• 

• 

• 

• 

• 

• 

• 

• 

• 

• 

ProofPay: Catch the Payment Fraud Hiding in Plain Sight

Inspiration

Imagine running a small business. You receive an invoice from a supplier you've worked with for years. The company name looks right, the amount is expected, and the email seems legitimate.

But there's one detail you didn't notice: the payment account has changed.

You send the money, and it goes to a fraudster.

This is the reality of business email compromise and invoice payment fraud. As AI makes impersonation and convincing fraudulent communications easier to produce, recognizing suspicious requests by appearance alone becomes increasingly difficult.

I wanted to build something that goes beyond simply asking AI, "Does this look like a scam?"

That's how ProofPay started.

The idea is simple: Don't just analyze how trustworthy a payment request looks. Verify its details against information you already trust.

What It Does

ProofPay is an AI-powered payment fraud verification platform that helps businesses identify suspicious payment requests before sending money.

It combines AI-powered information extraction with deterministic verification to detect inconsistencies between incoming payment requests and previously registered supplier records.

Here's how it works:

1. Extract: AI analyzes a payment request and extracts supplier information, invoice details, beneficiary names, and payment account identifiers.
2. Compare: ProofPay checks those details against trusted supplier records.
3. Explain: An independent rules engine identifies discrepancies and presents evidence showing what was expected versus what was received.
4. Protect: Suspicious requests receive a HOLD or REVIEW decision within a simulated payment approval workflow.

For example, if an invoice claims to be from a known supplier but includes a different bank account, ProofPay highlights the mismatch, explains the evidence, and holds the simulated payment.

It also handles incomplete information, unknown suppliers, and suspicious instructions embedded in documents.

The key difference? ProofPay doesn't blindly trust an AI-generated fraud score.

AI understands the request. Deterministic code makes the verification decision.

How I Built It

I built ProofPay as a solo developer using a modern full-stack architecture.

The technology stack includes:

• Next.js, React, and TypeScript for the application.
• Tailwind CSS for the responsive interface.
• AI SDK and a structured-output language model for extracting information from payment requests.
• Zod for validating extracted data.
• A custom TypeScript verification engine for comparing payment information against registered supplier records.
• Vitest for automated testing of verification rules and security-sensitive behavior.

The architecture deliberately separates AI extraction from security decisions.

The AI converts unstructured payment requests into structured information. Extracted values are checked against their supporting source text, then passed to an independent verification engine.

The engine evaluates supplier identity, beneficiary details, account identifiers, and other relevant inconsistencies before generating an evidence-backed result.

I also built a modern, Neo-Swiss-inspired interface focused on making complicated verification results immediately understandable.

For the hackathon demonstration, ProofPay uses synthetic supplier records and simulated payment actions. It does not connect to real banking systems or independently verify bank account ownership.

Challenges I Faced

1. Making AI useful without trusting it blindly

One of the biggest challenges was designing an AI-powered security product that didn't depend entirely on the model's judgment.

Language models can misinterpret information, overlook details, or generate unsupported conclusions. In a payment verification workflow, those mistakes matter.

My solution was to give AI a limited responsibility: extract information.

The final verification decisions are handled by deterministic rules, with missing or insufficient evidence triggering additional review.

2. Making every finding explainable

Simply displaying "High Risk" isn't enough.

A business owner needs to understand what changed and why it matters.

I designed ProofPay to show observed payment details alongside trusted reference values, supported by evidence from the original request.

This makes the system more transparent and actionable.

3. Handling adversarial and incomplete information

Payment requests aren't always clean or trustworthy.

Documents may contain conflicting account numbers, missing information, misleading sender details, or instructions attempting to manipulate an AI system.

I designed verification safeguards so that untrusted document content cannot directly control the final decision.

4. Building everything solo under hackathon pressure

Balancing AI integration, security logic, automated testing, product design, and demo preparation within a short timeframe was challenging.

I had to be intentional about scope, prioritize the core verification experience, and resist adding features that wouldn't strengthen the central solution.

What I Learned

Building ProofPay reinforced an important lesson:

The best AI systems don't necessarily give AI more authority. They give it the right responsibilities.

AI is powerful at understanding unstructured information, but sensitive decisions benefit from explicit rules, independent evidence, and clear boundaries.

I also learned how important explainability is in security products. A useful warning doesn't just tell someone to be careful. It shows them exactly what needs attention.

Finally, this project reminded me that technical depth and user experience should reinforce each other. Even sophisticated verification logic has limited value if users can't understand the results.

Accomplishments I'm Proud Of

I'm especially proud of building an end-to-end workflow that brings together:

• Structured AI-powered extraction.
• Source-grounded information.
• Independent, deterministic verification rules.
• Supplier impersonation and payment mismatch detection.
• Explainable security findings.
• A simulated payment approval gate.
• A polished, responsive product experience.

Rather than creating another generic AI chatbot, I focused on a practical security workflow where AI and traditional software engineering complement each other.

What's Next

ProofPay is currently a hackathon prototype, but the broader vision is to make payment verification a natural part of business workflows.

Future directions include integration with accounting systems, invoice-processing tools, and email platforms, along with stronger supplier onboarding and independently authenticated verification channels.

The long-term goal is to help businesses catch suspicious payment changes before those changes become financial losses.

Because sometimes, the difference between a legitimate invoice and a costly mistake is just one changed account number.

And that's exactly what ProofPay is designed to catch.

Built With

• ai-sdk
• nextjs
• openai
• react
• tailwindcss
• typescript
• vercel
• vercel-ai-gateway
• vitest
• zod