LUCID

LUCID is an AI agent that can recognize screenshots/text for cognitive risk assessment to prevent fraud.

Comment

LUCID — Cognitive Triage Agent for Scam Prevention

Live Demo: https://lucid-cognitive-triage-agent-220940600627.us-central1.run.app

Inspiration

Scams often succeed before money is transferred.

They succeed at the moment a person is isolated, frightened, rushed, ashamed, confused, or made to feel that asking for help is dangerous. In many scam cases, the victim does not lose money because they cannot read a warning sign. They lose money because the scammer successfully controls the victim’s decision-making environment.

This is the problem LUCID is built to address.

Most anti-scam tools focus on technical indicators such as suspicious URLs, phishing websites, fake domains, dangerous attachments, or known scam keywords. These are important, but they only explain part of the problem. Many modern scams are not just technical attacks. They are cognitive pressure systems.

By analyzing local trends, we observed how scammers adapt their psychological tactics across multiple languages and platforms:

  • A fake police or LHDN (Inland Revenue Board of Malaysia) tax audit scam creates sudden legal fear.
  • A fake embassy or MySejahtera data-verification scam creates immense authority pressure.
  • A fake Shopee or Lazada part-time job/refund scam creates artificial financial urgency.
  • A WhatsApp or Telegram account-takeover scam leverages social proof and panic.
  • A crypto investment scam creates reward pressure and fear of missing out (FOMO).

In all of these cases, the scam is not only in the message. The scam is in the pressure sequence.

LUCID was inspired by this gap. Instead of only asking, “Is this message a scam?”, LUCID asks a deeper question:

“Is this situation manipulating the user into making an unsafe decision?”

LUCID is built for the fragile moment before the irreversible action happens — before a user clicks a suspicious link, shares a verification code, transfers money, reveals private information, or follows instructions from a fake authority figure.

Its purpose is not only to detect scams. Its purpose is to help users pause, understand the pressure, and regain enough clarity to verify safely.

What it does

LUCID is a cognitive triage agent for digital safety.

Users can submit suspicious evidence such as:

  • Screenshots
  • Suspicious URLs
  • Pasted chat messages
  • Call transcripts
  • Reward pages
  • Verification requests
  • Payment instructions
  • Investment messages
  • Fake customer-service conversations

LUCID analyzes the submitted evidence and identifies both technical and psychological risk signals. These include fear, urgency, authority impersonation, isolation, suspicious links, fake rewards, sensitive-data requests, verification-code pressure, payment pressure, and attempts to stop the user from seeking outside help.

However, LUCID does not reduce the case into a simple “scam” or “not scam” answer.

That binary approach is often too weak for real scam situations. Real scams are progressive. They may begin with a normal-looking message, then gradually add pressure, urgency, authority, and financial requests. A single message may look harmless, but the sequence may be dangerous.

Therefore, LUCID uses a four-level cognitive triage system:

  • Green — Low risk; normal or harmless communication.
  • Yellow — Some suspicious elements; user should verify carefully.
  • Orange — Strong manipulation signals; user should stop and confirm through trusted channels.
  • Red — High-risk scam indicators; user should not pay, click, reply, or share sensitive information.

This triage model is one of LUCID’s core design decisions. It is inspired by the idea that users under pressure do not only need a label. They need a risk level, a reason, and a safe next step.

For each submitted case, LUCID generates:

  • A clear risk level
  • Detected manipulation tactics
  • Explanation of what increased the risk
  • Similar anonymized scam patterns retrieved from MongoDB Pattern Memory
  • Practical safety actions
  • Verification steps
  • Safe reply suggestions
  • Evidence summaries
  • Shareable reports for family members, banks, schools, NGOs, or support organizations

For example, instead of simply saying, “This looks like a scam,” LUCID can explain:

“This case is high risk because it combines authority impersonation, urgency, isolation, and sensitive-data pressure. The safest next step is not to reply directly, not to click the link, and to verify through the official website or phone number you find independently.”

This makes LUCID more useful in real life because it turns a confusing and stressful situation into structured, calm, and actionable guidance.

Core Innovation

LUCID’s innovation is not simply detecting scam content.

Its innovation is detecting scam pressure.

Many scam tools analyze whether a URL, number, or message is suspicious. LUCID goes further by analyzing how the situation is trying to shape the user’s behavior.

