PayShield

PayShield is an AI safety check that spots scam red flags before you pay a seller, then guides you to a safer PayPal checkout. Pause. Check. Pay with confidence.

Comment

PayShield

Project Name: PayShield
Organization: PayShield-AI
Repository: https://github.com/PayShield-AI/PayShield
Live Web App (Render): https://payshield-lbek.onrender.com
Sole Developer & Founder: Akshdeep Singh (@akshdeepsingh7)
Video Demo: https://www.youtube.com/watch?v=060fg4GyTac
YouTube Channel: https://www.youtube.com/@Pay-Shield
Event: PayPal AI Hackathon 2026 ("Build What's Next with PayPal and AI")
Category: Agentic Commerce & Payment Security

Inspiration

Every year, consumers and small businesses lose over $10 Billion to online payment scams. As e-commerce has expanded, fraudulent sellers have evolved from clumsy phishing emails into sophisticated traps:

  • Disposable Lookalike Storefronts: Brand-new domains and Cyrillic homoglyphs impersonating trusted retailers (apple-authorized-clearance-outlet.shop).
  • "Too Good To Be True" Liquidations: Counterfeit storefronts advertising brand-new $1,200 smartphones for $89.
  • Social Engineering & Coercion: High-pressure countdown timers ("Pay in 8 minutes or order cancelled!") paired with payment bypass requests ("Please send payment via PayPal Friends & Family to avoid custom taxes").

When analyzing why these scams succeed, I realized a fundamental architectural gap in modern e-commerce: traditional payment security operates too late in the funnel. Payment gateways encrypt card numbers and detect stolen credentials during checkout, but they have zero visibility into the context of the deal itself. Gateways cannot tell if a listing has an impossible 90% discount, if the domain was created yesterday, or if the seller is manipulating the buyer into waiving their purchase protection. Once money is sent through an unprotected channel, the buyer's funds are lost permanently.

I was inspired to build PayShield to create an AI safety guardian that protects the buyer before they authorize payment. By combining multi-layered AI scam analysis with the official PayPal Developer Platform (Orders API v2), PayShield evaluates listings in real time, explains risks in plain human language, and gates checkout so shoppers never walk blindly into a financial trap.

What it does

PayShield is an intelligent pre-payment AI safety assistant that evaluates online purchases before money changes hands.

When a buyer prepares to pay an unfamiliar seller or online merchant, they provide three inputs:

  1. Listing URL (storefront or product link)
  2. Asking Price & Currency
  3. Seller Details & Communication (seller name, chat transcripts, payment instructions, or urgency timers)

In under a second, PayShield's threat evaluation engine executes a multi-vector security inspection:

  1. Website & Infrastructure Authenticity: Catches brand typosquatting, Cyrillic IDNA homoglyphs (xn--), disposable scam-heavy top-level domains (.top, .xyz, .shop, .buzz), insecure HTTP connections, and raw numerical IP hosts.
  2. Price Realism & Anomaly AI: Cross-references popular consumer electronics, consoles, laptops, and luxury goods against verified market retail benchmarks while intelligently excluding accessories (cases, cables, adapters). Listings discounted by 80% or more trigger critical non-delivery fraud warnings.
  3. Linguistic Manipulation & Pushy Language Engine: Scans seller notes and chat transcripts for coercive urgency ("Offer expires in 10 minutes", "Act now") and payment diversion tricks—specifically intercepting requests to use PayPal Friends & Family, wire transfers, or gift cards that strip away PayPal Purchase Protection.

Transparent Risk Ratings & Intelligent Checkout Gating

PayShield synthesizes these signals into a clear numerical score (0 to 100) and an intuitive risk tier:

  • LOW RISK (0 to 30): Safe transaction. Instantly unlocks a one-click PayPal Checkout button with full PayPal Buyer Protection.
  • MEDIUM RISK (31 to 65): Potential concerns detected (unverified seller, domain registered recently). Displays an itemized safety checklist and requires buyer acknowledgment before unlocking PayPal checkout.
  • HIGH RISK (66 to 100): Severe scam indicators detected. The checkout button is securely locked. PayShield presents plain-words explanations detailing why the deal is dangerous. The buyer can only proceed by explicitly acknowledging the risks and manually overriding the safety lock.

