Inspiration
Scam messages — fake lottery wins, phishing bank alerts, fraudulent job offers — circulate constantly through WhatsApp and SMS across Pakistan and South Asia. Almost everyone has received one, and many people, especially those less familiar with digital scams, end up falling victim because these messages are designed to look urgent and legitimate. We wanted to build something that gives people an instant, trustworthy second opinion before they click a link or share personal information.
What it does
ScamShield lets anyone paste a suspicious WhatsApp or SMS message into a simple web interface. Within seconds, an AI model analyzes the message and returns a clear verdict — Scam, Suspicious, or Safe — along with a confidence percentage and a list of specific red flags explaining why the message looks dangerous (e.g. urgency language, requests for personal/bank details, suspicious links, impersonation of a real institution). The goal is to translate technical scam-detection reasoning into plain, actionable language anyone can understand in seconds.
How we built it
- Backend: Python and Flask handle the web server and API logic.
- AI/LLM: We use the Groq API running Llama 3.3 70B for fast, near-instant inference. A carefully engineered system prompt forces the model to return strictly structured JSON (verdict, confidence score, red flags, and a plain-language summary), which we then render dynamically on the frontend.
- Frontend: A single-page interface built with vanilla HTML, CSS, and JavaScript — kept deliberately lightweight to move fast during the hackathon while still delivering a clean, color-coded result card (green for safe, yellow for suspicious, red for scam).
- Security: API keys are managed through environment variables using python-dotenv, keeping credentials out of the codebase entirely.
Challenges we ran into
- Prompt engineering: Getting the LLM to reliably return valid, strictly-structured JSON — rather than free-form text — took several rounds of iterating on the system prompt and using the API's JSON response-format mode.
- Secure credential management: Early in development we hardcoded the API key for speed, then had to properly refactor to a
.env-based approach. Along the way, GitHub's push protection caught an accidentally committed key in our Git history, which we resolved by rebuilding the commit history cleanly — a real, hands-on lesson in secret management under time pressure. - Environment setup debugging: We ran into several local development snags — Flask's
templates/folder structure, mixing upbashvs PowerShell syntax, and switching LLM providers mid-build (from OpenAI to Groq) to work within free-tier constraints. - Solo development under time pressure: Building alone in just a few hours meant every architectural decision had to prioritize speed without sacrificing polish — no model training, no database, just a tight, focused MVP.
Accomplishments that we're proud of
- Shipped a fully working, end-to-end AI product — from prompt design to live UI — solo, within a short hackathon timeframe.
- Built something genuinely useful and locally relevant, addressing a scam problem that real people in Pakistan encounter regularly.
- Learned and applied real-world security practices (environment variables,
.gitignore, credential rotation) under real deployment pressure, not just in theory. - Designed a clean, intuitive UI that non-technical users — including people the tool is meant to protect — can use without any explanation.
What we learned
- How to engineer prompts that reliably produce structured, parseable output from an LLM rather than free-form text.
- Practical experience with secure API key handling and recovering from accidentally exposed credentials in version control.
- How to scope a project tightly for a time-boxed hackathon: choosing an architecture (LLM API over custom model training) that maximizes impact per hour of development time.
What's next for ScamShield — AI Scam Message Detector
- Urdu-language interface to make the tool accessible to a wider audience beyond English/Roman Urdu text input.
- Browser extension that scans messages directly on WhatsApp Web in real time, rather than requiring copy-paste.
- Community-reported scam database so previously flagged scam patterns can be checked instantly and the model gets sharper with real-world data over time.
- Message history and stats dashboard to show users how many scams they've avoided.
Log in or sign up for Devpost to join the conversation.