ScamShield

• 

  Cover image

• 

  Home page with the input box and sample buttons

• 

  Digital arrest message scoring 100/100, with highlights

• 

  Red flag explanations with “What to do”

• 

  Real bank OTP scoring 0, in light mode (proves no false alarm)

Inspiration

Almost every family in India has a WhatsApp group where someone has forwarded a scam, or worse, fallen for one. My own relatives regularly get messages saying "your KYC has expired, your account will be blocked today" or "your electricity will be cut tonight, call this number." Lately there's a scarier one: "digital arrest", where fake police or CBI officers threaten people over video calls until they transfer money.

The people most likely to fall for these, like parents, grandparents and first-time smartphone users, usually don't know the warning signs. By the time they ask someone, the money is often gone. I wanted to build something simple enough that anyone could use it in 10 seconds: paste the message, see if it's a scam, and understand why.

What it does

ScamShield is a website where you paste any suspicious SMS, WhatsApp message or email, and it:

• 🎯 Gives a risk score from 0 to 100: Looks low risk, Suspicious, or Likely a scam
• 🖍️ Highlights the exact words that triggered a warning
• 💬 Explains every red flag in plain language, with a clear "What to do" for each
• ✅ Recognises good signs too. A real bank OTP that says "do not share this OTP" scores 0, not 100
• 👨‍👩‍👧 Writes a warning message you can copy and send to your family group
• 🚨 Shows where to report: helpline 1930, cybercrime.gov.in, and Chakshu on Sanchar Saathi

🔒 Privacy first: everything runs in your browser. Your message is never uploaded, stored or sent to any server.

Scams it detects

How I built it

ScamShield is built with HTML, CSS and vanilla JavaScript. There's no framework, no backend and no API, which is what makes it fast, free and private.

• rules.js holds 19 detection rules. Each rule has regular expressions, a weight (risk points), an explanation and advice.
• script.js runs every rule on the message, collects the match positions, scores them, and renders the results.
• Highlighting: matches from all rules are sorted and overlapping ranges are merged, then the message is rebuilt with <mark> tags. Everything is escaped first, so pasted text can't inject HTML.

Scoring

Each triggered rule \( i \) adds its weight \( w_i \). Real scams usually stack several tricks at once, so 3 or more red flags add a bonus \( B = 10 \). Good signs like "do not share" subtract points \( s_j \):

$$ \text{score} = \min\left(100,\ \max\left(0,\ \sum_{i \in \text{flags}} w_i \;+\; B \cdot [\,n \ge 3\,] \;-\; \sum_{j} s_j \right)\right) $$

Challenges I ran into

• False positives on real OTP messages. My first version flagged real bank OTPs as scams because they contain "OTP" and "share". I fixed this by checking the words before each match for "not", "don't" or "never", and by adding "good sign" rules that lower the score.
• Words that are only scary together. "Police" alone is normal, but "police" plus "arrest warrant" plus "video call" is a digital arrest scam. I added an alsoNeeds option so some rules only trigger when two kinds of words appear together.
• Overlapping highlights. Different rules often matched the same words, which broke the HTML. I solved it by merging overlapping ranges before building the output.
• Tuning weights. I tested against sample scam messages and normal messages, like an Amazon delivery update, and adjusted the weights until scams scored high and normal messages scored low.

What I learned

• Writing and debugging regular expressions for messy real-world text
• How common scams actually work, and how many use the same psychological tricks: urgency, fear, secrecy and "too good to be true"
• That a simple, explainable rule-based system can be more trustworthy for this use case than a black-box model, because it can always tell you why
• Designing for non-technical users: plain language, big clear verdicts, and dark and light mode

Impact

ScamShield is built for the people who need it most and are least likely to download a security app. It works on any phone browser, needs no sign-up, costs nothing, and never sees your data. Even a "Suspicious" result is often enough to make someone stop and check before tapping a link, and the Warn your family button helps one person protect a whole family group.

What's next

• 🌐 Hindi and regional language support
• 🧩 Browser extension that checks messages in WhatsApp Web and Gmail automatically
• 📱 Android app that can scan SMS directly
• 🖼️ Screenshot upload with OCR, since many people forward screenshots instead of text
• 🗳️ Let users report new scam patterns so the rules stay up to date

Built With

• css3
• git
• github
• html5
• javascript
• regex