Bharosa

Before you send money to a stranger online, forward their message to Bharosa. It spots scams in seconds, explains why in your language, and pays safely with PayPal.

Comment 1

Inspiration

Most online buying where I live doesn't happen on a checkout page. It happens in Instagram DMs, Facebook Marketplace and WhatsApp chats. The seller sends a photo and a price, then asks you to send money first by bank transfer, JazzCash or Easypaisa. If the parcel never comes, that money is gone. There's no buyer protection and nobody to complain to.

I wanted a check that needs nothing new: no app to install, no account, no English required. People already have the suspicious message open in WhatsApp, so the check should happen right there, in their language, with a reason they can repeat to the seller instead of a bare score.

What it does

You forward Bharosa whatever the seller sent: the chat text, a screenshot, a link or a voice note, on WhatsApp or the web. A few seconds later you get one of three answers:

  • 🔴 Don't pay
  • 🟡 Be careful
  • 🟢 Looks safe

Each comes with one plain sentence in the language you wrote in (English, Urdu, Roman Urdu or Arabic). Reply WHY to see every piece of evidence.

The checks behind it:

  • the price compared with the usual market price
  • how they want to be paid (crypto, gift cards and "friends and family" are red flags)
  • crypto wallet addresses pasted into the chat
  • websites pretending to be a known brand, like apple-store-pk.shop
  • how old the website's domain is, and whether Google Safe Browsing flags it
  • requests for money upfront, and pressure lines like "3 people are waiting"
  • how many people have already reported this seller

Green and yellow verdicts get a PayPal checkout for the exact price. If the seller gave a PayPal email, the money goes straight to them and the buyer keeps PayPal buyer protection. A red verdict never gets a pay link.

Reply REPORT to warn the next buyer. If someone later opens a PayPal dispute on a Bharosa payment, that counts as a report against the seller too.

Every check, report and payment goes into a hash chain, and the newest link is stamped on Bitcoin every day. The public /proof page lets anyone confirm nothing was edited or deleted.

How I built it

  • App: Next.js 14 and TypeScript, deployed on Vercel.
  • AI: Gemini (free tier) reads screenshots, transcribes voice notes, pulls out the price, payment method, links and phone numbers, and writes the one-line explanation. It never picks the color. Fixed rules do that: any danger signal means red, two warnings mean yellow. That keeps every verdict repeatable, and the model can't talk itself into "safe".
  • PayPal: the Orders v2 API creates the checkout, with the seller as payee when they gave a PayPal email. Webhooks track captures, refunds and disputes, and every webhook is confirmed through PayPal's verify-signature API before Bharosa acts on it.
  • WhatsApp: a Twilio webhook, with every request's signature checked.
  • Data: Supabase Postgres with row-level security. Phone numbers and handles are stored only as salted HMAC fingerprints, so the report network can count reports without keeping anyone's number.
  • Tamper-evident record: each entry is

$$h_n = \mathrm{SHA256}(h_{n-1} \,|\, n \,|\, \text{kind} \,|\, \mathrm{SHA256}(\text{payload}) \,|\, t_n)$$

A Postgres function appends entries under a lock, and a trigger blocks edits and deletes. Once a day the newest $h_n$ is stamped on Bitcoin through OpenTimestamps, which covers everything before it.

The web page and WhatsApp call the same check function. With no API keys at all it still runs on rules alone, so the demo can't fully break.

Challenges I ran into

  • Currencies: money in these chats is mostly PKR, AED or SAR, and PayPal doesn't accept PKR. Those prices are converted to USD for the checkout, and the buyer sees the conversion.
  • Roman Urdu: Urdu script is easy to detect from its letters, but "pehle advance bhejo" looks like English to most language detectors. I combined a word list with the AI's own reading, and wrote reply templates in all four languages, so answers stay correct even when the AI is down.
  • Twilio's 15-second limit: Twilio gives up on a webhook after 15 seconds, and reading a screenshot can take longer. Slow checks reply "checking..." straight away and send the verdict as a follow-up message.
  • PayPal webhook verification: PayPal checks the event exactly as it was sent. Parsing the JSON and re-encoding it can change number formats and break the check on a genuine event, so Bharosa passes the raw text through untouched.
  • OpenTimestamps by hand: building the proof files meant matching the format byte for byte. I checked every file Bharosa makes against the official OpenTimestamps library.

What I learned

People trust an answer that shows its evidence far more than one that just gives a score. Showing "domain registered 4 days ago" does more than any confidence percentage, so I kept every reason specific. I also learned to keep the AI's job narrow: let it read and explain, but make the decision with rules anyone can read in the code.

What's next

  • An official WhatsApp Business number, so nobody has to join a sandbox
  • Checking Instagram and OLX seller profiles straight from a link
  • A trusted-seller badge for sellers who take PayPal and have no reports
  • Letting a seller's first reply be a protected PayPal checkout instead of a bank account number

Built With

Share this project:

Updates

Submission history