ScamShield

💔 Inspiration

Indians lost over ₹22,800 crore to cyber fraud in 2024. The victims aren't careless people — they're targets of messages engineered to bypass rational thinking: fake KYC alerts that threaten account suspension, UPI "refunds" that trick you into typing your PIN, fake police conducting "digital arrests" over video calls. Everyone in India knows someone who has been hit. Existing tools tell you that something is spam. Nobody tells you why — so people stay vulnerable to the next variant.

🛡️ What it does

ScamShield lets anyone paste a suspicious message (or upload a screenshot of it) and instantly get:

• A 0–100 risk score with an animated gauge and a plain-English verdict
• Every manipulation tactic exposed — manufactured urgency, fear of losing access, authority impersonation, greed, secrecy — each one quoted directly from the message
• Link inspection — lookalike bank domains (sbi-yono-kyc-update.xyz), URL shorteners, raw IPs
• Concrete action steps — block, report, and India's 1930 cybercrime helpline
• An education card that explains the entire playbook of that scam type

The last part is the point: ScamShield is not just a detector, it's a fraud-awareness teacher. Every analysis is a micro-lesson, so users graduate from needing the tool to warning their family group chat themselves.

🏗️ How we built it

• Next.js 16 (App Router) + React 19 + TypeScript + Tailwind CSS 4, single /api/analyze endpoint
• Dual analysis engine:
  • With an Anthropic API key: Claude (claude-opus-5) does multimodal analysis — it reads screenshots directly and returns structured JSON (score, tactics, URLs, advice, education)
  • Without a key (or if the API ever fails): an offline rule engine takes over automatically — 18 weighted India-specific scam patterns (KYC phishing, UPI collect tricks, digital arrest, task scams, lottery fraud…) plus URL heuristics. Same JSON contract, same UI, so the demo can never break.
• Zero data stored — no accounts, no database. A message is analysed and forgotten.

🧗 Challenges we ran into

• Making rule-based scoring match AI-level judgment on real scam samples took several calibration rounds (e.g. the UPI "enter your PIN to receive money" trick must always score high — it's definitionally a scam)
• Avoiding false positives: a legitimate message mentioning "my mother is in hospital" must NOT trigger the emotional-manipulation pattern by itself
• Designing quote extraction so the UI can show which exact phrase is manipulative

🏆 Accomplishments we're proud of

• A complete, polished, mobile-responsive product built solo in 21 hours
• The dual-engine architecture — genuinely resilient, works with zero configuration
• Six one-click real-world scam samples that make the demo instant and repeatable
• Every verdict doubles as fraud-awareness education, in language ordinary people understand

📚 What we learned

• The psychology of scams is more systematic than expected — nearly every scam message uses the same 5 levers (urgency, fear, authority, greed, secrecy), which is exactly what makes tactic-level education effective
• Prompt-engineering structured JSON output from a multimodal model
• Weighted-pattern scoring design and calibration against a real sample set

🚀 What's next for ScamShield

1. WhatsApp bot — forward a message, get the verdict back; zero install, meets users where scams actually happen
2. Hindi + regional languages with voice-first output for low-literacy users
3. Browser extension / SMS integration — flag scams on arrival
4. Community scam radar — anonymous aggregate reporting of trending scams by district

Built With

• ai
• anthropic
• claude
• cybersecurity
• fintech
• nextjs
• react
• social-impact
• tailwindcss
• typescript