-
-
-
-
Result
-
Ai explanation
-
Acknowledge warnings before you pay
-
Payment success
-
What it could not verify
-
Paypal sandbox integration
Inspiration
Digital payments have made sending money easier than ever, but they have also created opportunities for scammers to exploit people's trust.
Fake payment websites, look-alike domains, impersonated brands, and urgent payment messages can make fraudulent requests appear legitimate. I personally came close to falling for a similar scam, but recognised the warning signs in time.
That experience made me think about people who might not recognise these signs; especially first-time digital payment users and elderly people who may not be familiar with how online scams work.
I wanted to build something that could make basic cybersecurity awareness more accessible.
People should not have to be cybersecurity experts to make safer online payments.
What it does
PayShield is a privacy-first, pre-transaction payment security scanner that helps users examine a payment destination and its accompanying message before proceeding. Users can submit a URL and an optional payment request message. PayShield analyses them for suspicious patterns, including:
-Brand impersonation and look-alike domains. -Unusual URL structures and suspicious hostnames. -Urgent or compelling payment language. -Requests involving gift cards, cryptocurrency, OTPs, or sensitive credentials. -Pressure tactics involving account threats, fees, or unrealistic rewards.
It then presents a risk assessment with explanations of the warning signs detected.
An optional Gemini-powered explanation helps users understand the findings in simpler language. It is disabled by default and cannot override the deterministic rule-based assessment.
PayShield also demonstrates a PayPal Sandbox checkout flow with a warning acknowledgement gate. Users must acknowledge the displayed warnings before proceeding through the demo checkout.
How I built it
PayShield combines deterministic security checks, optional AI-assisted explanations, and a simulated payment workflow.
- Rule-Based Detection
The core analysis engine uses Python's standard library to inspect submitted URLs and payment messages. It checks for suspicious patterns locally without visiting the submitted website, performing DNS lookups, or calling external detection APIs.
- AI-Assisted Explanations
The optional Gemini integration explains the findings generated by the rule engine. Its output is schema-validated, and observations that cannot be independently verified are clearly separated from rule-based findings.
- PayPal Integration
PayShield uses the PayPal JavaScript SDK and Orders API v2 to demonstrate a gated Sandbox checkout. The server controls the product and amount, validates the order, and verifies the capture before reporting a successful transaction.
The checkout is a demonstration involving the PayShield demo merchant. It does not process payments to the URL being analysed or handle real money.
Technology Stack
Python and Flask
HTML, CSS and JavaScript
Google Gemini API (optional)
PayPal JavaScript SDK v6
PayPal Orders API v2
What I learned
Building PayShield helped me understand that security tools should not only identify potential risks — they should also communicate them responsibly.
I learned about:
URL parsing and suspicious domain patterns.
Rule-based security analysis and risk scoring.
Integrating AI without making it the authority for security decisions.
Secure handling of API credentials and environment variables.
PayPal Sandbox integration and server-side order verification.
Designing privacy-conscious applications.
Most importantly, I learned that adding more warnings does not necessarily make a tool safer. Users need understandable explanations and enough context to make informed decisions.
Challenges I ran into
One of the biggest challenges was deciding how to communicate risk without creating unnecessary panic or false confidence.
A suspicious-looking URL does not automatically prove fraud, and a URL with no detected warning signs is not necessarily safe. We therefore designed the assessment to explain individual findings rather than present a score as a probability of fraud.
Another challenge was separating AI explanations from the actual security assessment. Gemini needed to explain existing findings without inventing evidence, claiming to verify a website, or overriding the rule engine.
Integrating the PayPal Sandbox flow also required careful handling of order creation, server-side validation, and capture verification.
Accomplishments that I am proud of
Building a complete working prototype: I took PayShield from an idea to a functional application combining URL analysis, payment-message scanning, optional AI explanations, and a PayPal Sandbox checkout flow.
Implementing security checks without external scanning services: I built a deterministic, rule-based analysis engine that examines suspicious URL patterns and payment language locally, without visiting submitted websites or making DNS lookups.
Integrating AI responsibly: I incorporated Gemini as an optional explanation layer while keeping the core security assessment independent of AI. This helped me explore how AI can improve user understanding without becoming the sole decision-maker.
Integrating PayPal Sandbox: I implemented a demonstration checkout flow with server-side order creation, validation, and capture verification.
Prioritising privacy and transparency: I designed the application without user accounts, a database, or payment-history tracking, and made AI analysis opt-in rather than automatic.
Learning through independent debugging: As a first-year BTech student, I worked through unfamiliar technologies, integration issues, and testing challenges to bring the different parts of the application together.
What's next for PayShield
Some improvements we would like to explore include:
Expanding the brand impersonation detection list.
Supporting more languages in payment-message analysis.
Integrating trusted domain reputation and domain-age services.
Improving URL extraction and analysis from payment messages.
Moving the checkout warning gate towards stronger server-side enforcement.
Deploying the application for broader testing and feedback.
