ScamShield AI

• 

• 

• 

• 

Inspiration

Scams, impersonation, and fraud are becoming harder to recognize as attackers use convincing messages, fake identities, deceptive URLs, and psychological pressure to manipulate people into giving away credentials, OTPs, or money.

We wanted to build something that would not simply tell a user "Scam" or "Not a Scam", but would explain why a message is suspicious, identify the specific attack techniques being used, and tell the user what safer action to take.

This led us to build ScamShield AI.

What It Does

ScamShield AI is an AI-powered scam, phishing, impersonation, and fraud detection assistant.

Users can analyze:

• Suspicious text messages
• URLs
• Screenshots
• Multi-message conversations

The system provides a risk level, scam category, suspicious indicators, explanation, recommended action, and specific attack techniques detected.

For example, a single phishing message can be identified as involving:

• Bank Impersonation
• Credential Phishing
• OTP Theft
• Malicious Link
• Open Redirect Abuse
• Urgency/Threat Manipulation
• Social Engineering

How We Built It

ScamShield AI combines AI reasoning with deterministic cybersecurity analysis.

The main pipeline is:

User Input → AI Analysis + URL Security Analysis + PhishTank Intelligence → Evidence Fusion → Risk & Attack Techniques → Explanation & Safe Action

Google Gemini is used for semantic and multimodal analysis of suspicious messages, screenshots, and conversations.

We also built a deterministic URL analysis layer that checks for security indicators including typosquatting, Punycode/IDN homographs, deceptive @ routing, suspicious ports, URL obfuscation, shortened URLs, malicious payload extensions, open redirects, and brand impersonation.

PhishTank is used as known-threat intelligence. Importantly, a URL not being found in PhishTank is not treated as proof that it is safe.

An evidence-fusion layer combines the different sources of evidence to produce the final assessment.

We also implemented fallback and degraded-mode behavior so that temporary Gemini API failures do not cause the entire application to fail.

Challenges We Ran Into

One of the biggest challenges was making the system useful beyond simple keyword-based scam detection.

Real scam messages can contain multiple attack techniques at the same time. We therefore implemented a controlled multi-attack taxonomy and combined deterministic detection with Gemini's semantic analysis.

We also faced challenges around:

• Detecting previously unseen phishing URLs
• Handling shortened and obfuscated URLs safely
• Preventing false positives between credential theft and payment fraud
• Handling Gemini API failures and rate limits
• Safely processing URLs without arbitrary web crawling or SSRF risks
• Making the frontend clearly display multiple detected attack techniques

Another challenge was validating the system without claiming unrealistic real-world accuracy. We therefore created controlled synthetic/internal evaluation datasets and clearly documented their limitations.

Accomplishments That We're Proud Of

We are proud that ScamShield AI became a working end-to-end application rather than only a prototype model.

The project supports:

• Text scam detection
• Screenshot-based scam analysis
• Multi-message conversation analysis
• URL security analysis
• PhishTank threat intelligence
• Multi-attack technique detection
• Evidence fusion
• Offline/degraded-mode protection
• Explainable risk assessment
• Actionable safety recommendations
• Live web deployment

We also achieved strong results on our controlled internal benchmarks, including 100% accuracy on the curated URL-security benchmark and 93.33% micro F1 for multi-attack technique extraction.

These results are from synthetic/internal evaluation datasets and are not presented as real-world accuracy.

What We Learned

This project taught us that effective scam detection is not just an AI classification problem.

Combining AI reasoning with deterministic cybersecurity rules provides a more transparent and resilient approach.

We learned how to:

• Build multimodal AI pipelines
• Integrate Gemini into a real application
• Perform deterministic URL security analysis
• Combine multiple evidence sources
• Design multi-label attack taxonomies
• Build fallback behavior for unreliable external services
• Think about SSRF and secure URL handling
• Test security-oriented systems using controlled evaluation datasets
• Deploy an AI application as a live web service

Most importantly, we learned that security tools should explain their decisions clearly because users need to understand why they should not trust something.

What's Next for ScamShield AI

We want to extend ScamShield AI beyond a standalone web application.

Potential future improvements include:

• Domain age and WHOIS intelligence
• SSL certificate and certificate-transparency analysis
• Additional threat-intelligence integrations
• Lightweight on-device scam screening
• Browser extension support
• Mobile keyboard integration
• Real-time warnings inside messaging and email applications
• Automated phishing reporting

Our long-term goal is to make ScamShield AI a practical safety layer that can help users recognize and avoid scams before they lose money, credentials, or sensitive information.

Built With

• as-we-build
• python
• we-can-start-with:-python-then