Guidr: Scam Protection

Guidr warns you at the exact moment a scam is about to cost you money. Other tools warn you about a website. But a scam site is harmless until you do one of about five things: type a TAC, hand over your banking password, paste a bank account number, run a file you downloaded, or press "pay". Guidr watches for the action, not the page. That is why it stays quiet almost all of the time and still catches the moment that actually matters. WHAT IT CATCHES - Your banking password or TAC being typed into a page that is not your bank. This is the single most expensive scam in Malaysia, and it is the one Guidr is built around. - Web addresses imitating a bank: a character changed, the bank's name glued on to somebody else's domain, or look-alike characters. - Android app installers (.apk) handed to you by a website. No real bank, agency, or employer in Malaysia asks you to install an app from a link. - A bank account number being typed on a site nobody can vouch for, which is the marketplace and job-scam pattern. - Search results: official bank websites are marked green, imitations red, before you click. WHEN IT WARNS, IT TELLS YOU WHAT TO DO No jargon. Not "phishing", not "credential harvesting". It says what is happening and what to do next: close this tab, open your bank by typing the address yourself, call the hotline if you already entered something. IT SENDS NOTHING TO ANYONE Guidr makes zero network requests. Not for analytics, not to update a blocklist, not an anonymous ping. There is no server to receive your browsing, so there is nothing to sell, nothing to lose in a breach, and nothing anyone can compel us to hand over. This is enforced by our build, not promised in a policy: the build scans the compiled code for every way an extension can reach the network and refuses to produce a build if it finds one. - It never reads the value of your password or your TAC. It detects that such a field exists and that you have started typing. Not what you typed. - It keeps no browsing history. It stores three things on your device: on or off, sites you switched it off for yourself, and two counters. - On the verified websites of Malaysian banks and on gov.my, Chrome does not load Guidr at all. It is structurally incapable of watching your real banking session. Chrome will tell you Guidr can "read and change all your data on all websites". That is accurate, and we are not going to argue with it: a fake bank page lives on an attacker's domain and we cannot know that domain in advance. What we can do is make the data impossible to send anywhere, and publish our code unminified so anyone can check. Most extensions ship compressed and unreadable. Ours ships as the roughly 40 kilobytes we actually wrote. Built in Malaysia, for Malaysian scams. Free. Privacy policy: https://guidr.my/extension/privacy