Sachet: Real-Time Scam Call Detection

Defending citizens from Digital Arrest and phone scams. Real-time, privacy-first Indic AI that warns before you transfer money, share an OTP, click an unknown link or get scammed in any other way.

Comment

Sachet (सचेत): Real-Time Scam-Call Risk Detector

"Warn, Never Block." A privacy-first system that listens to the substance of a phone call and protects citizens before the money leaves their bank accounts.

Inspiration

According to the Indian Cyber Crime Coordination Centre (I4C), Indian citizens lost over ₹19,813 Crore to cyber fraud between 2021 and 2024, with Uttar Pradesh consistently among the top 5 most-targeted states. National consumer surveys suggest that 3 in every 4 Indian households receive scam or extortion calls every week.

But this project began with something personal: my own father was targeted by a fraudulent investment caller. The caller used professional financial jargon, isolated him with false urgency, and convinced him to move his hard-earned savings into a bogus portal. Seeing the psychological toll and helplessness that fraud inflicts on ordinary families changed how I saw the problem.

Passive number-tagging apps like Truecaller are no match for organized syndicates that use fresh burner SIMs and spoofed numbers. We needed technology that listens to what is being said and steps in while the call is happening.

That became the mission of Sachet (सचेत), which means "alert" in Hindi.

What It Does

Sachet is a real-time scam-call risk detector built for the linguistic and psychological patterns of Hindi and Hinglish phone calls. It follows a defensive "Warn, Never Block" philosophy: it empowers the user without interrupting legitimate conversations.

Key Features

Feature Description
Turn-by-Turn Telemetry Transcribes and analyzes every utterance live, tracking how the conversation escalates.
Multi-Vector Threat Ladder Detects the core mechanics of coercive scams (see below).
Instant Risk Gauge A radial risk score $S \in [0, 100]$ labeled Normal, Caution, or High Risk.
Plain-Language Explanations Hinglish explanations of why a call is risky, with direct links to the National Cyber Crime Helpline (1930 / cybercrime.gov.in).
Zero-Knowledge Evidence Export Transcripts and risk histories stay ephemeral in server memory. Victims can download them locally as an evidentiary log for police reporting.

The Multi-Vector Threat Ladder

  • Authority Impersonation: Police, CBI, ED, TRAI, Cyber Crime Cell, court officials
  • Coercive Threats: "Digital Arrest", non-bailable warrants, fabricated contraband or parcel seizures
  • Forced Isolation & Secrecy: "Stay in a closed room", "don't tell your family"
  • Critical Financial Demands: UPI transfers, "RBI safe accounts", OTPs, ATM PINs, remote-desktop tools (AnyDesk / TeamViewer)
  • Victim Compliance & Vulnerability: Panic, confusion, and submission signals from the receiver

How We Built It

We built Sachet in five structured phases.

Phase 1: Synthetic Dataset Engineering

Authentic Indic-language scam recordings are proprietary or confidential, so we built a conversational data-generation pipeline (datagen/generate.py). Using LLM prompt framing with strict schema validation, we generated paired bilingual dialogues across 31 call scenarios: 17 scam types and 14 legitimate look-alikes. The legitimate calls matter as much as the scams, because they teach the model not to panic at a real bank, delivery, or HR call.

Scam scenarios (17)

  1. Digital arrest
  2. Fake investment
  3. KYC / bank block
  4. Courier / customs
  5. Electricity bill threat
  6. UPI refund or sent-by-mistake
  7. Lottery / prize
  8. Tech support
  9. Fake delivery OTP
  10. Part-time job or task fraud
  11. Loan app threat
  12. Sextortion
  13. Relative in trouble
  14. Fake customer care refund
  15. SIM disconnection (TRAI)
  16. Credit card limit upgrade
  17. Marketplace QR scam

Real / normal scenarios (14)

  1. Genuine bank call mentioning OTP safety
  2. Delivery call
  3. Genuine delivery asking for OTP at the door
  4. Relative asking for money
  5. School
  6. Doctor's office
  7. Telemarketer
  8. Government survey
  9. Customer care callback you requested
  10. Genuine loan or card sales call
  11. Real electricity department notice
  12. Genuine merchant refund
  13. HR or interview call
  14. Insurance renewal reminder

Phase 2: Baseline Benchmarking

We evaluated several architectures on identical multi-turn call transcripts, comparing zero-shot prompting against multilingual transformers (XLM-RoBERTa and Google's MuRIL).

Phase 3: Fine-Tuning MuRIL for Code-Mixed Speech

We fine-tuned google/muril-base-cased on Romanized Hindi and Devanagari text for sequence classification. MuRIL was chosen for its pre-training on 17 Indian languages and its strong handling of phonetic transliterations.

