Test ContactTap: scam patterns & false positives

ContactTap · The hostile half of the test bench

What this page tests. A contact scanner is only trustworthy if it can't be used against you. Every row below imitates a real trick — with fictional targets — and states exactly how ContactTap responds: some things are shown with a warning, some are refused with an honest note, and digits that merely look like contact info stay out of the popup entirely.

Tags: found appears in the popup, warns appears (or is reported) alongside an amber warning, ignored must not appear, and known miss documents an honest limitation.

1 · Default-country pin (structured data)

This block pins the page's default phone region to US, exactly like the primary test page. Expected: one ordinary found card.

• Mojave Signal Works found — card A normal business card: phone and Las Vegas address.

2 · Scam patterns ContactTap defends against

• Number spoofing: the link shows one number, dials another warns This link displays (702) 555-0122 but its tel: target is +1 702 555 0111:

  (702) 555-0122

  Expected: the popup lists (702) 555-0111 — the number that would really be dialed — with an inline flag on that exact row (“the link for this number displays a different one than it dials”) plus the page-level amber warning. The flagged number is ranked last, never badged “Main”, and is never badged as a recommendation — listing it with a warning is honest; endorsing it would not be. The displayed 0122 must not appear as a separate verified entry from this link.
• Contact info hidden from view ignored + reported The block below contains a phone number and an email inside display:none markup — invisible to you, a classic spot for planting scam contact info:

  This paragraph looks empty except for this sentence.

  Urgent support: (702) 555-0133 or [email protected]
  Expected: neither the number nor the email appears in the popup, and the amber notice “contact info hidden from view on this page was ignored” does.
• Premium-rate number found + flagged Calls to premium-rate lines cost extra — a favorite of fake-support scams. UK premium-rate example in plain text: call +44 909 8790123 for “priority help”. Expected: the number is listed (it's real and visible), with a premium-rate warning when the bundled number metadata can identify the type — and silence rather than a guess when it can't.
• A hostile link scheme dressed up as a phone link link ignored; visible text found The link below is javascript:, not tel: — ContactTap reads only tel:, sms:, and mailto: links, so the href contributes nothing:

  Call (702) 555-0144 now

  Expected: the visible text’s number is still found (it's legitimate on-screen text), but strictly from the text scan — the hostile href itself is never read or acted on.
• Malformed mailto: payload ignored A crafted address full of markup characters: mailto:"><img src=x>@example.com (a real link below, visually labeled “Email support”):

  Email support

  Expected: fails strict address validation and never appears — and could not execute anywhere in the popup even if it did, because page text is never rendered as HTML.
• International (IDN) email known miss — safely mü[email protected] — the current matcher is ASCII-only. Expected: not reported at all. The important part: it must never be reported truncated (“[email protected]”) — a mangled address is worse than none. Full international support is on the improvement list.

3 · Digits that only LOOK like contact info

The false-positive guard: nothing in this section may appear in the popup.

• A price ignored The restoration cost $1,702,555.01 in total.
• An order number ignored Your confirmation is #7025550142.
• A tracking-style digit run after a digit ignored Serial 97025550142 is a part number, not a phone.
• A version string ignored Requires firmware 2.5.1 or newer.
• An ISBN ignored Reference: ISBN 978-0-306-40615-7.
• An IP address ignored The printer lives at 192.168.50.114.
• A 16-digit card-style number ignored Test PAN 4111 1111 1111 1111 (a standard payment-form test value).
• An image filename with @ ignored The asset is named logo@2x.png.
• A package version with @ ignored Installed libphonenumber-js@1.12.9 from the lockfile.
• An email with no dot in the domain ignored The dev box mailer is root@localhost.
• Digits split across table cells ignored Fragments from unrelated elements must never fuse into one number:

  702

  555

  0123

• An obfuscated email known miss — by design “write to don (at) example (dot) com” — deliberately not decoded: the author obfuscated it to keep it away from automated harvesters, and ContactTap respects that.

← Back to the primary test page · Address formats test page →