Getting Started
This guide walks you through creating a ScamShield AI account, completing the mandatory security setup, and reading your dashboard.
Creating your account
There are two ways to sign up:
- Free trial — the fastest path. Provide your name, work email, Indian mobile number, and GSTIN. Your company name defaults to "{Your Name}'s Business" if you leave it blank. Trial accounts trust your email address, so there's no separate email-verification step.
- Standard registration — provide your email, full name, company name, phone, and DPDP consent (required). Optionally add your industry and GSTIN.
Note: For security, ScamShield AI generates a temporary password and emails it to you — you do not choose your password at sign-up. You set your own password on first login (see Security setup below).
After standard registration, check your inbox for a verification email. The link (/verify-email?token=…) is valid for 24 hours; you can request a fresh one up to 3 times per hour.
Security setup (required before you can use the app)
ScamShield AI enforces account security on the server, not just in the UI. When you first log in, you're guided through a fixed sequence, and you only receive a full session once every step is complete:
- Change your password — replace the emailed temporary password with your own (minimum 12 characters).
- Set up two-factor authentication (MFA) — scan the displayed QR code (or enter the manual key) into any TOTP authenticator app (Google Authenticator, Authy, etc.), then confirm the 6-digit code.
- Save your recovery codes — a set of one-time recovery codes is shown once at MFA confirmation. Store them safely; they let you sign in if you lose your authenticator. You can regenerate a fresh set later from Settings (which invalidates the old set).
MFA is mandatory for new signups, invited team members, staff accounts, and any company that enforces MFA. If you close the tab midway, you resume at the same step on your next login.
Once MFA is confirmed, logins ask for your password plus a 6-digit code (or a recovery code). Repeated wrong codes trigger a temporary lockout.
The onboarding wizard
After security setup, a short onboarding wizard runs (6 steps): password → welcome → company details → connect email → terms → done. The meaningful data-collection steps are:
- Company details — name, industry, employee count, GSTIN, city, and state. Your GSTIN can be verified live during this step.
- Connect email — link Gmail (see Integrations) so ScamShield AI can start screening your inbox.
Verify from your side: the wizard's "terms" step and any team-invite flow are not tied to a specific stored field we could confirm in code — team invites are handled separately from the numbered wizard. If your rollout depends on those, confirm the exact behaviour with the team.
Reading your dashboard
The dashboard (Overview) summarises your workspace's threat posture. Key figures it reports:
| Metric | What it means |
|---|---|
| Company risk score | Average risk of your currently-open threats (0 if none open) |
| Total threats | Count of all non-safe detections |
| High / Medium / Low risk | Detections banded by score (high = score > 60; medium = 31–60; low ≤ 30) |
| Open threats | Detections still in detected or reviewed status |
| Threats by type / by fraud category | Breakdown by detection type and scam category (legitimate items excluded from the category view) |
| Users at risk | Distinct users with at least one high-risk (>60) detection |
| Recent threats | Your five most recent open threats |
The portal headline reads, for example, *"N total detections across email and voice analysis · M high-risk open."*
Next: connect your inboxes in Integrations.