Inspiration
Almost everyone in India has received a message like "Your SBI account will be blocked, update KYC now." Most of us can spot it, but our parents and grandparents often can't, and one wrong tap can empty a bank account. We wanted a trusted second opinion that anyone can use before they click, reply, or pay.
What it does
Pause checks suspicious messages and tells you what to do next.
- Paste a message, add a screenshot, or scan a QR code. Pause reads the text and pulls out links, including links hidden inside QR codes.
- Link investigation: it follows short links to the real destination and checks how new the website's domain is. Scam sites are usually brand new.
- A clear verdict (no obvious red flags, suspicious, or likely scam) with a risk score, plain-language reasons, and the evidence it found.
- English, Hindi and Tamil results, with a read-aloud button for people who prefer listening.
- Family share: send the result as a large-text page or on WhatsApp. The original message is never included in the shared link.
- India-specific help: if money was lost, it points to the 1930 cyber fraud helpline and cybercrime.gov.in.
How we built it
Pause combines three layers, and the more cautious result wins:
- Rule-based checks for known scam patterns: OTP and PIN requests, fake KYC, UPI collect requests, job, lottery and courier scams, and look-alike bank domains.
- Link investigation: redirect following, domain age lookup (RDAP), and [optional Google Safe Browsing].
- AI analysis through Groq for context and to write the explanation in the user's language.
The app is built with Next.js and React, with QR decoding in the browser (jsQR) and read-aloud through the Web Speech API. It is deployed on Vercel. Security was part of the design: the server only fetches public web addresses and blocks internal and private ones (SSRF protection), and API keys stay on the server. The code was written with AI coding assistance, and we tested and verified each part ourselves.
Challenges we ran into
- Making the AI checker safe to deploy. Every AI check uses Groq credits, so a public link that anyone could hit repeatedly could drain them. We added shared rate limits with Upstash, and in production the AI checks stay disabled until those limits are configured, so the app never runs unprotected.
- Fetching user-supplied links safely. Following links on the server can be abused, so we added checks that refuse private and internal addresses.
- Balancing alarms and trust. A scam checker that flags genuine bank alerts is worse than useless, so we tested real and fake messages side by side and tuned the rules.
- Voice support varies by device, especially for Tamil, so we tested read-aloud on real phones.
Accomplishments that we're proud of
- A working tool, live today, that anyone can try without an account.
- On our 14-message smoke test, Pause flagged 8 of 8 scam messages with 0 false alarms across 6 genuine messages. This is a small test set we wrote ourselves, so it shows the system behaves sensibly rather than proving real-world accuracy.
- Results in Tamil and Hindi with read-aloud, so the people most targeted can actually use it.
- Cost and abuse protection built in before launch, not after.
What we learned
Good scam detection is about explaining the warning signs, not only labelling a message. We learned how much care goes into letting a server fetch links safely, and that deploying an AI feature means thinking about cost and abuse, not just accuracy. Honest limits ("a helper, not a guarantee") build more trust than big claims.
What's next for Pause
- A larger, community-reviewed test set and published accuracy
- More Indian languages (Telugu, Kannada, Malayalam, Bengali, Marathi)
- A WhatsApp or SMS bot, so people don't need to open a website
- Live call warnings for "digital arrest" and impersonation scams
Log in or sign up for Devpost to join the conversation.