You scan through everything client-side, many monero wallets do this. There is no SPV and  headers are not checked either.