Measured, not claimed.

How we got here

1. Run 1 (24 textbook cases). A single model prompt got 24/24. Countersign got 20/24: it never cleared a scam, but rated four tactic-only scams (no links or sender to check) as UNVERIFIED rather than FORGERY.
2. We pre-registered a hard set of 14 polished fakes and scary-but-real alerts, and added one signal: an identity claim combined with a request for money, codes or access. Run 2: single prompt 38/38, Countersign 36/38 with one false alarm (a genuine verification-code text).
3. Two fixes after run 2, and we say so: a message that gives a code is no longer read as one that asks for it, and the model's overall read now counts as one weighted signal, which code can still outvote.
4. Run 4: we pre-registered an adversarial set, and lost it. Twelve new cases: eight scams written to persuade an AI screener (fake security-scan reports, a fake assistant transcript, “training example” framing, instructions in Spanish or spaced out), and four genuine messages that talk about AI. Neither system was fooled by any of the eight scams. But Countersign rated two genuine messages that quote injection text (a security newsletter and a GitHub pull request) as UNVERIFIED, so the single prompt won 12/12 to 10/12. That's the cost of treating any text aimed at an AI as suspicious. We published it unchanged (it's kept in eval/history/run-4.json).
5. Fix, then run 5 on two new pre-registered sets. We changed the injection detector so that quoting an attack as an example (“phrases such as …”) no longer counts as one. Then we tested what a single prompt can't see: six pairs of identical messages whose only difference is a QR code pointing to a lookalike or the real site. The single prompt scored 3/12 and stamped three genuine messages FORGERY; Countersign scored 7/12. On a fresh quoting-versus-attacking set both scored 5/6.
6. Four more fixes, then run 6 on a hold-out nobody had seen. A brand claim is trusted when every link is on the brand's own domain; a link to a site carrying the claimed brand's name that the brand doesn't own is flagged; a list of quoted examples shares its cue; a fake “Assistant:” line vouching for a message counts as an attack. Run 6's hold-out (18 new cases, committed first): Countersign 17/18, single prompt 8/18. Our one miss was a bug in the new “Assistant:” rule (a quoted example starting with a role label), since fixed; the recorded result stays. The other tables above are run 6 too, but those sets had already shaped our fixes, so only the hold-out is a clean test.
7. What this means. On plain text, a strong model is as good as we are, and we don't claim otherwise. Countersign wins where a prompt is blind: it reads QR codes, checks domains, email authentication and redirects for real, keeps working without the model, and the AI can't set the verdict on its own. And Family Countersign proves identity in the one case no detector can: a perfect voice clone.