ScamBait X-Ray

A privacy tool that shows college freshers how a scammer would target them using their public bio, then helps them fix it in 60 seconds.

Comment

## Inspiration

Almost every college fresher has seen it: a message that says "Hi [Name], final-year students of [Your College] are selected for a remote internship. Pay a small fee to confirm your seat." What makes it convincing is that it feels personal, and it feels personal because we ourselves put those details on LinkedIn, Instagram and internship profiles.

Most privacy tools show a list of what is public ("your email appears in 3 places") and stop there. That creates fear, not action. We asked a different question: what if people could see their profile the way a scammer sees it?

What it does

ScamBait X-Ray is a small browser tool for college freshers (18–22) who are building their first public profiles and applying for internships.

  1. Paste your own public bio (LinkedIn "About", Instagram bio, etc.). No login, no scraping.
  2. See the scammer's view. The tool spots risky details such as college name, city, phone or email, birthday and "looking for internship", shows an exposure level (Low / Medium / High) and generates a synthetic fake-scam message built from those details, with red flags highlighted.
  3. Fix it in about 60 seconds. Short fix cards (e.g. "Remove your college name from your bio", "Make your phone number private") and a Before / After view show how the scam message gets weaker and the exposure level drops as details are removed.
  4. Scam or Real? mini-game. A short quiz of a few fake and real messages with instant explanations, so users learn the red flags themselves.

Example of a safer outcome: with a sample profile, exposure goes from High to Low after removing four details, and the generated scam message loses its personal hooks.

Limitation: the tool only analyses the text the user pastes. It cannot find data elsewhere on the internet, and the exposure level is a rough estimate, not a guarantee of safety.

How we built it

  • Frontend: HTML, CSS and JavaScript, running entirely in the browser (no backend)
  • Detection: regular expressions for phone numbers, emails and dates, plus keyword lists for colleges, cities and internship phrases
  • Scam message generator: reliable templates, with clearly marked placeholders filled from the detected details
  • Hosting: [GitHub Pages / Netlify], so the demo link stays live through judging
  • Language: [English / Hinglish toggle, if you build it]

Pre-existing work vs. built during the hackathon (Oct 17 – Nov 22, 2026): [Our earlier Digital Footprint X-Ray only displayed what information was exposed. During this hackathon we built the scammer's-eye view, the synthetic scam message generator, the Before/After comparison, the fix cards and the Scam or Real? game. / Everything was built during the hackathon.] (Keep whichever is true.)

Credits: [libraries/fonts used], AI assistance (Claude by Anthropic) for brainstorming, planning and code assistance, and all sample profiles and messages are synthetic.

Challenges we ran into

  • Not creating a new risk. A tool that shows how people can be targeted could be misused to profile others. So we only analyse text the user pastes about themselves, include no search-by-name feature, store nothing, and use only fictional example profiles.
  • Honest scoring. Turning a messy bio into a "risk level" is guesswork. We label it clearly as an estimate and show which detail caused which risk, instead of a single scary number.
  • Making it useful, not scary. Early ideas just listed problems. We redesigned the flow so every warning comes with one clear action.
  • Handling imperfect input. Empty, very short or unusual text needed friendly messages instead of broken results.

Accomplishments that we're proud of

  • A complete flow of paste → understand → fix that works in under a minute
  • A Before/After view that shows the safer outcome instead of just claiming it
  • A privacy-first design: everything runs in the browser and nothing is stored [confirm this before submitting]
  • Keeping the scope small so one everyday situation actually works well

What we learned

  • Showing the attacker's perspective is far more memorable than listing exposed data
  • Responsible design means deciding what not to build (no searching other people, no live scraping)
  • Clear limitations make a safety tool more trustworthy, not less
  • Small, simple tools can still change behaviour if they end with a concrete action

What's next for ScamBait X-Ray

  • More scam types: fake KYC calls, UPI fraud and "digital arrest" scams
  • Hindi, Telugu and other regional language support
  • A browser extension that warns before you publish a bio
  • Short classroom and hostel workshop versions for colleges
  • Testing with real students (with consent) to improve the risk model and measure whether the fixes get used.

Built With

Share this project:

Updates

Submission history