RakshaPay Shield

Inspiration

We built RakshaPay Shield after seeing family members almost approve fake UPI refund collect requests. Banks catch most fraud only after money leaves your account, but the dangerous moment is those five seconds before you tap Approve. We wanted a tool that sits in that gap: a fast, plain-language second opinion for everyday payment users in India who do not have a security team on speed dial.

What it does

RakshaPay Shield is a single-screen web app where you paste a suspicious SMS, UPI collect message, QR screenshot, or voice note and get an instant verdict (Safe, Suspicious, or Likely Scam) with a clear explanation and next step. It targets seniors facing impersonation scams, students hit with fake job offers, and small merchants dealing with QR swaps - anyone who needs help mid-panic, not after the loss.

How we built it

We used Next.js 14 with TypeScript and Tailwind CSS for a polished single-page experience, plus shadcn-style components for consistent UI. A thin /api/analyze route calls Gemini 2.0 Flash in JSON mode for multimodal analysis, with a hardened system prompt and in-prompt knowledge base of Indian scam patterns. API keys live in browser localStorage and travel via request headers - never stored server-side. Without a key, pattern-matched mock verdicts keep the demo fully functional.

Challenges we ran into

The hardest part was hardening against prompt injection in attacker-controlled content while still giving useful explanations to non-technical users. We wrapped all user input in untrusted tags, validated structured JSON output, and fall back to mock analysis on API errors so the demo never breaks during judging.

Accomplishments that we're proud of

We shipped a complete multimodal scam checker with QR/screenshot support, voice note upload, multilingual response options, local history with seeded data, and Docker deployment - all degrading gracefully without an API key so judges can try it in under a minute.

What we learned

Consumer-side pre-transaction defense is a real gap in the fraud stack. LLMs are strong at spotting social-engineering patterns when you give them domain-specific context, but you need strict output schemas and prompt boundaries because scam content is actively trying to fool the model.

What's next for RakshaPay Shield

Add offline QR decoding without API calls, expand Hindi and regional language UI, partner with NPCI for verified payee lookup, build a WhatsApp bot for forwarding suspicious messages, and run a small user study with seniors in Tier-2 cities to measure how often the tool prevents bad approvals.

Built With

• docker
• google-gemini-api
• next.js-14
• shadcn-ui
• tailwindcss
• typescript