Detective Crab

• 

  Logo

• 

• 

• 

• 

• 

• 

Inspiration

We were inspired by a teammate with a cognitive disability who was scammed over the phone by someone pretending to be from his bank. Watching how easily that happened, even to someone who trusted the process completely, made the problem personal for us. It also showed us something important: the person on the other end of a scam call often has no way of knowing whether they should trust it or not, and by the time anyone realizes something is wrong, the money is already gone.

That experience is what pushed us past the usual fraud detection idea and into something broader. We started asking what a bank could do differently in the exact moment a transaction looks strange, instead of just reacting after the fact. We also looked into the idea of a reverse PIN as a silent alarm, only to find out it was a well known concept from the 1990s that banks rejected because it did not actually work under real stress. That failure shaped a lot of how we designed our own version.

What it does

Detective Crab has two main functions. The first is voice verification. Every transaction is compared against the normal behavior of that specific account, looking at transfer speed, merchant category, and unusual timing or destination. If enough of these signals look off, the transaction is paused and a phone call is triggered, powered by AI, that asks simple context questions and evaluates whether the answers sound clear or confused. If the person cannot speak at that moment, the system falls back to text, and if things are still unclear it escalates to a real human, never to another bot.

The second function is a duress PIN. This is a separate code the user sets up ahead of time, different from their real PIN. If they are ever forced to withdraw or transfer money, entering that code quietly triggers an alarm, blocks the transfer, and notifies the police, while the screen or receipt simply shows transaction failed, so whoever is forcing them never finds out.

How we built it

The backend is built entirely in Python using FastAPI, which let us connect everything cleanly, from data validation with Pydantic models to the AI services and both databases. We deployed everything on Vultr during the hackathon since we needed something fast to set up with the clock running.

FastAPI is the coordinator. When an anomaly is detected, it calls Google Gemini to generate context questions specific to whatever signal triggered the alert, and to evaluate how clear or confused the response sounds. ElevenLabs handles the actual voice of the call, since we wanted it to sound like a real conversation instead of a robotic bank menu.

For storage we used two different databases on purpose. MongoDB Atlas handles everything operational, users, transactions, and verification status, since that data changes constantly and needs to be read and written fast. Snowflake is used separately, only for auditing, so every blocked transaction or triggered alarm gets logged there permanently without slowing down the live app.

Challenges we ran into

The biggest challenge was making sure we protected vulnerable users without ever profiling them. Our first instinct was to add special rules based on age or condition, and we realized quickly that this could create real discrimination risk, so we redesigned the system to treat every account the same way and let protection come from good detection, not from labeling people.

The duress PIN also took a wrong turn before it worked. We started with the reverse PIN idea before learning it had already failed in practice decades ago, so we rebuilt it as an independent code instead of something the victim has to calculate under pressure.

Designing for accessibility from the start was harder than expected too, since a voice first system does not work for everyone, which is part of why the text fallback and human escalation exist as core paths, not afterthoughts.

Accomplishments that we're proud of

We are proud that the duress PIN actually fixes the two real reasons the original idea failed instead of just repeating it. We are also proud that our fraud detection protects vulnerable people without ever needing to know who they are. And we managed to get a full working pipeline running in under 36 hours, from anomaly detection to a live AI phone call to human escalation, not just a slide describing the idea.

What we learned

We learned that the strongest version of an idea often comes from understanding why an earlier version failed, not from starting from scratch. We also learned that real protection does not come from singling people out, it comes from building a system that treats everyone fairly and catches the right signals anyway.

What's next for Detective Crab

We want to bring the duress PIN to physical ATMs, not just the app, so the same protection works in person during an assault or a coerced withdrawal. We also want to move from a rules based scoring system to a trained model once we have enough real data to validate it safely, add a sign language verification option for Deaf users, and eventually integrate directly into an existing bank's risk infrastructure instead of running as a standalone system.

Built With

• .tech
• elevenlabs
• gemini-api
• mongodb-altas
• python
• snowflake-api
• vultr