The key innovation is the combination of:

  1. Gemini multimodal analysis
  2. MongoDB Pattern Memory
  3. Four-level cognitive triage
  4. User-controlled safety actions
  5. Privacy-conscious memory design

Together, these turn LUCID from a basic scam detector into an agentic decision-support system.

LUCID does not only ask:

“Does this message contain a scam keyword?”

It asks:

“Does this evidence match a known manipulation pattern, and is the user being pressured toward an unsafe action?”

This matters because many scams are successful precisely because they do not look dangerous at the beginning. A scammer may first create trust, then introduce urgency, then isolate the victim, then ask for money or sensitive information. LUCID is designed to identify these behavioral sequences before the user reaches the final harmful step.

How we built it

LUCID is built as a Next.js and TypeScript web application and deployed on Google Cloud Run.

The system uses Gemini as the core multimodal reasoning engine. Gemini analyzes user-submitted evidence across different formats, including screenshots, text, URLs, and call transcripts. This is important because scam evidence is rarely limited to one clean text input. A user may only have a screenshot of a WhatsApp conversation, a suspicious refund page, a copied URL, or a rough call transcript.

Gemini helps LUCID extract:

  • Suspicious claims
  • Authority impersonation
  • Urgency signals
  • Fear-based language
  • Isolation attempts
  • Requests for payment
  • Requests for sensitive information
  • Inconsistencies in the message
  • Potentially unsafe next-step instructions

LUCID uses MongoDB Atlas as its Pattern Memory layer. This is a major part of the system design. Pattern Memory stores anonymized scam structures, not private original conversations. It allows LUCID to compare the current case with previously observed scam patterns.

This means LUCID does not rely only on keyword detection. It can reason from recurring scam structures.

For example:

  • Fake authority threat → urgency → isolation → payment demand
  • Fake refund message → suspicious link → banking information request
  • Fake account verification → code request → account takeover
  • Fake investment opportunity → reward pressure → deposit request
  • Fake customer support → trust-building → sensitive-data request

This makes LUCID more explainable because it can say not only what looks risky, but also why this pattern is dangerous.

Agent Workflow

LUCID was intentionally designed as a multi-stage agent workflow, not a single prompt response.

The workflow is:

  1. Perceive the evidence submitted by the user.
  2. Extract technical and psychological risk signals.
  3. Retrieve similar anonymized scam patterns from MongoDB Pattern Memory.
  4. Reason over both the current evidence and retrieved patterns.
  5. Assign a Green, Yellow, Orange, or Red cognitive triage level.
  6. Generate user-controlled safety actions, verification steps, safe replies, summaries, and reports.
  7. Optionally save an anonymized pattern only when the user explicitly confirms.

This separation is important.

If the system only sent the user’s message directly to a model and asked, “Is this a scam?”, the output would be less explainable and less reliable. Scam assessment often depends on combining multiple weak signals. One sign may not be enough, but several signs together can create a high-risk pattern.

For example, urgency alone may be normal. Authority alone may be normal. A link alone may be normal. But authority impersonation + urgency + isolation + payment pressure creates a very different risk profile.

By separating perception, retrieval, reasoning, and action generation, LUCID can produce more structured and safer outputs. This also makes the system easier to improve because each stage has a clear role.

Why Google Cloud and Gemini Matter

Google Cloud and Gemini are not only added for technical appearance. They directly support the core purpose of LUCID.

Gemini is essential because scam evidence is multimodal. A user may not have a clean text message to paste. They may have a screenshot, a suspicious website, a chat conversation, a copied URL, or a call transcript. Gemini allows LUCID to reason across these different evidence formats within one safety workflow.

This is especially important for real users because people under scam pressure will not always format their evidence properly. They may upload whatever they have. A useful anti-scam assistant must be able to understand messy, real-world evidence.

Google Cloud Run is essential because LUCID needs fast and accessible deployment. In a scam situation, the user needs immediate help. A local prototype is not enough. Cloud Run allows LUCID to be deployed as a live web application that users and judges can access directly through the demo link.

Cloud Run also fits the nature of the product because user submissions may be event-driven and unpredictable. The system needs a scalable deployment model that can handle requests without requiring the team to manage infrastructure manually.

Together, Gemini + Google Cloud Run allow LUCID to function as a real, accessible, AI-powered safety agent rather than just a static prototype.

