Ojo: scam message checker for Chile

Paste a suspicious SMS or WhatsApp and Ojo highlights the scam tricks, explains them in plain Spanish or English, and tells you what to do. Runs 100% on your device.

Comment

Inspiration

In Chile, scam messages are part of everyday life. Texts pretend to be your bank and ask for your "tarjeta de coordenadas". WhatsApps start with "Hola mamá, cambié de número". Fake couriers say a parcel is held, fake tax-office messages promise a refund, and "agencies" offer to pay you for liking YouTube videos. The people who fall for them are often older relatives who don't know what to look for. Generic scam checkers are in English and know nothing about Chilean banks, couriers or slang. The goal: something a parent or grandparent can use in ten seconds, in Spanish, without handing their messages to a server.

What it does

You paste a message (or tap one of the built-in examples) and Ojo:

  • gives a 0–100 risk score with a clear traffic-light verdict: low, suspicious or likely scam;
  • highlights the exact words that triggered each warning, like a highlighter pen on the message;
  • explains every red flag in one plain sentence, with a concrete tip ("Call the number on the back of your card, never the one in the message");
  • checks every link against the official domains of 24 Chilean banks, government services, couriers and telecoms. It flags look-alikes such as bancoestado-cl.verificacion-segura.top or bancodechlle.cl, and catches shorteners, raw IP addresses, punycode and throwaway domain endings;
  • shows a short "what to do now" list and what to do if you already fell for it (block the card, change passwords, report to the PDI police at 134).

The interface works in Spanish and English, in light and dark mode, and on phones.

How it was built

Ojo is a single static web page with no backend and no network calls. All analysis runs in the browser, so the message never leaves the device and nothing is stored.

The core is a transparent rule engine:

  • 17 signal types, 43 patterns based on common Chilean scam scripts: credential requests (clave, coordenadas, ClaveÚnica, SMS codes), fake urgency, the "new number" family scam, money requests, the "cuento del tío" emergency scam, prizes, pay-to-receive fees, held parcels, government refunds, unrecognized charges, remote-access apps, task and investment scams, secrecy and moving to Telegram, generic greetings and toll debts.
  • Combination patterns add weight when signals appear together, for example "new number" plus a money request, or a suspicious link plus a request to act.
  • Link analysis compares each domain with an allowlist of official domains. It detects brand names inside fake domains and typosquats (Levenshtein distance ≤ 2 after undoing digit swaps like 0→o). It also flags a message that names a brand but links elsewhere.
  • Text is matched without accents or case, character by character, so each match lines up with the original text and can be highlighted exactly.

Rules were chosen over a black-box model on purpose: every point of the score has a written reason the user can read and judge. That matters for a safety tool aimed at non-technical users.

AI assistance (disclosed per the rules): this project was built with heavy help from Claude (Anthropic), an AI assistant, which wrote most of the code, the detection rules and the text under my direction. Everything was created during the hackathon period.

Testing

Real-style test messages, including legitimate ones, were used to keep false alarms down:

  • Fake bank asking to "validate" details: 100, likely scam
  • "Hi mom, I changed my number" + transfer: 90, likely scam
  • Held parcel with a typosquatted courier link: 100, likely scam
  • Tax refund asking for ClaveÚnica: 100, likely scam
  • Paid "likes" job moving to Telegram: 60, likely scam
  • Unrecognized charge + "call this mobile number": 65, likely scam
  • Typosquatted bank domain (bancodechlle.cl): 70, likely scam
  • Toll debt pointing to a raw IP address: 60, likely scam
  • Normal chat between friends: 0, low
  • Real-style bank alert pointing to the official 600 line: 20, low
  • Message with an official sii.cl link: 0, low
  • Real-style Mercado Libre delivery notice: 0, low
  • "Your wi-fi password is the usual one": 0, low

That last case was a real false positive found during testing ("tu clave" flagged a wi-fi password). A narrower rule fixed it.

Challenges

  • False positives versus misses. Words like "clave", "pagar" or "envío" appear in normal messages, so each rule needs context (who is asking, for what, with which link) instead of single keywords.
  • Look-alike domains. Real brands use subdomains, while scammers put the brand name inside other domains. The check has to accept www.sii.cl and reject sii-devolucion.online.
  • Being honest about limits. Ojo does not open links, so a low score is not a guarantee. The page says so clearly.

What we learned

Most scams use the same few levers: urgency, authority, a small payment and a link. Showing people which lever is being pulled teaches them more than a red "SCAM" label.

What's next

  • A share-to-check flow for WhatsApp on Android.
  • Community-reported patterns, reviewed before they become rules.
  • Testing with older adults and adjusting the wording to what they understand.

Team

Solo entry. I chose and directed the project; Claude (AI) did most of the implementation, as disclosed above.

Built With

Share this project:

Updates

Submission history