Scam-HoneyPot

Inspiration

India lost over ₹11,000 crore to cyber fraud in a single year — and the most common scams (digital arrest, KYC expiry, fake courier, UPI refund) all follow the same playbook: call, scare, pressure, collect. Blocking and reporting are reactive; by the time a number is blacklisted, the scammer has moved to a new SIM. We asked: what if the scammer's biggest weapon — their time — could be turned against them? Honeypots have defended networks for decades. We built one for the phone line.

What it does

Scam Honeypot runs an AI-powered decoy conversation with a scammer in real time:

A lifelike persona — "Ramesh Gupta", a 62-year-old retired government employee who speaks Hinglish — keeps the scammer engaged, confused, and on the call as long as possible.
Four scam scripts — Digital Arrest, KYC Expiry, Courier Scam, and UPI Collect Refund — each with its own simulated scammer so the demo works with zero real criminals involved.
A canary guardrail — sensitive details (real-looking but invented UPI IDs, phone numbers, account numbers) are protected so the decoy never leaks anything a scammer could actually use.
An intel extractor — every message is mined for UPI IDs, phone numbers, URLs, and account numbers using an LLM extractor.
A ready-to-file report — when the scammer gives up, the app generates a markdown report with the full transcript, all extracted indicators, and a draft complaint for India's Cybercrime Helpline (1930).

The killer metric: time wasted. Every minute the scammer spends on our decoy is a minute they can't spend on a real victim.

How we built it

Python + Streamlit for the interactive dashboard with live chat, intel panel, and report download.
Two LLM agents — a decoy persona and a simulated scammer — driven by Qwen2.5-72B-Instruct on Featherless AI's OpenAI-compatible API.
Guardrails — output sanitization (collapsing degenerate punctuation runs, rejecting contentless stubs) plus a canary-leak blocker that prevents the persona from ever revealing sensitive data.
LLM-based extraction — a JSON extractor pulls structured fraud indicators (UPI IDs, phone numbers, URLs, account numbers) from raw conversation text.
Automated reporting — a report generator with a draft 1930 complaint.
Testing — a 40-test pytest suite covering the guardrail, extractor, persona, and conversation loop.
Deployment — live on Streamlit Community Cloud, with API secrets kept out of the codebase via environment variables.

Challenges we ran into

Model quality: mid-size models degenerated into punctuation spam ("Ha!!!!! OK!!!!") on our persona prompt. We fixed this two ways — a sanitization guardrail that collapses punctuation runs and rejects contentless replies, and a move to a stronger 72B model that produces natural, human-like Hinglish.
Keeping the decoy safe: the persona must never leak a real or real-looking canary value, or we'd be feeding scammers ammunition. We built a string-based canary blocker that scrubs replies before they go out.
Balancing realism with control: the decoy must stall without being obvious, so the conversation loop watches for repetition and "scammer_stuck" signals to end runs cleanly.
Time: everything here was designed, built, tested, and deployed within the hackathon window.

What's next

Live call integration (Twilio/telephony) so a real scammer can be patched into the decoy.
Automatic complaint filing against harvested numbers via the 1930 portal.
A shared community blocklist of UPI IDs and numbers extracted by deployments.