ScamShield

Inspiration

Everyone in my family group chat has received one: "Congratulations, you won!", "I sent money to your number by mistake, please return it." Where I live, mobile money IS the bank — one wrong reply costs real savings. I wanted a friend in your pocket who has seen every scam before.

What it does

Paste any suspicious SMS, WhatsApp or email (or screenshot it) and you get a verdict in seconds: SCAM, SUSPICIOUS, or no known signs — with the exact phrases that triggered each warning highlighted inside your own message, the links x-rayed, and steps for what to do now. The whole app speaks 24 languages, and the core detection works with no internet, no account, no API key — a rule engine running entirely on your phone. AI (Gemini) is only the optional layer that explains it in plain words and reads screenshots.

How I built it

One HTML file, no frameworks. The rule engine is plain readable JavaScript: 20+ regex packs for the classic tricks (fake prizes, OTP theft, money-reversal, "new number" impersonation...) plus URL forensics that un-disguises links before judging them — bit(.)ly, "paypal dot com", hxxp://, lookalikes like paypa1 and arnazon. For the 24 languages, Swahili and French ship inside the app so they work offline; the rest get translated once by AI and cached. A Cloudflare Worker holds the AI key server-side so nobody has to set anything up.

Challenges I ran into

Not crying wolf was harder than catching scams. My first OTP rule flagged real bank safety messages — "never share your OTP" looked identical to "share your OTP" until I taught the engine negation. So I built a test battery of scams AND innocent messages; every rule has to pass both sides before it ships. Weirdest bug: my rules silently did nothing on Arabic and Hindi text, because regex word boundaries only exist in Latin script.

Accomplishments that I'm proud of

The offline Kiswahili detection — "Umeshinda milioni 5! Tuma pesa haraka" gets caught with zero internet, which matters where data bundles are expensive. And the x-ray view: you don't just get told "scam", you see exactly which words were the trap. Every check becomes a small lesson.

What I learned

Let AI read and explain, but let deterministic code decide — you can't audit a vibe, but you can audit a rule. And a false alarm is as dangerous as a miss: if the app cries wolf on real bank messages, people stop listening right when it matters.

What's next for ScamShield

A one-tap "report to your carrier" flow, a family mode that warns the whole group chat, deeper offline packs for the non-Latin languages, and a public test corpus so anyone can verify the accuracy.

Built With

• cloudflare-workers
• gemini
• javascript
• pwa
• regex
• service-worker