Scamdrill

A fire drill for scams: families set up a safe practice "digital arrest" call, so elderly parents learn to hang up before a real scammer rings.

Comment

Inspiration

In India, scammers call people and pretend to be the police or the CBI. They say "you are under digital arrest", keep the person on the call for hours, and force them to send money. Indians lost ₹1,935 crore to this scam in 2024, according to government data. Elderly parents get these calls, and warning messages on WhatsApp don't prepare them for the pressure of a real one.

Schools run fire drills so that people know what to do without thinking. I wanted the same thing for scam calls: a safe way to practise hanging up.

What it does

ScamDrill is a fire drill for scams, set up by the family.

  1. The child sets it up with a few details: the parent's name, their bank, a grandchild's name and a safe contact.
  2. The parent practises a chat with "Inspector Sharma", an AI playing a fake CBI officer. He follows a real digital-arrest script and uses the family's details.
  3. Every trick is named live. A second AI labels each message with the tactic it uses (authority, urgency, secrecy, and so on), and a pressure meter rises.
  4. The parent wins by hanging up or calling their safe contact. They lose if they share the fake OTP or tap the fake Pay button.
  5. The ending teaches, without shame. It shows the exact message that tricked them and what to do in real life: hang up and call 1930.
  6. The child gets a report card showing which tactics worked, which were caught, and one tip to practise.

It works in English, Hindi and Hinglish.

How we built it

I built it plan-first with the Devpost Learn skill pack in Claude Code: scope, then PRD, then spec, then the build in small tested slices. All the planning docs are in the repo.

  • Frontend: React, TypeScript and Vite. The app is the "referee": it controls the stages, the pressure meter and the endings in plain code.
  • Server: a small Node and Express server that keeps the API key secret.
  • AI: two Groq models. One plays the scammer (gpt-oss-120b) and one labels the tactic (gpt-oss-20b).
  • Privacy: real names never reach the AI. The browser sends placeholders like {PARENT} and fills in the names on screen.
  • Tests: 105 automated tests with Vitest.
  • Demo: a scripted demo version that needs no API key is live on Vercel.

Challenges we ran into

  • Getting an AI to play a scammer safely. The prompt had to explain that this is a training drill the user has agreed to, and each request only asks for one small step of the script.
  • The AI rushed ahead. In Hinglish, it asked for money far too early. The fix was to let the app's code control the pace, and replace any line that breaks the order with a prepared one.
  • Hindi numerals slipped past the safety check. A code typed as ४८२९१३ was not caught at first. Now all Indian-script digits are converted before any check.
  • False alarms. "I was born in 1952" or "my flat is 1204" should not count as sharing a code, so the number rules had to be made smarter.

Accomplishments that we're proud of

  • Losing is decided by code, not by AI. The outcome is always the same for the same action, so it's fair and reliable.
  • Privacy by design. The family's details stay in the browser, and real-looking ID or card numbers are blocked before they are sent anywhere.
  • It never breaks mid-drill. Every AI step has a prepared fallback line.
  • A kind ending. There's no red "FAILED" screen, only the moment, the lesson and the helpline.
  • Three languages, because that's how Indian parents really talk.

What we learned

  • Plan before building. With a clear scope, PRD and spec, the AI agent stayed on track and didn't forget my decisions.
  • Turn every "must never" into a test. The rule "never send real names to the AI" became a test, and that test found a leak I hadn't planned for.
  • Use code where the answer is certain, and AI only where judgement is needed. The AI writes the words; the code sets the rules.

What's next for ScamDrill

  • Test it with real elderly users and improve it from what they say.
  • Voice mode, because real scam calls are spoken, not typed.
  • More scam types, such as the "grandparent in trouble" scam common in the US.
  • A harder mode that hides the red flags once someone has practised.
  • Send a drill by link to a parent's own phone.

Built With

Share this project:

Updates

Submission history