SecYour: AI & Blockchain-Powered Phishing Detection for Mobile Banking

Inspiration

With the rise of digital banking, phishing-driven frauds have become a major cybersecurity concern, especially in rural areas where users rely on low-end smartphones and weak internet connections.
We noticed that even when users enter the right passwords or OTPs, fraudsters can still take over accounts through phishing links, screen sharing, or remote access apps.
This inspired us to build SecYour (PhishSafe) — a lightweight, AI-powered security SDK that continuously monitors behavior, context, and anomalies to detect phishing-driven fraud in real time.

What it does

SecYour detects and prevents phishing-based account takeovers in mobile banking apps by analyzing user behavior, device context, and environmental cues.
It builds a dynamic trust score using both rules and machine learning models to assess session safety.
If risk is detected, it triggers adaptive responses like silent alerts, session termination, or re-authentication.
It even works offline, ensuring protection for users in low-connectivity regions.

How we built it

We developed SecYour as a Flutter SDK that banks can easily embed into their mobile apps.
The SDK runs silently in the background, recording behavioral patterns such as tap velocity, swipe frequency, and session flow.

Architecture Overview:

Behavior Tracking Module: Records user gestures and screen time.
Anomaly Detection Engine: Detects phishing indicators like remote control, cloned apps, or suspicious sessions.
Trust Score Engine: Uses a regression-based ML model:
[ T = \alpha B + \beta C + \gamma A ] where
( B ) = Behavioral similarity,
( C ) = Context confidence,
( A ) = Anomaly severity.
Blockchain Layer: Logs session hashes on a private blockchain to ensure data integrity and prevent tampering.
Alert Response System: Takes adaptive action when the trust score falls below threshold.

Tech Stack:

Frontend / SDK: Flutter (Dart)
Backend / ML: Python (PyTorch)
Integration: Kotlin (Android)
Blockchain: Hyperledger Fabric
Storage: Local JSON (offline support)

Challenges we ran into

Optimizing the ML model to run efficiently on low-end smartphones without overheating or lag.
Balancing privacy and security while collecting behavioral data — we ensured all logs are locally stored and anonymized.
Handling offline operation where server-side verification wasn’t possible.
Integrating blockchain efficiently without slowing down the SDK.
Making the SDK lightweight enough for real-time mobile integration.

Accomplishments that we're proud of

Built a fully functional anti-phishing SDK that runs smoothly on entry-level Android devices.
Achieved real-time phishing detection without requiring constant internet connectivity.
Designed a trust score engine that adapts over time to the user’s normal behavior.
Created a plug-and-play SDK that banks can integrate without changing existing infrastructure.

What we learned

How to design resource-efficient ML systems for mobile environments.
Importance of contextual authentication over static credentials like OTPs.
How blockchain can add verifiable trust to mobile security systems.
Managing edge inference and privacy compliance simultaneously.
The power of user behavior analytics as a defense layer against phishing.

What's next for SecYour

Expand to detect voice phishing (vishing) and social engineering patterns.
Build a bank-side dashboard to visualize trust scores and fraud heatmaps.
Integrate federated learning to allow the model to improve across devices without sharing user data.
Explore real-time threat intelligence sharing between banks via blockchain.
Partner with financial institutions to pilot SecYour in real-world environments.