ScamPause

A pause button for scams: paste a suspicious message and get a risk score, plain-language warning signs, a 10-second pause and a ready-to-send note to someone you trust.

Comment

Inspiration

Scam messages almost always rely on one thing: panic. Whether it’s a fake police officer, a bank alert, or a "relative" in trouble, they want you to click a link or transfer money before your brain has time to process what's happening. We built ScamPause to do exactly what the name says—force a moment of calm. We wanted to put a buffer between receiving a scary message and actually acting on it.

What it does

Instant Risk Scoring: Paste any message (it handles English, Chinese, or a mix of both) and get a 0–100 risk score instantly. Explainable Warnings: Instead of a black-box "danger" sign, it highlights the exact suspicious words and explains why they are risky in plain English/Chinese. Offline Link Checking: We check URLs for lookalike domains (e.g., rnaybank2u imitating Maybank), abused brand names, and URL shorteners. It does this entirely offline—the app never actually visits the malicious link. The "Pause" Feature: If a message scores high risk, the UI locks up for 10 seconds. You literally can't do anything but read the matched warning signs (like authority threats + urgency + money requests). Draft a message: One tap creates a pre-written text you can forward to a trusted family member to ask for a second opinion. Evaluation View: We added a transparency mode where users can see how the engine performs on our test dataset and manually tweak the strictness threshold. (Mainly for older adults, international students living alone, or anyone's parents who might not be super tech-savvy. Basically, it's for the people we care about.)

How we built it

We deliberately went zero-dependency: just plain HTML, CSS, and vanilla JavaScript. Everything runs locally in the browser, meaning private messages are never uploaded to any server. The detection engine is rule-based, covering 10 categories (authority, threats, money, remote access, etc.). We implemented negation handling (so "never share your TAC code" doesn't get flagged as a scammer asking for a TAC). For link analysis, we used character normalization (mapping rn to m, 0 to o) and edit distance algorithms to catch clever typosquatting. To tune the engine, we manually created a synthetic dataset of 120 messages (half English, half Chinese, 50/50 split between real scams and legit messages).

Challenges we ran into

The "False Positive" Nightmare: Real bank SMS alerts actually sound a lot like scams. They use words like "Never share this OTP" or "Fund transfer to...". We had to build specific "protective notice" rules and negation logic so legit OTPs wouldn't trigger alarms. Catching Lookalike Domains: Simple regex doesn't catch rnaybank. Normalizing look-alike characters before running the domain comparison was a pain to implement in vanilla JS but solved most of our edge cases. Finding the sweet spot between annoying users with false alarms and actually missing real scams was tough. We built the threshold slider in the evaluation view so we could visually debug this trade-off.

Accomplishments that we're proud of

We managed to hit around 95% accuracy (with ~96% precision and 93% recall) on our test datasets for both languages. More importantly, we did it completely offline without relying on heavy backend NLP models, making it instant and privacy-preserving.

What we learned

Rules and regex are incredibly effective against aggressive, high-pressure scams. However, "gentle" scams (like pig-butchering or crypto investment groups that just start with a polite "Hi, are you the tour guide?") are notoriously hard to catch without context.

What's next for ScamPause

Adding OCR so users can just upload a screenshot of the chat and do our best to integrate a lightweight LLM API for a "second opinion" on those tricky conversational scams. Besides, we also have idea to download other language modle into it.

Built With

Share this project:

Updates

Submission history