Phase 4: Hybrid Risk Formulation & Compound Escalation

Pure ML models struggle with sudden compound threats. We built a hybrid inference pipeline that fuses the neural scam probability with turn-aware contextual heuristics:

$$S_{\text{raw}} = (1 - \alpha) \cdot S_{\text{MuRIL}} + \alpha \cdot H_{\text{heuristic}}$$

where $\alpha \in [0.35, 0.65]$ scales dynamically with the diversity of confirmed threat vectors. The score is then bounded by progressive turn damping:

$$S_{\text{final}} = \min\left(S_{\max}(n),\ \max\left(S_{\min},\ S_{\text{raw}} - \delta_{\text{safe}}\right)\right)$$

Phase 5: High-Performance Engine & Streaming UI

We implemented an asynchronous FastAPI backend with session-state caching, automated token purging, Whisper-based speech-to-text, and native browser Web Speech API integration, all behind an accessible, responsive web interface.

Challenges We Ran Into

1. The Failure of Baseline Model 1 (XLM-RoBERTa)

Our first model, trained on standard multilingual embeddings, performed poorly on colloquial Hinglish:

  • It struggled with phonetic variation (e.g., "galti se transfer ho gaya" vs. "mistakenly sent").
  • It had a 30.0% false-alarm rate and a Mean Absolute Error (MAE) of 14.1 points.
  • Simple negations like "police phone par OTP nahi maangti" triggered false-positive spikes.

We revised the architecture, moving to a fine-tuned MuRIL v2 paired with a context-aware negation-suppression parser (NEG regex mask).

2. The Cloud Deployment Memory Crash (512 MB OOM)

On Render's free tier, the service crashed immediately with Exit Code 137 (Out of Memory). Loading everything at once needed over 1.3 GB of RAM against a 512 MB ceiling:

Component Approx. RAM
PyTorch ~400 MB
MuRIL weights ~450 MB
Faster-Whisper ~500 MB

3. Architecting the Low-RAM Dual-Mode Pipeline

When Hugging Face put free compute Spaces behind a paid PRO barrier, we redesigned the deployment as a decoupled architecture:

  • The fine-tuned MuRIL model is hosted on the Hugging Face Model Hub and called over HTTP through the free Serverless Inference API.
  • The FastAPI server handles heuristics and serves the static UI.

This cut server RAM from ~1,300 MB to ~45 MB, giving us stable hosting at zero cost.

4. Speaker Cross-Talk & Real-Time Sync

Segmenting caller and receiver utterances during live microphone capture required an event-driven boundary-flush mechanism in the frontend, so transcriptions never bleed between speaker roles.

Accomplishments That We're Proud Of

On a holdout test set of 92 multi-turn calls, fine-tuned MuRIL v2 clearly outperformed the baseline:

Metric XLM-RoBERTa (Baseline) MuRIL v2 (Ours)
Scam Detection Recall 86.4% 95.5% (96.6% on validation)
Mean Absolute Error 14.1 pts 7.4 – 10.2 pts
Early-Warning Lead Time ($\tau_{\text{alert}}$) n/a 0.32 – 0.46
Processing Latency n/a < 150 ms per turn
  • Early warning: with $\tau_{\text{alert}} = 0.32\text{–}0.46$, Sachet alerts the citizen within the first third of the call, well before any payment or credential transfer.
  • Real-time speed: turn evaluation, signal extraction, and risk compounding finish in under 150 ms.
  • Zero-cost infrastructure: we built, fine-tuned, and deployed a working end-to-end AI security service on 100% free-tier tooling, without spending a single rupee.

What We Learned

  • Indic NLP & Romanized transliteration: Fine-tuning on code-mixed Hinglish needs careful vocabulary handling. Standard Western tokenizers fragment Hinglish words into too many subwords, which weakens semantic attention.
  • Hybrid systems beat pure LLMs: In high-stakes security, relying only on an LLM is too slow and prone to hallucination. A lightweight neural classifier anchored by deterministic, explainable heuristic guards gives far better reliability and auditability.
  • Production resource engineering: We gained hands-on experience with asynchronous FastAPI lifecycles, Docker image slimming with CPU-only wheels, memory profiling under a strict 512 MB limit, and decoupled serverless inference.

What's Next for Sachet

  • Native on-device mobile integration: Move the engine from browser simulation to an Android background service using the CallScreeningService API and ONNX Runtime / INT8 quantization, enabling on-device evaluation with zero cloud data transmission.
  • Acoustic & deepfake voice biometrics: Detect AI-cloned voices, recorded background audio artifacts (looped police-radio chatter, typing sounds), and stress patterns in the receiver's voice.
  • Dialect expansion: Extend training corpora to regional vernaculars that fraud syndicates exploit, including Bhojpuri, Marathi, Bengali, and Telugu.
  • Automated 1930 / I4C reporting: One-click, anonymized threat-payload forwarding to India's National Cyber Crime Reporting Portal to help freeze mule bank accounts in real time.

Sachet (सचेत): because every family deserves a warning before it's too late.

Built With

Share this project:

Updates

Submission history