Inspiration
A text says your bank account is at risk and asks you to move your money to a “safe account.” Even if you suspect a scam, two questions remain: How do you check who sent it? What can you do if you already sent money? I built PausePoint as a solo project for the T-Mobile challenge to help people answer both questions.
What it does
Paste a message or choose a synthetic example. PausePoint highlights the words behind its warning and explains the action that could put you at risk. In the bank example, it highlights the transfer request and suggests opening your usual banking app or calling the number on your card. An unrecognized message receives an “uncertain” result. The app cannot authenticate the sender.
If you already acted, choose what happened. Six recovery plans cover situations from clicking a link to sharing a password or sending money. Each plan gives concrete next steps and links to official consumer resources. You can download the plan without including the suspicious message.
How we built it
I used HTML, CSS, and JavaScript for the app and Node.js for local testing. Detection runs in the browser. The rules recognize requests such as sharing a verification code, account for some spelling variations, and map each match back to the original words. Pasted links stay inactive, and the app keeps no message history.
OpenAI Codex assisted extensively with the interface, detection rules, recovery guidance, tests, synthetic examples, and documentation. The running app analyzes messages with local rules and makes no generative AI API calls.
Challenges we ran into
A bank can legitimately tell someone never to share a code. A scammer can ask for the same code indirectly. Treating every mention of a code as a warning creates false alarms. Looking only for familiar requests misses scams. One example in the expanded test set still slips through: a supposed support agent asks someone to read six digits back to stop a transfer.
Accomplishments that we're proud of
A user can go from a highlighted transfer request to a trusted contact route or a recovery plan in the same session. All 34 automated tests pass in the submitted GitHub version.
On the original 30 synthetic cases, the detector flagged 16 of 16 scam messages and 0 of 10 legitimate messages. On the expanded 28-case repository evaluation, it flagged 13 of 14 scams, missed one, and flagged 0 of 12 legitimate messages. Four ambiguous cases in the original set and two in the expanded set were left unscored. “Flagged” includes both high-concern and review-level warnings.
What we learned
Showing the exact words behind a warning makes the next step easier to explain. Showing a missed scam is just as important: it demonstrates why people still need an independent way to verify a request.
Detection uses local rule heuristics evaluated on synthetic test examples; real-world statistical accuracy baselines are in ongoing development. These AI-assisted examples were used during development. The original cases informed changes to the detector. T-Mobile’s supplied dataset and classifier were not used for these results.
What's next for PausePoint
I want to test the detector on an independently labeled dataset, measure misses and false alarms across more languages, and watch people try the verification flow. A useful next test is whether someone who receives the “safe account” message can identify a trusted way to contact their bank without using anything in the message.
