Groundtruth

Inspiration

Job scam losses reported to the FTC rose from $90M in 2020 to $501M in 2024. One in four people who job-hunted in 2025 reported being scammed. But the sharpest version of this harm hits international students on F-1/OPT: consultancies charge them up to $2,000 for fabricated work experience letters, collect from dozens of students, and vanish — one operator alone faked employment verification for 2,500+ F-1 students. The damage is deferred and often irreversible: a student can be detained or removed years later, sometimes never having known the record filed on their behalf was false.

Every existing anti-scam approach we looked at asks the same question: "was this written by AI?" We think that's the wrong question. It's unanswerable, it gets harder every month as models improve, and it systematically penalizes non-native English writers — punishing exactly the people this problem hurts most.

So we flipped it. We ask: is any of this actually checkable? A model can write a flawless scam email in four seconds. It cannot make a domain older than it is, forge a signature it doesn't hold the key for, or publish a job on a company's real careers page. Fabrication is cheap. Corroboration is expensive. That asymmetry became the whole product.

What it does

A job seeker pastes in recruiter outreach — sender address, message, optionally an offer-letter PDF or a signed verification code — and gets back a cited, tiered account of what is and isn't verifiable, never a verdict. Six independent checks:

• Sender impersonation — homoglyph folding, typosquat/combosquat detection, punycode/IDN spoofing, brand-in-subdomain ("company.com.hiring-portal.xyz" is controlled by hiring-portal.xyz, not the company)
• Predatory practices — three strictly separated tiers: not lawful to ask (candidate fees, shifted H-1B costs, fabricated records), puts you at risk (PII before an offer, unpaid "bench," untraceable payment), worth knowing
• Employer corroboration (Tavily) — does the company exist, and what's its real domain
• Document integrity — hidden text, Unicode Tag-block smuggling, bidi tricks, and offer-letter tampering (font-mismatch forensics)
• Careers-page listing (Solari) — is the role actually posted where the company posts roles
• Signed attestation — Ed25519 signatures, anchored to the employer's own domain, never to us

Every run is traced to PRISM end to end, so "why was this flagged" stays answerable.

How we built it

Deliberately deterministic — no LLM anywhere in the verification path. Every verdict is reproducible down to the bytes, which matters in a domain where a false negative can carry a visa consequence years later. The core idea threading every check: severity is a function of evidence layer, not wording — "ignore all previous instructions" is CRITICAL hidden in 1pt white text on a PDF and INFO in a security engineer's visible bullet point describing their job. Same string, opposite verdict, because concealment establishes intent and wording alone never does.

The framing itself changed twice before we landed here: a generic "hiring trust" tool was too broad to demo, and an employer-side pitch (sell trust tooling to staffing agencies) was rejected on reflection — agencies are frequently the threat in this space, not the customer. Candidate-side, protecting the people who can't pay for protection, is the one nobody else builds for.

Challenges we ran into

Building detectors that don't cry wolf turned out to be harder than building ones that catch attacks. Early versions flagged a resume written in Russian, an Arabic name with bidi marks, and a security engineer's bullet point about prompt-injection defense — all false positives from naive keyword matching. Every detector now ships with a benign control that must come back clean, treated as a release gate, not a nice-to-have.

We also found real bugs by attacking our own feature: a scammer replaying someone else's genuinely valid signed attestation from an unrelated domain initially got read back as "cryptographically signed by Datadog" — the trust signal laundering a scam. Binding a signature to the sender's domain, not just verifying it cryptographically, fixed it. Other bugs included Severity silently inheriting Python's alphabetical string ordering (so CRITICAL >= MEDIUM evaluated False), and a per-line font-consistency check that let a 14-character forged name outvote the five honest characters around it, flagging the word "Dear," in a tampered offer letter instead of the actual forgery.

Our dev sandbox's egress policy blocks all three sponsor APIs outright (403 on CONNECT), so the whole system had to run correctly offline via cassettes and local fixtures, then get separately live-verified on a machine with real network access — which forced an "absence of evidence is never evidence" discipline into the architecture itself: every offline path raises rather than silently returning a clean result.

Accomplishments we're proud of

153 tests passing, all three sponsor integrations live-verified end to end, and a demo beat we're genuinely proud of: the same cryptographically valid signature, attached by two different senders, returns opposite verdicts — proof the trust model can't be laundered.

What we learned

That "verification, not detection" isn't just a tagline — it's a design discipline that has to be enforced at every layer, from regex severity resolution up through how a UI checklist renders a tick. We also learned, the hard way, that a tool which never shows a true negative isn't trustworthy — the "ordinary recruiter, comes back clean" case did more for our own confidence in the system than any attack case did.

What's next

Replace hand-written Tavily cassettes with real recorded traffic; add claim extraction from resume text as the first legitimate use of an LLM in the system (fully traced, never disguised as the deterministic engine); and build the institutional layer — accounts, per-institution quotas, and a usage dashboard — for the business model we've settled on: sell to universities, international-student offices, and immigration law firms as compliance tooling, with the tool staying free for candidates, permanently.

Built With

• chromium
• cryptography
• css3
• ed25519
• fastapi
• html5
• httpx
• javascript
• playwright
• prism
• prismtrace
• pydantic
• pymupdf
• pytest
• python
• regex
• rest-api
• solari
• solari-browser
• tavily
• tavily-api
• unicode
• uvicorn
• vercel