Dealing…
Maya's card · Capital One sandbox (private demo account)
Dealing…
Bluff reads the shape of a page, never what you typed into it. To check your card, its server reads your sandbox charges and the merchants' public websites. Forwarding a message is your choice, and the message is dropped as soon as the verdict is made.
Checkout Guard extension
Your device
Stays here: what you type (card, CVV, password), your input values, the page text and the page's path or query.
The extension checks locally: is there a card field? gift cards only? countdown timer? contact page?
Bluff server
The site's origin, which kinds of fields it asks for, and yes/no page signals.
Card watch (bank scan)
Capital One Nessie
Sandbox account with synthetic charges. No real card data.
Bluff server
Groups your charges by the merchant's website.
Merchant's public site
Public pages only, read on your request, no forms submitted.
NVIDIA Nemotron
Reads the pages plus that merchant's own charge dates and amounts, then rates the site.
| Data | Where it goes | Notes |
|---|---|---|
| Card watch (bank scan) | ||
| Your Capital One transactions (Nessie sandbox) | Read by Bluff's server | Bluff's server pulls the sandbox account's charges from Capital One's Nessie API and keeps them in your demo account. |
| The merchant's public website | Crawled by Bluff's server | Up to 10 public pages per merchant (refunds, terms, contact, checkout). You asked for the check, so pages robots.txt hides from bots are read too (and noted); pages built with JavaScript are loaded in a sandboxed headless browser. No form is ever submitted. The page text goes to NVIDIA Nemotron with registry facts. |
| A merchant's own charge history (dates and amounts) | Sent to Nemotron | Only that merchant's charges, and only for that merchant's review. Your other charges are not sent. |
| Real card data | Never | Synthetic only: the Nessie sandbox account and every demo charge are made up. No real customer data. |
| Checkout Guard extension | ||
| What you type into a page (card number, CVV, password, SSN) | Never sent | The extension never reads input values. |
| Page text, screenshots, and the page's path or query | Never sent | Only the site's origin leaves the page, for example https://shop.example. |
| The site's origin | Sent | Needed to check the site and to link a later charge to it. |
| Which kinds of fields the page asks for | Sent | For example "card number" and "CVV", never the values. |
| Yes/no page signals | Sent | Gift-card-only, countdown timer, no contact page, and similar. |
| Texts and links you check | ||
| A text you forward or report, or a link you paste | Sent by you, then discarded | Sent to Nemotron for the verdict, then discarded. Only the verdict is kept, and for a scam link, the site's host. |
Proof: how well Bluff works (measured claims, with the failures shown)
Clears your exposures, verdicts, texts, disputes, crawls and game data, then starts your account over from the demo card history. Only your account is affected.