Hoax Hunter

Learn to spot scams by playing. Check real ones with AI.

Comment

Inspiration

Scams are getting harder to spot, and young people are often the ones hit by them: fake job offers that ask for a fee, fake scholarships, a "parcel is held" text, a friend whose account was hacked, a boss who suddenly needs gift cards. A one-time lesson on "how to spot phishing" does not stick, and when a scary message actually arrives, most people have nobody to ask. I wanted to build both halves of the answer: a way to practice before a scam arrives, and a tool that helps when one does.

What it does

Hoax Hunter is a browser game and a scam checker in one. Four game modes train your instincts against AI-written scams:

  • Inbox Defender: ten messages arrive on a fake phone. Trust, Verify or Report each one. Every round mixes clear scams, safe messages, and unclear ones where verifying is the right move.
  • Scammer Chat: chat live with one of 8 AI scammers who adapt to what you say and keep raising the pressure. An AI judge decides whether you refused, verified, or gave in.
  • Detective: tap the exact words that give a scam away before the timer runs out.
  • Boss Fights: four scam masters with three phases each (sort their messages under a special rule, strike their red flags, win a live chat duel), one health bar, shared hearts. The Scam Helper works on real messages. Paste a message or link, or drop in a screenshot, and get a 0-100 risk score, the exact warning signs, a likely scam type, and clear next steps. The Scam Dex is a collection of 13 scam types. Cards unlock as you meet scams in the games or the Helper finds them in messages you check. It tracks which scams fool you, shows your weak spots, and a Practice button starts a round made only of that scam type. Accounts are required, and progress, Scam Dex and bosses belong to each account.

How we built it

Next.js 16 (App Router), TypeScript and Tailwind CSS v4, deployed on Vercel. Supabase handles email login. Google's Gemini API powers all the AI, and every sound in the game is synthesized in the browser with the Web Audio API. The AI is designed, not just prompted:

  • Round generation: the model is told the game's own scam knowledge (13 scam types, 12 red flags) and the exact mix it must write, and must answer in a strict JSON schema. Code validates every message and discards bad ones (invalid scam types, safe messages with flags, Detective clue phrases that do not really appear in the text). Gaps are filled from hand-written scenarios, and the server enforces the mix.
  • Scammer Chat: one request makes the AI play two roles, the scammer and the judge. Player text is treated as untrusted: the judge ignores attempts to manipulate it, and the turn limit is enforced on the server. Every chat opens with a freshly written message and a hidden backstory.
  • Scam Helper, a hybrid: my own rule engine (19 wording patterns, link analysis, signs of a normal message like "never share this code") scores the message in plain code. The AI scores it too, seeing the rule findings and the best-matching scam patterns from the game's knowledge base. The two are blended 40/60, with a safety rule so a result is never shown as "low risk" if either half is alarmed. If the AI is slow or down, the Helper still answers from the rules alone.
  • Adaptive practice: the Scam Dex records every scam you catch or fall for and feeds the practice rounds.

Challenges we ran into

  • The free AI tier is unreliable. During testing the bigger models returned errors or hung for over a minute. I measured each model, put the fastest reliable one first, added a timeout per model and a total time budget, and gave every AI feature a fallback.
  • Making AI output trustworthy. Every AI answer goes through strict schemas and validation, and the chat judge is hardened against players trying to trick it.
  • Keeping it fun and safe. All scam content is fictional, with no real brands or phone numbers, and the games never ask for real personal information.
  • Fitting everything on one screen. Every screen fits the window without scrolling, which took careful layout work. I measured the Scam Helper on a labeled test set of 40 messages (20 scams, 20 safe, 13 of them hard: real-looking bank and code messages, and convincing scams). The test set and script are in the repo (eval/). | Method | Accuracy | Scams caught | False alarms | |---|---|---|---| | Rules only | 92.5% | 85% | 0% | | AI only | 100% | 100% | 0% | | Hybrid (what the app uses) | 100% | 100% | 0% | The test set is small and I wrote it myself, so this shows the approach works, not that it is perfect on every real scam. I also tuned a few rules after seeing the rules-only results on the same set. After building it, I tested 15 fresh messages and found and fixed one weakness (a "wrong number" scam with no keywords was scored low).

Accomplishments that we're proud of

  • A complete product built solo in a few days: four game modes, a real-world checker, a collection system and accounts, all live.
  • A measured result, not just a demo: an evaluation I can rerun with one command.
  • It keeps working when the AI does not, and I tested that for real.

What we learned

How to make AI features reliable (schemas, validation, fallbacks, time budgets), that testing your own tool on fresh inputs finds flaws your test set hides, and that the blend of simple rules and an AI model can be both explainable and accurate.

What's next for Hoax Hunter

Saving progress to the account so it follows you across devices, a leaderboard, more languages and scam types, and a fact-checking mode with web search. The Helper checks for scams and manipulation, not whether news is true.

Built With

  • google-gemini-api
  • next.js
  • react
  • supabase
  • tailwindcss
  • typescript
  • vercel
  • web-audio-api
Share this project:

Updates

Submission history