Inspiration
What it does
How we built it
Challenges we ran into
Accomplishments tha## Inspiration
Scammers research you before they message you, and AI has made that research fast. People aged 20 to 29 reported $540.1 million in losses to the FBI in 2024. Data-removal services show you a list of broker sites. None of them show you what a scammer would actually do with everything else you have posted. We wanted to see ourselves the way a scammer does, then fix it.
What it does
You sign in and Scammer's View scans your own public footprint.
- Live scan: parallel AI agents search the public web for facts about you and stream them onto an attack map as they are found.
- Attack map: shows how those facts chain into an account takeover, step by step, with the source of every fact.
- Exposure score: one number from 0 to 100, with the three facts doing the most damage.
- Practice attacks: a scam text, email and voicemail script built from your own facts, with every tell marked.
- Fixes: a ranked lock-down list. Tick a fix and the chain breaks and the score drops.
- Photos and video: an on-device face scan finds photos of you, and Gemini reads what they reveal, such as a street sign or a school logo.
It only works on yourself, uses public information only, never sends anything, and keeps nothing after the session.
How we built it
- Next.js, React and TypeScript for the app, with findings streamed over server-sent events.
- Google Gemini API for everything the scammer would do by hand: search agents with Google Search grounding, structured extraction, attack-chain reasoning, practice messages, and photo and video understanding.
- In the browser: MediaPipe and face-api for the face scan and photo match, and a speaker model for voice matching, so that data stays on the device.
- React Flow for the attack map, Recharts for charts, Leaflet for the places map, Motion for animation.
- Google sign-in locks every scan to the signed-in person. There is no field anywhere to type someone else's name.
Challenges we ran into
- Namesakes. Many people share a name, so every fact needs evidence that it is about you: your email, your GitHub, your school, or your face.
- Duplicates. Different agents find the same fact worded differently. We check for duplicates before a fact reaches the screen.
- Social sites block anonymous reading, so most findings come from search results, GitHub and public pages.
- Switching AI providers mid-hackathon, including a stale API key on one laptop that silently overrode the new one.
- Keeping it safe. A tool like this could be misused, so the self-only rule is enforced in code and tested, not just promised.
What we learned
- A handful of harmless-looking facts is enough to build a convincing scam.
- Fixing three things usually breaks the whole chain.
- Grounded search with citations makes AI findings checkable, which matters when the subject is a real person.
What's next
Family mode so relatives can check each other's scores without sharing details, campus group sessions for orientation, and weekly change alerts.t we're proud of
What we learned
What's next for Scammer's View
Built With
- apify
- elevenlabs
- face-api.js
- gemini
- github-api
- google-oauth
- google-search-grounding
- leaflet.js
- mediapipe
- motion
- nextjs
- node.js
- openstreetmap
- react
- react-flow
- recharts
- server-sent-events
- shadcn-ui
- tailwindcss
- transformers.js
- typescript