Why Pattern Memory Matters

Pattern Memory is one of the strongest parts of LUCID.

Many scams follow repeatable structures. The exact wording changes, but the manipulation pattern often remains similar.

A fake police scam may use different names or phone numbers, but the structure is familiar:

authority → fear → urgency → isolation → payment or information request

A fake refund scam may use a different airline or platform, but the structure is familiar:

reward/refund → link → personal details → banking information

A WhatsApp takeover scam may use different wording, but the structure is familiar:

trust → verification request → code sharing → account loss

Pattern Memory allows LUCID to reason over these structures. It helps the system move from keyword matching to behavioral pattern reasoning.

This is important because scammers often adapt their language. If a system only looks for fixed keywords, it may fail when the scammer changes the wording. But if the system understands the underlying manipulation sequence, it can recognize risk even when the surface wording changes.

Pattern Memory also gives LUCID the potential to become stronger over time. With user permission, anonymized patterns can be saved and used to help future users identify similar risks earlier.

This turns LUCID from a one-session chatbot into a growing safety system.

Responsible AI and User Control

LUCID is agentic in reasoning, but conservative in action.

This is an intentional design choice.

In scam situations, AI systems must be careful. The wrong automated action could create harm, confusion, privacy risks, or false accusations. Therefore, LUCID does not automatically contact the sender, report the case, send replies, freeze accounts, block numbers, or make financial decisions.

Instead, LUCID supports the user by preparing safer options.

The user remains in control of every final action.

This boundary is important because LUCID is working in a high-stakes context involving money, identity, privacy, and emotional stress. The goal is not to replace human judgment. The goal is to protect the space needed for human judgment to return.

LUCID can say:

  • Do not click this link.
  • Verify through the official website.
  • Do not share the code.
  • Call the bank using the number on the official card or website.
  • Ask a trusted person to review this.
  • Save this evidence.
  • Use this safe reply if you choose to respond.

But the system does not act without the user.

This makes LUCID a responsible AI safety assistant rather than an uncontrolled automation tool.

Privacy and Safety Design

Privacy is a core design principle in LUCID because scam evidence may contain sensitive information.

LUCID only analyzes content that the user actively submits. It does not monitor private chats or automatically scan user accounts.

Pattern Memory is also designed carefully. If the user chooses to save a pattern, LUCID stores only an anonymized scam structure, not the original private content.

The saved memory does not include:

  • Original screenshots
  • Full private chat logs
  • Names
  • Phone numbers
  • Account numbers
  • Verification codes
  • Addresses
  • Personal identifiers
  • Sensitive financial details

This matters because an anti-scam system should not create a new privacy risk while trying to prevent another one.

In future versions, LUCID will add client-side privacy-preserving redaction, where sensitive information such as faces, phone numbers, account numbers, and credit card numbers can be masked before the data reaches the backend or model layer.

This supports a privacy-by-design approach.

Challenges we faced

One major challenge was avoiding over-alarm.

If LUCID labels every suspicious-looking message as dangerous, users may lose trust in the system. A useful safety agent must stay calm when the risk is low, but escalate clearly when multiple manipulation signals appear together.

Another challenge was making the output useful during panic.

When users are under scam pressure, they may not be ready to read long technical explanations. They need short, clear, structured guidance that helps them stop and verify. Therefore, LUCID’s output had to be designed around the user’s emotional state, not only around technical correctness.

A third challenge was designing the memory system responsibly.

Pattern Memory is valuable because it helps LUCID recognize recurring scam structures. However, saving user-submitted evidence without boundaries would be unsafe. We solved this by making pattern saving opt-in and anonymized. LUCID remembers the scam structure, not the user’s private data.

The final challenge was balancing agent capability with human control.

We wanted LUCID to behave like an intelligent agent, but not one that takes risky actions on behalf of the user. The result is a system that can analyze, retrieve, reason, and prepare actions, while still leaving final decisions to the user.

What we learned

We learned that scam prevention is not only a cybersecurity problem. It is also a human decision-making problem.

A scammer’s goal is not only to send a fake link. The goal is to control the user’s thoughts, emotions, timing, and sense of safety. This means an effective anti-scam system must detect not only technical danger, but also psychological manipulation.

We also learned that explainability matters. If LUCID only says “high risk,” the user may ignore it. But if LUCID explains that the risk comes from authority impersonation, urgency, isolation, and payment pressure, the user can understand the danger more clearly.