The 3 Core Guarantees

  • PayPal handles all payments securely: All checkout flows orchestrate exclusively through official PayPal Sandbox v2 Orders APIs with Buyer Purchase Protection.
  • The app never touches card details: Zero sensitive cardholder credentials or bank details are accessed, handled, or stored by PayShield.
  • The user always makes the final decision: PayShield informs, warns, and gates, but preserves buyer autonomy.

How we built it

PayShield was engineered from the ground up as a production-grade, asynchronous Python application:

1. Asynchronous Python Backend

  • Developed using Tornado 6.4, delivering non-blocking asynchronous I/O and high-concurrency request routing.
  • Designed clean REST API endpoints (/api/analyze, /api/paypal/create-order, /api/paypal/capture-order, /api/presets, /api/status, /api/history).

2. Multi-Layered AI Threat Engine

  • DomainInspector (core/domain_inspector.py): Uses URI parsing, IDNA ASCII punycode decoding, boundary-aware regex matching, and suspicious TLD registries to detect brand spoofing, Cyrillic homoglyphs, and infrastructure anomalies.
  • PriceAnalyzer (core/price_analyzer.py): Evaluates discount discrepancies against market benchmarks using statistical drop formulas with accessory keyword exclusions and non-finite float validation: Discount Percentage = ((Market Retail Price - Offered Price) / Market Retail Price) * 100
  • UrgencyDetector (core/urgency_detector.py): NLP keyword and sentiment analyzer identifying coercive time pressure, buyer protection diversion tricks, and uppercase aggressive shouting.
  • PayShieldAIEngine (core/ai_engine.py): Orchestrates weighted composite risk scoring with a critical single-factor escalation rule (ensuring severe threats cannot be masked by low sub-scores). Integrates a zero-config heuristic NLP reasoning engine alongside optional Google Gemini (gemini-3.5-flash-lite) API synthesis.

3. PayPal Developer Platform (v2 Orders API) Integration

  • PayPalClient (core/paypal_client.py): Implements server-side OAuth2 basic authentication token caching (/v1/oauth2/token), order initialization (/v2/checkout/orders with intent: "CAPTURE"), and payment capture (/v2/checkout/orders/{id}/capture).
  • Enforces backend security policy gates: prevents order creation on Medium/High risk transactions unless explicit user confirmation is passed in the payload.
  • Attaches custom risk audit tags (payshield_risk_low, payshield_risk_medium, payshield_risk_high) directly to PayPal's custom_id field for end-to-end audit traceability.
  • Resilient Dual-Mode Architecture: When live PayPal sandbox credentials are provided, calls the live PayPal API with structured error handling; when unconfigured, activates a built-in sandbox simulator matching the exact PayPal Orders API v2 schema, enabling reviewers to evaluate the full checkout lifecycle with zero configuration friction.

4. Cyber-FinTech Frontend

  • Built with HTML5, Tailwind CSS, and modern glassmorphic styling with PayPal brand spectrum accents.
  • Features an animated circular SVG Risk Gauge Meter that transitions smoothly across green, amber, and red color spectrums.
  • Synthesizes audio feedback cues (harmonic safe chimes, caution tones, and alert sweeps) directly via the browser's native Web Audio API without external audio files.
  • Provides keyboard shortcuts (Ctrl + Enter to scan, Esc to dismiss modals), one-click preset test scenarios, dynamic currency formatters, and clipboard copying for PayPal Transaction IDs.

5. Production Cloud Deployment on Render (Sponsored Tool) with Gunicorn

  • Integrated with Render, an official sponsor of the PayPal AI Hackathon 2026.
  • Live deployed web application accessible for judges and reviewers at: https://payshield-lbek.onrender.com
  • Created root render.yaml infrastructure-as-code blueprint specifying automated Python environment provisioning, dependency builds, and dynamic port binding ($PORT) for seamless one-click cloud deployments.
  • Implemented dual-engine universal server architecture supporting both high-concurrency Gunicorn WSGI (gunicorn app:app) on Render containers and native asynchronous Tornado (python app.py) for local development.

Challenges we ran into

  1. Eliminating False Positives in Discount & Domain Analysis:
    Legitimate seasonal promotions (such as Black Friday sales) frequently offer steep discounts of 30% to 50%, while sub-brands like pineapple.com contain brand keywords (apple). A naive substring or pricing rule would generate false alarms. I resolved this by engineering boundary-aware delimiter regexes (r'(^|[\.\-_])' + brand + r'([\.\-_]|$)') and benchmark tolerance bands: discounts under 55% receive low risk, discounts between 55% and 79% trigger caution advisories, and only discounts exceeding 80% on high-ticket luxury electronics trigger critical fraud alerts.

