And it gave 1.4 million reports for 2024, which is the 2021 figure. All three are removed; the page now states that more than 1.1 million Americans reported identity theft in 2024.

Three errors of the same kind: a real number from a real source, attached to the wrong claim. That is harder to catch than an invented statistic, because every part of it looks checkable until you open the source.

20 September 2026 — recovery claim, checker accuracy and verification advice

The homepage still displayed the unsupported “60% if fast” recovery figure withdrawn in July. We removed that remaining instance. We corrected the website checker so an expired or otherwise unverifiable certificate is not presented as a valid HTTPS check, and clarified that its Google Safe Browsing result covers the site’s homepages rather than every pasted link. We also removed unsupported certainty about domain age and detection rates from the task-platform guide, and qualified the bank-text guide: published sender lists and message formats are clues, not a guarantee or a complete fraud test.