ScamLens

An AI triage tool that tells finance, support, and HR teams whether a message is a scam, shows the exact evidence, and says "uncertain" when it isn't sure.

Comment

TRACK: AI + Cybersecurity

The problem

Scam and impersonation messages work by pushing people to act before they think. For businesses this is costly: finance teams get "our bank details changed, please pay today" emails, support teams get impersonation attempts, and HR teams get fake candidate messages. Business email compromise alone cost US victims about $3.05 billion in 2025 (FBI IC3 figures), and most of it moved by wire or ACH. Teams can't read every message with suspicion, and most existing tools give a bare yes/no with no explanation, so nobody learns from the verdict and a wrong guess is expensive.

Who it's for

Small and mid-size teams that handle payments, customer requests, or inbound candidates, and don't have a dedicated security analyst.

What ScamLens does

You paste a suspicious message. ScamLens returns:

  • a risk score and one of three outcomes: flag, needs review (uncertain), or low-risk
  • the specific evidence it found (for example urgency, a payment-detail change, a lookalike link), shown separately so a human can verify it in seconds
  • a plain-language explanation of why

The "uncertain" outcome is deliberate. When the layers disagree, the tool says so and routes the message to a human instead of pretending to be sure.

How it works (technical approach)

Three layers feed one score:

  1. Evidence rules: [deterministic checks, e.g. urgency language, payment-change phrases, suspicious links/domains, [add what you actually built]]
  2. A text classifier: [model type, e.g. TF-IDF + logistic regression] trained on [dataset name]
  3. An LLM reasoning step: Google Gemini (free tier) for context-aware judgement and the explanation A fusion step combines the three scores. If they disagree by more than 45 points, or the LLM isn't confident in the middle range, the result becomes "uncertain". Stack: Python, [FastAPI], [frontend], scikit-learn, Gemini API, Supabase/[if used]. Everything runs on free tiers.

Evaluation (honest results)

I tested on a hold-out set of 28 messages (14 scams, 14 genuine) that I did not tune on.

  • Rules + classifier, no LLM: accuracy 0.82, recall 0.71, false-alarm rate 0.07
  • Evidence rules only: accuracy 0.79, recall 0.57, false-alarm rate 0.00
  • Full pipeline with the LLM: accuracy 0.68, recall 0.43, false-alarm rate 0.07 Adding the LLM lowered the headline numbers. The reason is that all 8 "missed" scams were labeled "uncertain" (scores 42-64), not "safe": of the 14 scams, 6 were flagged, 8 were uncertain, and none was called low-risk. The scoring script counts "uncertain" as "not flagged". I report these results as they came out and did not retune on this set. This is a small pilot set, so the numbers are indicative, not proof.

Real-world impact

ScamLens is a first-pass filter: it sorts incoming messages into flag / review / clear with the reasons attached, so people spend their attention where it matters, and a human always makes the final call on uncertain cases.

Challenges

Combining three very different signals into one trustworthy score, and keeping the evaluation fair (a single hold-out run, no tuning afterwards).

What I learned

Explainability and honest uncertainty matter more than a single accuracy number, and an extra AI layer doesn't automatically improve results.

What's next

Retune the fusion logic on a fresh labeled set, add link and attachment analysis, and test with real finance and support workflows.

Built With

Share this project:

Updates

Submission history