Kavach

backdrop
logo

💡 Inspiration

Most of us on this team come from immigrant families, and we've all seen some version of this text:

"USCIS: Your case will be cancelled in 24 hours. Pay the processing fee now."

Our parents aren't careless people. They're just scared when a message like that shows up. And that's exactly what the scam is counting on.

These scams go after people who can't easily check if they're real: parents still learning English, grandparents, anyone who doesn't know that USCIS will never call demanding a gift card. And it's getting worse:

Government-impersonation complaints to the FBI nearly doubled from 2024 to 2025 (17,367 → 32,424)
Losses jumped from $406M to $798M
Immigration scam reports to the FTC doubled too

When we looked at existing tools, almost all of them were English-only. Most also need you to already suspect something, and then they send your private messages to a server somewhere.

So we built the thing we wished our parents had.

🛡️ What it does

Kavach (Hindi for armor) sits quietly in Chrome and does nothing. Until it sees something like:

"Your visa has been revoked. Pay the fine immediately to avoid deportation."

Then a small popup slides in, kind of like Honey does for coupons:

⚠️ This message has signs of a scam.

You get two choices.

🔍 Investigate

A Nemotron agent goes to work. It decides which checks it needs, then runs them:

Is this case number even in a valid format?
Does USCIS ever contact people this way?
Is uscis-gov.help pretending to be uscis.gov?
What does official guidance actually say?

Every step ticks off on a live checklist, so you see why it reached its answer instead of just being told what to think.

🎙️ Talk to Kavach

Or just talk to it. In Spanish, Hindi, Mandarin, whatever you're most comfortable in.

The first thing Kavach does is slow you down:

"Take a breath. USCIS doesn't ask for payment over the phone. You have time."

Then it asks if you want it to check the message, and walks you through the investigation out loud while it runs.

Every screen says "Speak in your language." Tap the ⓘ to see every language it supports.

The verdict

Result	What it means
🔴 Highly likely scam	Multiple strong red flags
🟠 Likely scam	Clear warning signs
🟡 Unsure	Not enough to call it, so check before acting
🟢 Unlikely	No major red flags, but still check through the official channel

There's no "Safe" option. On purpose. We'll never tell someone to ignore a message, only to check it the right way.

If it's Likely or worse

🎙️ Talk to Kavach. If the result just made your heart rate spike, the voice agent is one tap away to explain it calmly.
👨‍👩‍👧 Tell someone you trust. A ready-made message goes to the family member you picked during setup: "I got this, Kavach thinks it's a scam, can you look before I do anything?" Scammers want you to decide alone, and this makes sure you don't.
📝 Report it to the FTC. We write the summary and open ReportFraud.ftc.gov for you.
☎️ Get the real number. Official contacts come from our verified directory, pulled straight from the agencies' own websites. The AI never makes these up.

🔧 How we built it

The extension. Manifest V3, plain JavaScript. A content script watches pages, a popup handles the first alert, and a side panel holds the investigation and voice chat.

Detection on your device. Rule-based scam signals plus Chrome's built-in Language Detector and Translator APIs. Turn off your Wi-Fi and it still works. Page content never leaves your browser unless you tap a button.

The investigation agent. An agent loop on NVIDIA Nemotron via NIM with tool calling. Nemotron plans, the extension runs the tools and passes results back, and Nemotron makes the final call. Nemotron VL reads screenshots.

Voice. Built on the Gemini Live API, with one hard rule:

Gemini is the voice. Nemotron is the brain.

When you ask the voice agent to investigate, it triggers the same Nemotron loop through function calling and reads each result back as it arrives. It never makes up facts of its own.

Privacy. This is the part we argued about most. Before anything touches the cloud, we swap out personal details for placeholders:

Receipt number  →  [RECEIPT_1]
A-number        →  [A_NUMBER_1]
Phone           →  [PHONE_1]

Nemotron can still say "validate [RECEIPT_1]" and our local tool checks the real value, which never leaves your machine. The voice agent only ever gets the redacted summary.

The rest.

A small Node/Express proxy keeps API keys out of the extension
Official contacts and guidance pulled from USCIS, IRS, FTC and ICE sites, each tagged with its source
Four of us built it in parallel with Claude Code, working from one shared product spec and agreed data formats so nobody broke anybody else's piece

🧗 Challenges we ran into

Tool calling was flaky at first. Nemotron would sometimes skip a check or call one with missing arguments. We tightened the tool schemas and added a validation step before anything runs.

False alarms almost killed passive detection. Real USCIS emails also talk about cases and deadlines. We had to focus on what actually separates scams (payment demands, gift cards, threats, weird domains) instead of flagging every scary-sounding word.

The voice agent kept trying to be too helpful. Early versions improvised advice. Locking it to Nemotron's findings and our verified directory fixed that.

Designing for panic is different. Someone who's terrified and reading in their second language doesn't want paragraphs. Fewer words, bigger buttons, no jargon. We cut the UI in half. Twice.

🏆 Accomplishments that we're proud of

📴 Pull the Wi-Fi plug and it still catches the scam.
🗣️ Hearing a Spanish voice conversation take someone from "oh no" to "okay, I know what to do". That's when it felt real.
✅ The live checklist. People trust the answer more when they can see the work.
🤝 Four people, one weekend, zero merge disasters. Somehow.

📚 What we learned

The easiest way to catch a fake agency is to know how the real one behaves. USCIS doesn't take gift cards. The IRS doesn't threaten arrest by text. Check what real agencies never do, and most scams fall apart.

On-device AI is way more capable than we expected. You don't have to give up privacy to get good features.

Supporting many languages is hard, just not in the way we thought. Translating the words is easy. Sounding calm and kind to someone who's panicking, in a language that isn't English? That's the hard part.

🚀 What's next for Kavach

📱 Phones. Most of these scams arrive by text message and WhatsApp, not Chrome. The same setup (local detection, a Nemotron agent, a calm voice) works on Android.
📡 Carrier integration. T-Mobile could build Kavach into its existing scam protection, and the family alert fits naturally with family plans: it goes to people already on your plan.
🌍 More languages. Vietnamese, Tagalog, Arabic, Korean, Portuguese.
🚩 Anonymous community reporting. New scam scripts get caught faster.
🤲 Nonprofit partnerships. We want to get Kavach to new immigrants through the organizations that already help them, and test it on real non-English scam messages.