-
-
Suspicious messages land on your desk. Inspect the clues with your hands, then stamp each one SCAM or SAFE. New case daily.
Inspiration
Almost everyone I know has received a message like "Your bank account will be BLOCKED today, update KYC now" or a payment request promising a prize. Most of us ignore them, but scammers only need one person to tap at the wrong moment, and that person is often a parent or grandparent. Awareness campaigns usually give us posters and long lists of rules that are easy to forget.
I wanted something you practise, the way a detective practises spotting clues, so that when a real scam arrives, your eyes already know where to look. Mixed reality felt like the perfect fit: the messages appear on your own desk, you inspect them with your own hands, and you deliver your verdict with a satisfying thunk of a rubber stamp.
What it does
Each day a new case file lands on your desk with 8 messages: SMS, emails, chats, payment requests and browser pop-ups. Five are scams and three are real, because the goal is to stay alert, not to be afraid of every message.
- Inspect: touch any part of the message that looks suspicious, such as a link, a sender, a deadline or a button, to mark it. You can also point and pinch.
- Decide: press the red SCAM stamp or the green SAFE stamp.
- Learn: the panel shows the red flags you caught (✓), the ones you missed (○), and one tip to remember.
The scams are the ones most common in India today: fake KYC alerts, UPI "collect" requests, QR code "refunds", "digital arrest" calls, task-job scams, fake delivery fees, electricity disconnection threats, SIM-swap OTP theft, fake virus pop-ups, "Hi Mom, this is my new number", and look-alike bank websites. Every brand, phone number and link is made up.
Every case ends by pointing players to India's official reporting channels: cybercrime.gov.in and the 1930 helpline.
How I built it
Scam Detective is a WebXR app written from scratch in JavaScript and WebGL, with no game engine. The whole game is a single ~95 KB web page that opens instantly in the Meta Quest Browser, with nothing to install.
- Hands-first input: the game tracks your index fingertip, so touching a clue marks it and pressing down on a stamp's handle stamps the message. The Quest's pinch-ray works for every target too.
- Message cards are drawn live onto a canvas texture. A small text-layout engine wraps the message and records the exact rectangle of every clue, so a fingertip lands on the right words.
- Scoring rewards the right verdict and real detective work:
$$ \text{points} = \max\Big(0,\; 100\cdot[\text{verdict correct}] + 25\,f - 10\,w - 10\,h\Big) $$
where $f$ is the number of real red flags you marked, $w$ the innocent parts you marked by mistake, and $h$ the hints you used.
- Daily cases are chosen from the date, so every player gets the same case each day. The pool has 16 scam messages and 8 real ones, so there are
$$ \binom{16}{5}\binom{8}{3} = 4368 \times 56 = 244{,}608 $$
possible combinations.
- Progress: a daily streak, plus ranks that unlock as your correct verdicts add up: Rookie → Junior Detective (10) → Detective (25) → Inspector (50) → Cyber Chief (100).
- Sound is generated in code: soft rain, paper sliding across the desk, a stamp thunk placed in space where you press it, and chimes for correct answers. Read-aloud uses the browser's built-in speech synthesis.
- Testing: automated tests check every message's clues, check 400 days of daily cases, play a full case in a browser, and test touch and pinch with a simulated headset.
Challenges I faced
- Making clues tappable without giving them away. If only red flags could be tapped, the game would be trivial. So every message also has innocent tappable parts (for example, "Dear Customer" appears in real bank messages too). Marking something never reveals whether it's a red flag; you only find out after you stamp.
- Being fair to real messages. A game that treats everything as a scam teaches fear, not judgment. Writing believable real messages (an OTP for a purchase you started, a delivery update from the official domain, money received from a friend) was as important as writing the scams.
- Reading in a headset. Small text is hard to read in VR, so I used large type, strong contrast, a Big text mode and read-aloud.
- Two ways to interact without conflict. Touch and pinch-ray could fire at the same time, so the ray hides automatically whenever your hand is close to the desk or a card.
- Responsible content. I used only invented brands, numbers and links, so the game teaches the patterns without copying real companies or creating anything that could be misused.
What I learned
- Scams follow a few patterns that repeat across all their variations: urgency, secrecy, paying to receive, and look-alike links. Once you see them, you notice them everywhere.
- People learn these patterns far faster by doing than by reading.
- Designing for hands means designing for feedback. Hands have no vibration, so every touch needs a visible change and a sound to confirm it.
What's next
- More languages (Hindi, Tamil, Bengali and more), because scams arrive in every language.
- Family mode: slower pacing and voice guidance for older players.
- Voice-call scenarios for phone scams like "digital arrest".
- Share your daily score with friends and family.
Log in or sign up for Devpost to join the conversation.