MIRAGE-SHIELD: AI-Powered Digital Arrest Scam Defense

Inspiration

Digital arrest scams are a growing cybersecurity threat in India. Scammers impersonate police officers, CBI agents, or other authorities over video calls, using threats of arrest and fabricated legal cases to pressure victims into transferring their savings.

The key vulnerability is informational isolation. When scammers claim that police officers are physically outside a victim's home, fear can prevent the victim from questioning the story. Traditional spam filters and phone-based warnings cannot independently verify these physical threats.

We asked ourselves: What if the home itself could help fight back? MIRAGE-SHIELD explores how smart-home doorbell evidence can challenge a scammer's claims, interrupt psychological coercion, and coordinate protective responses for the household.

What it does

MIRAGE-SHIELD is an AI-assisted digital arrest scam defense system that cross-checks caller claims against physical evidence from a smart-home doorbell.

Its workflow includes:

Call Claim Extraction: Uses pattern-based analysis to identify physical assertions and common digital-arrest extortion tactics in call transcripts.
Physical Evidence Oracle: Retrieves doorbell event information and snapshots through a Ring Partner API integration architecture, with local sandbox fixtures for reproducible demonstrations.
Contradiction Detection: Compares claims, such as three officers being outside, against sensor evidence showing zero people detected.
Risk Assessment: Combines coercion indicators and physical contradictions to produce a safety verdict.
Four Living-Room Defenses: Demonstrates Fire TV intervention, Ring Chime alerts, PaymentGuard transfer protection, and Family Guardian notifications.
Cryptographic Audit Ledger: Records incident details and uses SHA-256 hashing and HMAC-SHA256 signing in local sandbox mode, with AWS KMS and DynamoDB integration scaffolding.
False-Alarm Resistance: Includes separate scenarios for genuine family calls and verified courier deliveries.

The local demonstration uses predefined evidence and simulated deepfake scoring, banking responses, and SMS notifications. These limitations are clearly distinguished from the implemented detection logic and interfaces.

How we built it

MIRAGE-SHIELD uses a Python backend with FastAPI and Uvicorn to provide REST endpoints for scenario orchestration, evidence retrieval, risk assessment, payment-guard simulation, and audit records.

The detection layer uses Python pattern matching to extract physical claims and classify seven categories of extortion language based on Indian Cybercrime Coordination Centre (I4C) advisories. The decision engine combines these indicators with physical evidence to determine whether an incident should be treated as safe, warned about, or escalated.

The Ring service contains a client for the Ring Partner API and a sandbox fallback using local evidence fixtures. A Model Context Protocol (MCP) server exposes physical-evidence tools to AI agents. The agent architecture includes Amazon Bedrock Converse integration scaffolding and a deterministic local fallback.

The frontend uses HTML5, CSS3, and vanilla JavaScript, avoiding bulky frontend dependencies. It includes a master dashboard and a dedicated 10-foot television interface with remote-friendly navigation. PaymentGuard models a transaction-lock and family co-sign workflow, while the audit component supports SHA-256 hashing, local HMAC-SHA256 signatures, and optional AWS KMS and DynamoDB integration.

Challenges we ran into

Correlating speech with physical evidence: Natural-language threats can be ambiguous. We needed targeted pattern matching to distinguish claims about police being outside the door from general legal threats.
Reducing false alarms: Genuine family calls and ordinary courier deliveries must not trigger unnecessary interventions. Separate scenarios help demonstrate context-aware decisions.
Designing for high-stress situations: The living-room interface needs clear, readable warnings and direct guidance that can be understood quickly from a distance.
Coordinating multiple components: The evidence service, decision engine, dashboard, TV interface, chime, and payment-guard model need to work together consistently.
Testing without live credentials: Sandbox fixtures and local cryptographic signing make it possible to test scenarios even when live sensor tokens and cloud credentials are unavailable.

Accomplishments that we're proud of

Physical Evidence Oracle: Demonstrating how physical-world sensor evidence can challenge fabricated claims made during a digital scam.
Multi-scenario defense: Supporting digital-arrest, genuine-family-call, and courier-delivery scenarios.
Living-room intervention interface: Building a dedicated 10-foot web interface with remote-friendly navigation and emergency takeover states.
Cryptographic audit trail: Implementing local SHA-256 hashing and HMAC-SHA256 signing for incident records.
Modular architecture: Separating evidence retrieval, detection, agent reasoning, protection workflows, and the user interface.
Transparent prototype boundaries: Clearly identifying simulated banking, chime, SMS, and cloud-dependent functionality instead of presenting them as completed live integrations.

What we learned

We learned that physical evidence can provide valuable context when evaluating social-engineering threats. Cross-checking what a caller says against what a doorbell sensor reports offers a different defense approach from relying on call analysis alone.

We also learned the importance of context-aware detection, multi-component orchestration, accessible interfaces for high-stress situations, and reliable offline testing. Finally, we learned to distinguish a functional prototype from production integrations that require live credentials, external services, and additional validation.

What's next for MIRAGE-SHIELD

Complete live Ring Partner API authentication and token-refresh integration.
Integrate validated on-device deepfake detection models for audio and video.
Explore secure banking sandbox integrations and trusted-family authorization workflows.
Develop a native Fire TV or Android TV application with reliable device-level activation.
Enable real family notifications through a secure messaging gateway.
Expand AWS KMS signing and DynamoDB-backed audit storage for production deployment.
Explore secure submission of incident evidence to appropriate cybercrime reporting channels.

Our long-term goal is to make MIRAGE-SHIELD a practical household defense layer that helps people question coercive claims, verify physical evidence, and seek trusted support before making high-pressure financial decisions.