Ring-Radar

Catch the whole scam ring live: freeze every mule account at once, text victims on iMessage, and stop the money before it's gone, with no victim report needed.

Comment

Inspiration

Money mule scams are spreading fast, and they often go after students and young people with "easy remote job" offers. A scammer steals money from a victim, then passes it through a ring of recruited accounts within minutes. Banks usually find out only after a victim reports it, and by then the money has been cashed out. We wanted to flip that: catch the ring while the money is still moving, and talk to the real people involved, both the victim and the account holder who was often tricked too.

What it does

Ring Radar is a live fraud console for a bank's fraud analyst. It catches scam "money mule" rings while they're happening, with no victim report needed.

  • Scores every transfer live. A simulation engine runs a bank's normal day (paychecks, rent, groceries) and injects random scam attacks. Every transfer gets a risk score from behavior signals: new senders, how much of the incoming money is passed on within minutes, and account age.
  • Finds the ring, not just one transaction. Risk spreads across the transfer graph. When 3 or more connected suspicious accounts are being fed by 3 or more outside senders, Ring Radar flags a ring.
  • Freezes and traces. It freezes the whole ring at once, traces each victim's money hop by hop (stopped, cashed out, or refused), and writes a case file the analyst can release or send to police.
  • Talks to real people on iMessage. Through Photon, an agent texts real iPhones. The victim hears "we stopped your $800 payment," and the recruited account holder gets "who asked you to move this money?"
  • Turns messy replies into leads. Gemini pulls the recruiter, the lure, and any backup account number out of the holder's free-text reply. That backup account is frozen before the scammers can use it, so when they regroup, every payment is refused.
  • Runs on real banking records. Every account, scam transfer, and cash-out is a real record in Capital One's Nessie API.

How we built it

  • Backend: TypeScript, Node, and Express. A simulation engine generates normal banking traffic plus randomized scam attacks, and every account, transfer, and withdrawal is created through the Capital One Nessie API.
  • Detection engine: three layers. Behavior scoring rates each account on new senders, how fast it passes money on, and account age. Graph risk spreading pushes risk across connected accounts. Ring detection looks for clusters of 3 or more suspicious accounts fed by 3 or more outside senders.
  • Response: once a ring is found, we freeze all its members, trace each victim's money hop by hop, and generate a case file.
  • Agent: Photon's iMessage platform sends texts to real phones and receives replies. Gemini extracts structured leads (recruiter, lure, backup account) from free-text replies, and the system acts on them right away.
  • Dashboard: plain HTML, CSS, and SVG with no framework. Live updates stream over Server-Sent Events, driving the network map, the transfer feed, the iPhone conversation panel, and the case file.
  • Evaluation: a harness that runs 100 unseen random attacks and measures detection rate, innocent accounts frozen, and money stopped.
  • We used an AI coding assistant during development and credited it in our README.

Challenges we ran into

  • Avoiding false alarms. Real people also get money from lots of new senders, like splitting rent or getting paid by a new job. Tuning the scoring so it catches rings without freezing innocent accounts took many rounds.
  • Not grading our own homework. We built both the attacker and the detector, so we randomized ring size, timing, and hop counts, and tested on attacks the detector had never seen.
  • Real messages are messy. People reply with typos, slang, and half-sentences. Getting Gemini to reliably pull an account number out of "i was meant to send the rest to 4417-8823 tmrw" took careful prompting and checks.
  • Keeping everything live. Syncing the simulation, Nessie records, iMessage replies, and the dashboard in real time over Server-Sent Events, without the UI lagging.
  • Designing for an analyst. Our first dashboard showed everything at once and was too cluttered. We redesigned it so the screen stays calm until a ring is caught, then shows the incident step by step.

Accomplishments that we're proud of

  • On 100 unseen random attacks, Ring Radar caught 100% of rings and stopped 87.9% of the money, with zero innocent accounts frozen.
  • A real end-to-end loop: a simulated scam triggers real texts to real phones, a real person's reply leads to a real freeze, and the scammers' next move is refused.
  • Every account and transaction is a real Nessie record, not a mock array.
  • It catches rings without waiting for a victim to report anything.

What we learned

  • Fraud is a network problem. One suspicious transfer rarely tells you much, but the shape of the connections between accounts does.
  • Talking to people beats guessing. A single reply from a recruited account holder gave us information that no amount of transaction data could, like the backup account.
  • An AI model is most useful as one part of a pipeline: here it turns messy human text into structured data that the rest of the system can act on.
  • Measuring false positives matters as much as the detection rate. Freezing an innocent person's account is a real harm.

What's next for Ring-Radar

  • Test on real anonymized transaction data with a bank or credit union partner.
  • Support more ring shapes and scam types, like romance scams, fake landlords, and crypto cash-outs.
  • Let analysts approve or release freezes directly by iMessage.
  • Add a human review step and an appeal path for frozen account holders.
  • Share ring patterns across banks, since mule rings often span several institutions.

Built With

Share this project:

Updates

Submission history