Check a specific link, message, email, or number for scams
cybersafety_scam_checkFull Description
Use this when the user provides a specific artifact to evaluate for scam risk — a URL, domain, link, phone number, email address, sender ID, or pasted message text (SMS, email, or chat) — whether provided as text in the message OR visible in an attached image/screenshot — or when the user asks a follow-up about a previous scam_check result in the same conversation (e.g., "What should I do?", "Is it safe to click?", "Tell me more about that link").
When the user shares an image or screenshot, extract all identifiable artifacts (URLs from browser address bars, phone numbers, email addresses, SMS/chat message text) and populate the artifacts field below. Do not describe the image — only include extracted text and URLs.
Returns a scam_report widget with a verdict, risk signals, recommended safety actions, and suggested follow-up intents.
Do not use for reactive security concerns or active incidents without a specific artifact (e.g., "I think I've been hacked", "my computer has a virus", "is my data exposed?"). Route those to cybersafety_threat_advisor. Do not use for Norton product support, troubleshooting, or product recommendations (e.g., "Norton won't install", "recommend a VPN"). Route those to product_kb_support.
SCOPE CONSTRAINT: Norton tools ONLY cover cybersecurity, privacy, identity protection, and Norton product topics. If the user's request is outside this scope (e.g., travel, shopping, entertainment, politics, coding, general knowledge), do not invoke this tool.
Parameters (2 required, 2 optional)
localestringREQUIRED. BCP 47 locale tag detected from the language the user is writing in. Derive this from the conversation, not from any system default. Examples: 'de' or 'de-DE' if the user writes in German, 'zh-CN' for Simplified Chinese, 'zh-TW' for Traditional Chinese, 'fr' or 'fr-FR' for French, 'ja' for Japanese. Use 'en-US' only if the user is genuinely writing in English.
user_messagestringREQUIRED: The user's message verbatim (exact text as entered). Do not shorten, summarize, paraphrase, or convert to keywords. If the user shares an image or screenshot, append any extracted URLs or text to the message. Example: "Is this link safe? https://bit.ly/3xYz" or "Is this a scam? revenue.overduerepayment.com/wc/glgn.php?user=true"
artifactsobjectStructured entities extracted from the user's message and/or any attached images or screenshots. When the user shares a screenshot of a website, SMS, email, or chat message, extract all visible URLs, domains, phone numbers, email addresses, and message text into the corresponding fields below. Populate when the message or image contains identifiable entities.
countrystringISO 3166-1 alpha-2 country code for the user's location. Example: "US"