KinCheck

Don't just trust the message. Verify the action.

Comment

Inspiration

Fraud often begins with a familiar message: "I've changed my number. I urgently need money."

But recognising suspicious language is only half the problem. The real question is whether the person behind a request has actually authorised the action.

KinCheck was inspired by one principle: Don't just trust the message. Verify the action.

What it does

KinCheck demonstrates two complementary security mechanisms.

1. Relationship-aware risk detection

The application establishes a basic communication fingerprint and evaluates new messages for unusual greetings, changed contact details, urgency and financial requests.

Rather than claiming to identify a scammer, KinCheck explains the warning signs.

2. Trust Before Action

A simulated trusted device cryptographically signs an exact verification request.

The demonstration shows:

  • VERIFIED: The original £20 request is successfully verified.
  • REJECTED: Changing £20 to £800 invalidates the signature.
  • REJECTED: Changing the recipient invalidates the signature.
  • REJECTED: Reusing an accepted proof triggers replay protection.

The suspicious-message example and the £20 transaction are separate synthetic demonstrations.

How we built it

We built KinCheck using:

  • Vite, HTML, CSS and vanilla JavaScript for the frontend.
  • Node.js and Express for the backend.
  • Web Crypto API for ECDSA P-256 signatures with SHA-256.
  • Google Gemini for optional AI-assisted functionality.
  • Deterministic rules for explainable message-risk scoring.
  • Automated security tests for verification and tampering scenarios.

Cryptographic verification operates independently of AI.

Challenges we ran into

Separating suspicion from proof: A suspicious message is not definitive evidence of fraud.

Making cryptography understandable: We built an interactive comparison between the original signed request and a modified payload.

Preventing replay attacks: We implemented expiration checks, request identifiers, nonces and replay detection.

Maintaining security boundaries: AI-assisted interpretation cannot override failed cryptographic verification.

Working within the deadline: We prioritised a small, demonstrable and testable prototype.

Accomplishments that we're proud of

  • Implemented real ECDSA P-256 digital signatures.
  • Built exact-request cryptographic verification.
  • Demonstrated amount, recipient and action tampering rejection.
  • Implemented expiration and replay protection.
  • Passed 12 out of 12 automated security tests.
  • Created explainable relationship-aware risk detection.
  • Completed an interactive end-to-end security demonstration.

Our biggest achievement is demonstrating that a convincing message and valid authorisation are fundamentally different things.

What we learned

Fraud detection and action authorisation solve different problems.

A risk assessment helps identify reasons for suspicion. A digital signature establishes whether a particular request matches the data that was signed.

We also learned that security decisions benefit from deterministic verification rather than relying on generative AI.

AI proposes. Cryptography proves. Deterministic rules decide.

What's next for KinCheck

  • Genuine cross-device verification.
  • Secure device enrolment and key management.
  • Stronger authentication and account recovery.
  • Persistent verification records and audit trails.
  • Messaging and payment platform integrations.
  • Accessibility improvements and user testing.
  • Independent security review.

KinCheck is a proof of concept. The trusted device is currently simulated locally, and no actual payments are processed.

Our long-term goal is to make exact-action verification a reusable security layer for sensitive digital interactions.

If the request changes, the proof fails.

Built With

Share this project:

Updates

Submission history