PhishLens — Explain first. Click later.

Inspiration

Scams often win by creating urgency, impersonating a trusted organization, asking for a code or payment, and isolating the recipient from the people who could help verify the request. PhishLens gives students, families, and school staff a calm way to pause before a click becomes an account compromise or financial loss.

What it does

PhishLens turns a pasted email, text, or chat message into an explainable safety check. It identifies observable social-engineering signals—urgency pressure, credential requests, impersonation cues, payment or reward bait, secrecy requests, sender/brand mismatches, and suspicious destination patterns—and shows the literal evidence behind each finding.

The product never opens pasted links. It parses URLs locally and surfaces shorteners, numeric hosts, IDN/punycode look-alikes, encoded or deceptive destinations, unusual ports, high-risk domain endings, sender/destination mismatches, and claimed-brand mismatches. It then gives audience-aware next steps for students, parents/caregivers, school staff, and general users, plus a safe reply and a redacted local report. Nothing is sent automatically.

PhishLens also handles harder evidence safely. A user can preview a suspicious screenshot locally, decode a QR value when the browser exposes local barcode detection, or paste screenshot/OCR text; any decoded destination is analyzed without being opened. Email users can paste SPF, DKIM, and DMARC results, with a visible caveat that these are reported headers rather than independent verification.

How we built it

The prototype uses vanilla HTML, CSS, JavaScript modules, and a small Node.js server. The deterministic analysis engine also runs directly in the browser, so the static version remains useful when no server is available. An optional local Ollama semantic review provides a constrained second opinion; if that model is unavailable, PhishLens clearly retains the deterministic evidence result instead of claiming that AI ran.

The interface compares the deterministic signal set with the optional AI signal set: shared, deterministic-only, and AI-only emphasis remain visible. Accessibility controls support plain-language/standard reading density, larger text, high contrast, reduced motion, and keyboard/screen-reader-friendly controls. A guided 90-second judge mode walks through a representative school case, its evidence trail, its redacted report, and the behavior metrics.

Safety evidence

The UI includes a 36-case deterministic dataset: the original 24 curated cases plus adversarial checks for polite rewrites, misspellings, Unicode tricks, multilingual scams, voice-clone bait, image-text deception, unusual ports, encoded destinations, and pasted email authentication results. The current synthetic/adversarial run is 36/36 expected cases passed with accuracy 1.0, precision 1.0, recall 1.0, and false-positive rate 0.0. These are behavior metrics for this small curated dataset—not real-world accuracy, a probability, or a claim that the engine proves fraud.

Consent-first workflow

A caregiver, teacher, or school IT handoff can be exported only after an explicit consent checkbox. The export is redacted and local; PhishLens never sends it automatically. The ethical pilot mode collects only anonymous in-memory timing and outcome choices such as independent-verification behavior and false-alarm feedback. One explicitly consented synthetic-content dogfood session has now been completed: n=1, two recorded outcomes (one independent-verification choice and one feedback choice), a 0.5 independent-verification share of recorded outcomes, and 94.7 seconds average time to outcome. Original messages were not stored. These are descriptive local measures, not a representative user study or an accuracy claim; additional consented sessions are required before population-level claims.

Challenges we ran into

We avoided a black-box confidence trap: a polished percentage can make users over-trust a system that has not been measured in their environment. PhishLens uses an observed-factor count, evidence-linked explanations, explicit uncertainty, and independent-verification guidance instead.

Accomplishments that we're proud of

A complete judge-operable safety workflow with an explicit 90-second proof path. Evidence-linked phishing triage that does not open a link. Screenshot/QR and email-header intake with safety caveats. Deterministic-versus-AI agreement and disagreement made visible. Context-aware guidance, accessibility controls, and consent-first redacted handoff. A reproducible adversarial behavior dataset with honest metrics. A local-only optional AI second opinion with an explicit fallback. A tool that remains useful without an AI model or external service.

What we learned

Cybersecurity UX is not only about detecting threats; it is about helping a person make a safer decision under pressure. Explanation, uncertainty labels, privacy boundaries, and a trustworthy verification route are core product features.

AI and external-tools disclosure

OpenAI Codex assisted with design and implementation. PhishLens includes an optional local-only Ollama semantic-review feature. The deterministic evidence engine, screenshot/QR path, visible evaluation dataset, and no-link-opening boundary work without a hosted AI service or external AI API key.