ScamSathi

Before You Trust, Let ScamSathi Investigate.

Comment

Inspiration

Every day people in Bangladesh get messages like "Your bKash account will be blocked, send your PIN", "You won a prize — click here", or fake job and shopping offers. Most people can't tell whether a link or message is dangerous, and the tools that can (Google Safe Browsing, VirusTotal, URLhaus) are built for security professionals and only speak English. We wanted a "friend" (সাথী) that anyone can ask: "Is this a scam?" — and get a clear answer in Bangla or English before they trust it.

What it does

ScamSathi BD lets a user paste a suspicious URL, SMS, chat message, email, or offer. An AI agent then investigates it like an analyst: it extracts and validates URLs, checks them against Google Safe Browsing (plus VirusTotal and URLhaus when configured), analyses the message for scam patterns common in Bangladesh (OTP/PIN requests, prize claims, urgency, fake bKash/Nagad/bank branding, lookalike domains), and produces a 0–100 risk score with a level (Low / Guarded / Suspicious / High). Gemini then explains the evidence in plain Bangla or English with concrete safety steps. Every investigation is stored, so users can view history, statistics, and download reports — all in a dark "cyber-investigator" console UI that makes threat-hunting feel approachable.

How we built it

Python + Streamlit for the full-stack app, deployed on Streamlit Community Cloud. Gemini (google-genai SDK) with function calling as the agent: the model plans the investigation and picks tools, but can only call a small set of declared tools, with every tool name and argument validated in Python. External intelligence: Google Safe Browsing API (live), with VirusTotal and URLhaus as optional extra sources. Deterministic risk engine: weighted evidence (Safe Browsing 40, VirusTotal 25, URLhaus 20, domain indicators 10, message indicators 5) plus floors for confirmed listings and strong scam patterns. The LLM never sets the score — it only explains it. SQLite + SQLAlchemy for history, Pydantic for validation, Plotly for the gauge and statistics, pytest (53 tests) for validators, scoring, agent safety and fallbacks. Architecture in one line: external intelligence provides evidence, deterministic Python evaluates it, the LLM explains it.

Challenges we ran into

Keeping the agent safe: submitted messages are untrusted and may contain prompt injections. We built a strict tool whitelist, rejected any URL the model invents that wasn't in the submission, enforced call budgets, and never let the model fetch suspicious URLs or set the final score. LLM reliability: the Gemini models we started with returned 404 for new keys and others were timing out (503/504). We added a bounded model-fallback chain and a low-thinking configuration, cutting a full investigation from ~75 s to ~6 s. Not everything is available: we couldn't get a working VirusTotal key, so we designed every external source to be optional with honest "not configured / skipped" evidence and a confidence rating separate from the risk score. Scores that match reality: an obvious "send your OTP to claim your prize" message was scoring "Low" because no API had listed it yet; we introduced evidence floors so confirmed listings and strong scam patterns can't be under-scored. Bangla rendering in the terminal-style UI needed a web-font fallback (Noto Sans Bengali) so the monospace theme didn't break Bengali text.

Accomplishments that we're proud of

A working end-to-end agentic investigation in about 6 seconds, live on the web. Google's official phishing test URL is correctly flagged 70/100 High with the exact listing shown as evidence. Fully bilingual (Bangla/English) UI and AI reports, including the "no match is not proof of safety" warning. A design where the AI is powerful but can't hallucinate evidence or scores — every number is traceable to a concrete signal. A UI that makes users feel like the investigator hunting the black-hat, not the victim.

What we learned

Letting an LLM orchestrate and explain while keeping decisions deterministic gives both trust and transparency — users can see exactly why something was flagged. Degraded modes matter: real deployments lose APIs, keys expire, models change. Designing for "partial evidence" from day one made the system robust. Localisation is more than translation — scam patterns, brand names and the urgency phrases people fall for are local, so the detection rules had to be Bangladesh-specific.

What's next for ScamSathi

Add VirusTotal, URLhaus and PhishTank once keys are available, and WHOIS/domain-age checks for brand-new scam domains. A community reporting layer: let users confirm scams so repeated bKash/Nagad fraud numbers and links are flagged instantly for everyone. Screenshot/OCR input so people can share a photo of an SMS or Facebook ad. A Telegram/WhatsApp bot and a browser extension for one-tap checks. Partnerships with mobile-finance providers and BTRC to feed verified scam intelligence back into the system.

Built With

Share this project:

Updates

Submission history