We also learned that agentic AI is most useful when it has boundaries. LUCID can support the user through perception, retrieval, reasoning, and action generation, but it should not remove human control in a high-stakes situation.

Finally, we learned that a strong hackathon prototype should not only show that AI can produce an answer. It should show that AI can be structured into a responsible workflow that solves a real human problem.

Impact

LUCID addresses a real and urgent problem: people are often scammed not because they are careless, but because they are placed under immense psychological pressure at the wrong moment.

LUCID gives users a pause button.

This pause can prevent a user from clicking a suspicious link, sharing a verification code, transferring money, revealing private information, or continuing a dangerous conversation.

Think Globally, Act Locally. While LUCID’s architecture is built to scale across global markets, its roots are deeply personal. Developed as a direct response to the massive wave of digital payment and social engineering scams targeting communities in Malaysia and Southeast Asia, LUCID provides an adaptive defense layer where generic anti-virus software fails.

By proving our cognitive triage model against the complex, multi-lingual scam tactics found in the Southeast Asian environment, we have built a resilient core technology that can easily scale to support vulnerable groups globally, including:

  • Elderly users targeted by localized authority scams (such as fake parcel delivery, banking alerts, or government impersonation)
  • International students and migrant workers navigating unfamiliar foreign administrative and legal procedures
  • First-time online banking users who are easily confused by official-looking interfaces
  • People facing language barriers or those who feel too ashamed or afraid to ask family members for help

LUCID also has a realistic adoption path. It can be used by:

  • Schools and universities
  • NGOs
  • Elderly community centers
  • Student support offices
  • Banks and financial education teams
  • Digital literacy programs
  • Public anti-scam awareness campaigns

The value of LUCID is not only that it detects risk. Its value is that it helps users regain enough clarity to take a safer next step.

What’s next

Future versions will expand LUCID from a single-session web demo into a real-time, multi-channel cognitive safety system.

Zero-Friction Ingestion

During high-stress situations, users may not have the mental energy to copy and paste messages or upload screenshots manually. We plan to build a WhatsApp/Telegram anti-scam bot and a lightweight browser extension so users can forward suspicious messages or trigger analysis directly from the environment where the scam is happening.

This would reduce friction and make LUCID available at the exact moment when users need help.

Client-Side Privacy-Preserving Redaction

We plan to add on-device redaction before data reaches the backend or model layer. Sensitive information such as faces, phone numbers, account numbers, card numbers, names, and addresses can be automatically masked.

This will make users more comfortable submitting evidence and strengthen LUCID’s privacy-by-design approach.

Regional Pattern Packs

Scam patterns vary by region. In Southeast Asia, users may face scams involving fake tax authorities, fake immigration officers, fake delivery services, fake health-service updates, fake bank alerts, and fake e-wallet verification pages.

We plan to expand Pattern Memory with regional scam pattern packs so LUCID can recognize locally common scam structures more accurately.

Deeper Agent Orchestration

We also plan to explore deeper agent orchestration, including a live MongoDB MCP server for updated pattern retrieval. This would allow LUCID to reason over emerging scam structures and multi-stage manipulation chains more effectively.

NGO and Educational Deployment

We plan to build a simplified Simulation Mode for schools, NGOs, and elderly community centers. In this mode, users can safely experience realistic scam scenarios and learn how manipulation tactics work.

This would shift LUCID from only reacting to scams toward building long-term scam awareness and resilience.

Built With

  • Google Cloud Run
  • Gemini
  • MongoDB Atlas
  • Next.js
  • TypeScript
  • Multimodal AI analysis
  • Memory-augmented agent workflow
  • Cognitive triage system
  • Retrieval-based scam pattern reasoning

Final Reflection

LUCID is built on one central belief:

Scam prevention should happen before the irreversible moment.

A person should not have to lose money, reveal private information, or experience emotional harm before a safety system becomes useful.

By combining Gemini multimodal reasoning, Google Cloud Run deployment, MongoDB Pattern Memory, cognitive triage, and responsible user-controlled action design, LUCID helps users pause before clicking, paying, replying, or sharing sensitive information.

LUCID does not replace human judgment.

It protects the moment when human judgment is under attack.

That is why LUCID is not just a scam detector.

It is a cognitive triage agent for digital safety.

Built With

Share this project:

Updates