SCAM SWARM

• 

  1st

• 

  2nd

• 

  4th

• 

  3rd

Inspiration

India loses thousands of crores every year to UPI payment scams, fake QR codes, phishing links disguised as bank or KYC alerts, and fraudulent marketplace listings. Most victims aren't careless — they're just human, and scammers are very good at creating urgency and panic in the few seconds before someone clicks "Pay Now."

We kept noticing the same pattern in every scam: it's never one red flag, it's several small ones stacked together — a slightly-off domain name, an unnaturally urgent message, a payment request that doesn't quite match how real institutions communicate. A single AI check can miss this. But a team of specialized checks, each looking for a different signal, catches what one generalist pass would not.

That's what pushed us toward Scam Swarm: instead of one AI giving a verdict, build a small investigation team of AI agents — each with one job — that hands off findings to the next, the same way a real fraud analyst team would.

What it does

Scam Swarm lets a user upload a suspicious screenshot, paste a message, or drop in a URL — anything that smells like a scam. Five AI agents then investigate it in sequence:

• Collector Agent — pulls out the raw evidence: phone numbers, UPI handles, URLs, emails, and message text (using OCR for screenshots)
• Scam Analyzer Agent — reads the extracted text for urgency language, fake reward/lottery patterns, fake KYC or bank-alert phrasing, and impersonation attempts, and assigns a preliminary risk score
• Verification Agent — examines any extracted domain/URL for structural red flags like typosquatting, suspicious subdomains, and brand impersonation
• Evidence Agent — compiles everything into a clean evidence list and a timestamped investigation timeline
• Reporter Agent — produces the final verdict, a combined risk score, a plain-language explanation, and a draft complaint summary the user can take to a cybercrime portal

The user watches this happen live — each agent lighting up as it works — and ends up with a fraud risk gauge, an evidence breakdown, and a downloadable PDF report, instead of a single flat "this looks suspicious" message.

How we built it

Frontend: React + Vite, TailwindCSS, Framer Motion for the agent pipeline animations and page transitions, and ShadCN UI for component primitives. The UI is built around a dark, glassmorphism, cybersecurity-command-center aesthetic, since the biggest design goal was making the multi-agent nature of the tool visible, not just claimed.

Backend: Node.js + Express, with each of the five agents implemented as its own module with a narrowly-scoped Gemini system prompt — no single agent shares a prompt with another, since mixing responsibilities made outputs noisier in early testing. Tesseract.js handles OCR for screenshot uploads, and the agent pipeline streams live status updates to the frontend via Server-Sent Events so the orchestration screen can show real progress, not a fake loading spinner. PDF report generation is handled with pdf-lib.

Why a pipeline, not one big prompt: We could have asked one Gemini call to "detect if this is a scam," but that collapses the most interesting part of the idea — visible reasoning at each stage. Splitting it into five agents with distinct jobs means each one's output is independently inspectable, and the final verdict is explainable: you can see exactly which agent flagged what, not just trust a black-box score.

Challenges we ran into

• Keeping agent outputs structurally consistent. Getting five separate Gemini calls to reliably return clean, parseable JSON — without one agent's malformed output breaking the next agent's input — took real prompt discipline. We ended up being very explicit about output schemas in every system prompt rather than relying on the model to infer structure.
• OCR accuracy on real-world screenshots. Scam screenshots are often low-resolution, cropped, or have overlaid UI chrome, which made clean text extraction harder than expected.
• Making "verification" honest without real WHOIS/domain-age data. Since we didn't have time to integrate a live domain-age API, the Verification Agent reasons about domain structure heuristically — we made sure to label this clearly as a heuristic estimate rather than implying a live lookup, so the tool doesn't overstate its own certainty.
• Real-time orchestration without it feeling fake. Streaming actual agent completion events (not a scripted animation) through SSE so the frontend pipeline visualization reflects real backend state, not a pre-timed fake.

Accomplishments that we're proud of

• A genuinely visible multi-agent pipeline — the user can watch each agent complete its work in sequence, not just see a spinner and a final answer
• A tool that's actually usable by someone non-technical: upload a screenshot, get a plain-language verdict and a recommendation, not a wall of jargon
• A design that takes the problem seriously — calm, authoritative, slightly alarming where the risk warrants it, without being gimmicky

What we learned

Multi-agent systems are most valuable not because they're "smarter" than one big prompt, but because they're more inspectable — splitting a problem into agents with narrow responsibilities makes every step of the reasoning visible and debuggable, which matters enormously for a tool meant to be trusted with something as consequential as fraud detection.

What's next

• Real domain-age and WHOIS integration for the Verification Agent
• A WhatsApp/SMS forwarding bot so users can report suspicious messages without leaving their messaging app
• Multilingual scam detection, since many scams in India target users in regional languages, not just English/Hindi
• A community-reported scam database so the Analyzer Agent improves over time from real, anonymized reports

Built With

• css3
• gpt-4o-mini
• html5
• javascript
• netlify
• netlify-serverless-functions
• node.js
• openrouter-api