Scam Sense

Inspiration In 2026, the "Trust Crisis" is the biggest threat to the digital economy. We’ve moved beyond simple phishing emails to hyper-realistic AI-generated "spear-phishing" campaigns and deepfake social engineering. The average user—and even the average IT professional—can no longer distinguish between a legitimate alert from their bank and a malicious agent designed to steal their identity.

We built ScamSense because we believe the only defense against bad AI is better, faster, and more ethical AI. We wanted to build a guardian that doesn't just match keywords but actively investigates threats using the reasoning capabilities of the Elasticsearch Agent Builder. We wanted to democratize cybersecurity analysis, giving every user a personal security analyst in their pocket.

What it does ScamSense is an autonomous fraud detection agent. Users can input text, URLs, or upload screenshots of suspicious communications.

Unlike traditional spam filters that use static rules, ScamSense acts as an intelligent investigator:

Contextual Analysis: It "reads" the message to detect psychological triggers (urgency, fear, greed) common in 2026-era fraud.

Agentic Verification: It doesn't just guess; it uses tools. The Agent autonomously queries global reputation databases and our internal Elastic vector store to cross-reference sender IDs and domains.

RAG-Powered Education: Instead of a simple "Block" or "Allow," it generates a natural language explanation citing why it flagged the message, retrieving similar known scam patterns from the database to educate the user.

How we built it We architected ScamSense around the Elasticsearch Agent Builder to create a true "Reasoning Engine."

The Brain (Elastic Agent): We configured the Agent with specific system instructions to act as a "Senior Cybersecurity Analyst." We defined custom tools that allow the agent to fetch data from external APIs and our internal knowledge base.

The Memory (Vector Search): We ingested a massive dataset of known scam scripts and verified banking templates into Elasticsearch. We use ELSER (Elastic Learned Sparse EncodeR) for semantic retrieval, ensuring the agent understands the meaning of a scam, not just the keywords.

The Backend: A high-performance Python (FastAPI) wrapper that handles the chat session state and communicates with the Elastic Cloud instance.

The Frontend: A responsive React application that visualizes the Agent's "thought process" so users can see the verification steps happening in real-time.

Challenges we ran into Hallucinations vs. Verification: Early in development, the Agent would confidently declare safe messages as scams based on minor typos. We solved this by implementing a "Confidence Threshold" in the Elastic Agent Builder, forcing the model to rely on retrieved documents (RAG) rather than its internal training data for factual claims.

Latency in Agent Chains: Chaining multiple reasoning steps (e.g., Check URL -> Check Text -> Summarize) created a delay. We optimized this by parallelizing the vector search and the heuristic analysis tools within the Elastic pipeline.

Accomplishments that we're proud of True Agentic Behavior: We successfully built an agent that decides which tools to use. If you paste a URL, it uses the URL scanner. If you paste text, it uses the semantic analyzer. It feels alive.

The "Explainability" Layer: Achieving a transparent AI that cites its sources. When ScamSense flags a message, it highlights the exact section of the text that triggered the alert, powered by Elastic's highlighting capabilities.

Project Completion: Taking a complex concept from idea to a working, deployable prototype within the hackathon timeframe.

What we learned The Power of Context: We learned that metadata (timestamps, sender headers) is just as important as the message body for the Elastic Agent to make accurate decisions.

Elastic is more than Search: We discovered that the Agent Builder transforms Elasticsearch from a database into a logic layer. It simplified our stack significantly by handling the RAG orchestration internally.

What's next for Scam Sense Multi-Modal Protection: We plan to integrate Audio Analysis to detect AI Voice Cloning in real-time calls.

Browser Extension: Moving the Agent from a web app to a browser sidebar to passively scan web pages and emails as the user browses.

Community Defense Grid: Allowing users to "Report" new scams, which are instantly vectorized and added to the Elastic index, updating the defense model for all users globally in near real-time.

Built With

• elastic-agent-builder
• elasticsearch
• elser
• fastapi
• kibana
• openai
• python
• rag
• react
• vector-search