1.Verify the claim
Before the inbox. 3 questions, not 8.
- IdentityIs the sender who they claim to be?
- RoleAre they authorized to speak for the org?
- FreshnessIs the credential still valid?
Pass → deliver verified · Doubt → quarantine · Fail → reject
XSCAMTrust infrastructure researchThe logo can be real.
The logo can be real.
The request can still be fake.
XSCAM verifies two separate things: who a message really comes from, and whether the organization actually authorized the action it asks you to take.
- 1.Verify the claim
- 2.Verify the action
- 3.Keep the proof
Message"Please return your device."
Sender identitySigned by the organization
Action authorityReturn authorized for this device
Requested actionShip to Facility A
VERIFIEDThe organization signed this exact action.
The problem
A convincing message proves nothing about the action inside it.
MESSAGELooks convincing
TRUST THE SENDER
PERFORM THE ACTION
MONEY / DEVICE / CREDENTIAL LOST
MESSAGE???ACTION
How it works
Two gates. One verdict. Proof you keep.
2.Verify the action
A real sender can still make an unauthorized request.
VERIFIED ACTION
signedIssuerVerified organization ✓
ActionReturn device
DestinationApproved facility
ExpiresSeptember 30
MESSAGE IS AUTHENTIC ACTION IS AUTHORIZED
3.Try it
Same return request. Three outcomes.
Scope & rules
One principle, many surfaces. Six rules, no exceptions.
- 1.Appearance is not authority.
- 2.Verify before consequence.
- 3.Identity is not permission.
- 4.More consequence, more proof.
- 5.Unverified is not fraud.
- 6.Trust must be machine-checkable.
Where it applies
What can be built today
Buildable now
- Org key infrastructure
- Signed action records
- Verification API
- Audit receipts
Needs partners
- Provider pre-delivery checks
- Telecom + bank integration
Long term
- Universal trust layer
- OS-level verification
- XDomain native
Architecture
A trust layer, not another inbox.
SOURCEEmail · SMS · Voice · Apps
XSCAMIdentity · Authority · Action
RESULTVerdict + receipt → action
- Email gateways
- Banking apps
- Telecom apps
- Couriers
- Browsers
- AI agents
XDOMAIN
XSCAM secures the internet we have. XDomain explores identity-native communication.
Explore XDomain →Answers
Six questions, straight answers.
No — and it does not try. Public brand assets can always be copied. XSCAM checks whether the action is authorized, regardless of how the message looks.
XSCAMTrust infrastructure researchDon't just ask who sent it.
Don't just ask who sent it.
Ask who authorized it.
XSCAM is an independent research and product-development project. Third-party companies, trademarks and examples are referenced solely to illustrate fraud and verification scenarios and imply no partnership, affiliation or endorsement.