  2. The "Masking Problem" in Composite Scoring:
    In standard weighted scoring (30% Domain + 35% Price + 35% Urgency), a scammer offering a normal price ($999) on a brand-new phishing domain while demanding wire transfers could receive an artificially low composite score. I solved this by engineering a critical single-factor escalation rule: if any single component detects an extreme threat (such as brand spoofing, an 80%+ discount, or a demand for Friends & Family), the composite score automatically escalates to High Risk (70+ out of 100), ensuring critical threats cannot hide behind clean sub-scores.

  3. Cyrillic Homoglyph & Punycode Attacks:
    Scammers frequently use lookalike Cyrillic characters (e.g. Cyrillic 'а' replacing Latin 'a') that look identical to human eyes. Standard string checks miss these completely. I implemented IDNA ASCII decoding (domain.encode('idna').decode('ascii')) to convert unicode spoofing into xn-- punycode strings, which are immediately flagged with a severe risk penalty.

  4. Zero-Configuration Reviewability for Judges:
    Hackathon judges review dozens of projects and cannot spend hours configuring developer sandbox accounts or API keys. I built an offline client-side heuristic engine and sandbox simulator fallback: if run without API keys or opened directly as a local HTML file, PayShield evaluates the listing, runs the gauge animations, and simulates the PayPal sandbox order capture seamlessly.

Accomplishments that we're proud of

  • True Pre-Payment Security: Successfully bridged AI threat reasoning with PayPal's trusted checkout rails, stopping fraud before money moves rather than reacting after funds are lost.
  • Blazing Performance & 100% Test Coverage: The core heuristic engine executes in under 2 milliseconds—the automated test suite covers 17 comprehensive unit tests (punycode homographs, boundary safety, price non-finite math, accessory exclusions, urgency detection, and PayPal risk gates) passing 100% in ~0.02 seconds.
  • Plain-Words Communication: Transformed complex cybersecurity telemetry (IDNA punycode, TLD risk distributions, SSL protocol state) into clean, plain-English advice that any online shopper can immediately understand and act upon.
  • Sole Developer Execution: Designed, architected, coded, styled, and tested the entire full-stack platform, REST APIs, test suite, and documentation single-handedly as the sole founder and developer of PayShield-AI.

What we learned

  • The Anatomy of Modern Payment Fraud: Gained deep insight into how contemporary scammers exploit cognitive biases, artificial scarcity timers, and peer-to-peer payment features (like Friends & Family) to systematically bypass buyer protection programs.
  • PayPal Developer Platform Mastery: Mastered the PayPal Orders API v2 lifecycle, OAuth2 client credential token caching, and order capture workflows.
  • Hybrid AI Architecture: Learned that the most effective AI security systems combine deterministic heuristic rules (for instantaneous, zero-latency filtering) with generative LLM reasoning (for nuanced contextual explanation and plain-words translation).
  • The Value of Strategic Friction: In FinTech, friction is often viewed as a negative; however, strategically placed "smart friction" (such as PayShield's safety lock and confirmation checklist on high-risk purchases) empowers users to pause, verify, and avoid irreversible financial loss.

What's next for PayShield

  • Browser Extension (Chrome, Edge, Safari): Package PayShield's detection engine into an ambient browser extension that automatically injects a safety badge directly into cart and checkout pages across Shopify, Amazon, eBay, and independent storefronts.
  • Autonomous Agentic Commerce Protocol: Build an open-source SDK allowing autonomous AI shopping agents (e.g., LangChain, AutoGPT, CrewAI) to call PayShield as a mandatory pre-flight safety tool before autonomously moving money with PayPal.
  • Crowdsourced Threat Intelligence Network: Create a privacy-preserving threat intelligence network where verified scam storefronts, fraudulent domains, and disposable handles are indexed in real-time across the PayShield ecosystem.
  • Mobile SDK & In-App PayPal Integration: Partner with merchant platforms and digital wallets to embed PayShield's safety assessment directly into mobile checkout flows worldwide.

Built With

Share this project:

Updates

Submission history