Scam Whip

Inspiration

After we saw that people were being taken advantage by scammers, we began taking notes on how the scam works and what is involved with things like false domain names, urgency, and mismatches. We wanted to design a solution that would use this information and notify all the users.

What it does

The ScamWhip program scans the incoming e-mails in real time for any attempts of scams or phishing by analyzing their spoofed senders, fake links, and urgent messages, informing you instantly about them.

How we built it

We used python and various libraries to build our backend among these, SQLite and FastAPI were the most used and relevant overall.

Challenges we ran into

The biggest challenge that we have faced is the problem of false positives where initially ScamWhip raised so many alerts for genuine marketing and transactional emails such as shipping confirmation emails and email re-engagement campaigns that it resulted in people not heeding the alerts at all. We had to redesign our detection algorithm completely based on the concept of weighted scoring as against the initial one that was based purely on keyword matching.

Accomplishments that we're proud of

We’re proud that the weighted detection engine in ScamWhip is now robust enough to reliably tell a pushy marketing email from a real phishing attempt, with a massive reduction in false-positives from our early prototype.

What we learned

We found that exposing scams isn’t about finding “bad words” so much as it is about understanding behavior, how items work together to confuse someone in the moment. We also found that a security tool is only useful when people actually trust its warnings, which led us to prioritize accuracy over aggressiveness.

What's next for Scam Whip

We want to take ScamWhip beyond email and into the SMS and messaging apps, where phishing (or “smishing”) attacks are becoming just as pervasive. We also have a browser extension in the pipeline so links can be checked as soon as they are clicked rather than just when the email arrives in the inbox.