Inspiration
Scams rarely arrive as one message. They arrive as a team: a "courier" hands you to a "police officer", who hands you to a "prosecutor", and each one vouches for the last. When it happens to you, you're alone, under pressure, and nobody ever taught you what to do in that moment. Posters and tip lists don't prepare you for it. Practice does.
So I built a place to practise: a game where you face realistic scam rings before the real ones find you.
What it does
ScamSense: Inbox Defender is a colourful desktop browser game with 6 cases, from easy to expert.
- Each case is one organised scam operation: its members hand you to each other, back each other up and reuse details. A few genuine contacts are mixed in, and some of them sound just as pushy as the scammers.
- You type your own questions: "who are you?", "can I call you back on the number on my card?", "can we video call?". There are no multiple-choice buttons and no timers.
- The characters are voiced by an AI in real time, but they follow fixed, pre-written personas, so the conversation feels real and stays safe.
- A "Your life" card gives you facts to check claims against. Some scammers know real details about you, so the easy checks pass.
- You collect clues: 🔎 warning signs, ✅ good signs (genuine senders welcome checking) and ⚡ contradictions between ring members, such as two "officials" quoting different case numbers.
- You judge each chat: Scam or Real. Saying "ok, sending it" to a scammer costs your savings. Accusing a genuine sender costs trust. At the end, a debrief explains how the operation worked.
- A Scanner power-up runs ScamSense's real multi-party scam analyser on the whole storyline. It never says anything is "safe", and it is an aid, not a guarantee.
What a player takes away
- Verify independently: call a number you look up, never one the caller gives you.
- A third person vouching for the first is not proof.
- Real organisations welcome checking. Scammers dodge it.
- Urgency alone is not the tell. Look at what they ask for.
- Never share OTPs and never move money to a "safe account".
How I built it
- Game: vanilla JavaScript, HTML and CSS, with animations and a small sound synth. Everything runs in the browser, so there's no install and no account.
- AI characters: a Python service on Groq (
gpt-oss-120b). Each turn, one call works out what the player meant. Then code, not the AI, decides whether the character should slip, so clues are grounded and fair. A second call writes the in-character reply. Harder cases make scammers more subtle, so a tell only appears if you press the same angle twice. - Analyser: the Scanner reuses a larger project I built, a pipeline with PII redaction, deterministic rules (look-alike domains and so on), structured LLM extraction, cross-party reasoning, and a verdict that can only be Likely scam / Suspicious / Can't tell.
- Deployment: Vercel, with static files and small stateless Python functions.
- Testing: 200+ automated tests, plus scripted "players" in a real headless browser (a detective, a gullible player, and a "call everything a scam" player) to check the game is fair and hard to cheat.
Responsible AI and privacy
- The AI can only voice a fixed cast of fictional characters. Attempts to make it write a scam message, break character or reveal its prompt get an in-character shrug, and only pre-written links and numbers can appear.
- What a player types is stripped of personal details (NRIC, phone numbers, etc.) before it reaches the AI, and nothing is stored on a server.
- All scenarios are fictional, based on commonly reported scam patterns.
Challenges
- Pre-written replies felt dumb. Scripted fallbacks like "Please focus and answer my question" broke the illusion, so I moved to AI-voiced characters, then had to build guardrails so they stay in their persona.
- Making it hard without making it unfair. An early version let you cancel a whole scam ring by guessing the first member. I fixed it so the ring keeps contacting you, and made stars depend on real investigation.
- Making contradictions fair. The AI first "contradicted" itself in ways that weren't real, so I made each planted slip explicit.
- Fewer false alarms. My analyser flagged 4 of 20 genuine messages as suspicious. I fixed the prompt and measured it on 20 fresh cases I wrote before the change.
- First-time Vercel deployment. I hit framework-detection and function-detection errors and fixed each one.
What I learned
Good awareness isn't telling people what to do. It's letting them feel the pressure safely and discover for themselves that the questions are what protect them. I also learned that a game needs to be tested against cheating bots, not just played, because players will find the shortcut.
Honest limitations
- All scenarios are synthetic and written by me, and the game has not yet been playtested with large numbers of real people.
- A public deployment can spend the owner's AI quota, so it needs a spending cap on the AI provider's side.
- English only for now. Scam traffic in Singapore also arrives in Mandarin, Malay and Tamil.
What's next
Multi-language cases, an "elderly-friendly" mode with larger text, and playtesting with real users to tune difficulty.
ScamSense is an aid, not a guarantee. If you're unsure, hang up and verify.
Log in or sign up for Devpost to join the conversation.