Catfish - Training Against Romance Scams

Spot the warning signs: Look for rushed intimacy, pressure to leave the app, and excuses to avoid a video call.
Make your call: Identify each match and decide whether to unmatch, report, or send fictional money.
Set your matches: Choose your preferences and meet three fictional matches hiding very different intentions.
Reveal and learn: Discover who was behind each conversation and review the warning signs you caught—or missed.
A teammate plays the real human from a second device, bringing unscripted conversation into the challenge.

Inspiration

Romance scams cost Americans $1.14 billion in reported losses in 2023, with a median loss of $2,000 per person — the highest of any imposter scam the FTC tracks. The playbook is well documented: move you off the app, never be able to meet, build urgency, then ask for gift cards or a crypto "opportunity." Everyone has been told the red flags. Almost nobody has practiced spotting them while someone charming is texting them.

We wanted a safe place to get scammed: lose fake money, see exactly where you missed it, and try again.

What it does

Catfish is a five-minute, adults-only dating-safety game. You match with three fictional people and chat with all three at once:

One is a human: a friend or judge who scans a QR code and plays from their own phone. If nobody joins, the game says clearly that the human is simulated.
One is a bot: instant, generic replies, a Snapchat handle, and an "are you verified?" link.
One is a long-con scammer: warm, patient, always working abroad, camera "broken," then a secret crypto opportunity and an emergency that only $500 in gift cards can fix.

The round jumps through Day 1, 3, 7 and 14, compressing a months-long con into a few minutes. You can flag any message you find suspicious. Links open a contained "you just got phished" lesson instead of anything real, and the scammer sends voice notes on days 7 and 14.

Then you commit: label each match Human, Bot or Scammer, and choose Unmatch, Report or Send (fictional) money. The debrief reveals the truth and shows every red flag on the message where it appeared, which ones you caught, which you missed, and what the human did differently.

Scoring rewards judgment, not paranoia: 100 points per correct identification, +10 for each red flag you caught before the first money request, and −100 for each time you sent money to a fake.

A host view lets an audience follow the round on a big screen.

How we built it

Frontend: React 19 + Vite + TypeScript, mobile-first at 375 px, with a three-column chat view on laptops, QR invites, keyboard support and reduced-motion handling.
Game server: the server owns the secret roles, day progression, scoring and fake-money actions, so the browser can't peek at who's who. Player, human and host each get their own capability token.
Red-flag tagger: deterministic rules tag every message against 12 signals (off-app requests, links, verification lures, love-bombing, can't-meet excuses, crises, money requests, crypto, secrecy and more). No LLM decides what counts as evidence.
AI personas (live mode): OpenAI writes the human and bot replies; xAI's Grok (grok-4.3) plays the scammer. ElevenLabs generates the scammer's voice notes. Every call falls back to a scripted reply if a provider fails.
Scripted demo mode: a fully deterministic round with bundled ElevenLabs audio, so judging never depends on API latency.
Deployment: Vercel, with Upstash Redis holding room state and the client polling every 2.5 s. Locally it runs over WebSockets.
Portraits: nine fictional adults generated with OpenAI image generation. Roles shuffle independently of appearance, so no face or gender "looks like" the scammer.
We built it in Cursor with Grok 4.7 (plus OpenAI Codex agents) and verified every flow in headless Chromium at desktop and phone sizes. 20 automated tests cover scoring, role leakage, transport, persistence, auth and provider fallbacks.

Challenges we ran into

Serverless has no shared memory. Vercel functions can't hold a live game room, so we moved rooms into Redis with two-hour expiry, per-room locks and rate limits so two players acting at once can't corrupt the state.
Keeping it safe without making it fake. The scammer has to feel real, but the game never asks for real contact or payment details, never shows explicit content, and every link is intercepted.
Making the human feel human. A real person's typos and slow replies can look "suspicious," so the debrief is careful to say timing alone proves nothing.
Smaller fires: a portrait rendering bug that only appeared in production, typing indicators disappearing during polling, and an expired API key mid-build.

Accomplishments that we're proud of

It's live and playable at catfish-eight.vercel.app, with a full player, human and host round verified on the production URL.
Scripted mode means the demo works even if every AI provider goes down.
[PLAYTEST RESULT, e.g. "X of Y players sent money to the scammer."]
[e.g. "Our real human got voted 'bot' N times."]

What we learned

The signals that actually matter are behaviors, not writing style: pressure, secrecy, deceptive links, refusing to verify, and asking for money. Fast replies or typos don't prove anything by themselves.
A game needs a truthful "no": the human can say no and suggest a public first date, which makes the contrast with the scammer land.
[ONE THING WE LEARNED ABOUT GROK / ELEVENLABS / REAL-TIME APPS]

What's next for Catfish

More scam scripts: sextortion awareness, fake job offers, "wrong number" openers.
Versions for classrooms and for older adults.
Working with fraud-prevention groups to keep the scripts current.

Prior work

Human or Not: guess human vs. AI in one anonymous chat. Catfish runs three matches at once inside a dating app, with scams and a debrief.
ScamPilot (research): you advise a simulated victim. In Catfish, you're the target.
Scripted scam-awareness walkthroughs: ours is interactive and has a real human hiding among the fakes.

Safety and ethics

18+ only. Fictional profiles, AI-generated faces (never real people's photos), simulated money and intercepted links. No photo uploads, no real payments, and no real contact details. Scammers are portrayed as organized fraud, not as any gender or stereotype. It's a learning game, not a detector for real accounts.