ScamShield

A family fraud firewall for Alexa+. Say "Alexa, is this a scam?" and get a calm verdict, the real number to call back, and a quiet heads-up to your family.

Comment

Inspiration

I'm a Master's student in Cybersecurity at DePaul University, and the attack that worries me most isn't a zero-day. It's a phone call to an older relative from "Medicare," with a calm voice, a deadline, and a request for a card number. Those scripts are well documented, yet they still work because the person is alone, rushed, and told not to tell anyone. Fraud losses reported to the FTC by adults 60+ reached $2.4 billion in 2024. I wanted the moment of doubt, "is this real?", to have someone to ask.

What it does

ScamShield is an Alexa+ integration that protects older adults from phone, text and email scams.

  • Ask in your own words: "Alexa, a man from Medicare called and wants my number."
  • Get a clear verdict: red / yellow / green on Echo Show (an MCP Apps card in large print), and a short, calm, conversational answer by voice.
  • Get the real number: ScamShield gives the verified official contact (Medicare, Social Security, IRS, your bank…), never the caller's number.
  • Family is told automatically on a likely scam, by email through Amazon SNS, with no personal numbers in the message. The alert in the video is a real email sent live from AWS.
  • It remembers: the same "Medicare" calling again is recognized ("this is the second time this week"), and the risk goes up. Memory lives in Amazon DynamoDB.
  • It doesn't cry wolf: an ordinary message, like a pharmacy pickup text, stays green.
  • History on request: "What suspicious calls did I get this week?"

Demo note: the video shows the Alexa+ simulator included in the repo (the simulated-experience path). It talks to the same MCP server over Streamable HTTP and renders the same MCP Apps card a real Alexa+ host would, with live AWS services behind it. Code: https://github.com/Peri2505/scamshield

How I built it

  • MCP server in TypeScript with the official MCP SDK: Streamable HTTP transport, protocol 2025-11-25, stateless so it scales horizontally, with DNS-rebinding protection. Four tools, server instructions that guide the Alexa+ model, and tool annotations.
  • MCP Apps verdict card (ui://scamshield/verdict-card.html, text/html;profile=mcp-app) linked via _meta.ui.resourceUri. The card implements the ui/initialize handshake, renders tool-result notifications, and its "Tell my family" button calls a server tool back through the host.
  • Hybrid analysis: a deterministic, explainable scam playbook (15 tactics plus 5 supporting signals drawn from FTC/AARP/FBI guidance) and Amazon Bedrock (Converse API, Amazon Nova Lite) as a second opinion. ScamShield keeps the higher risk score.
  • Safe by design: the message is wrapped and treated as data, never instructions (prompt-injection guard); inputs are length-limited; errors never leak stack traces.
  • Privacy first: SSNs, card/account numbers, Medicare IDs and emails are redacted before reaching Bedrock, DynamoDB, logs or alerts.
  • Amazon DynamoDB stores incident memory per household (on-demand, 180-day TTL). Amazon SNS delivers family alerts by email. AWS access uses a least-privilege IAM user.
  • Resilience: every AWS dependency has a local fallback, and a circuit breaker pauses Bedrock when its quota is hit, so protection never stops.
  • Alexa+ simulator web app: an Echo Show–style screen that acts as an MCP Apps host, with voice input (Web Speech API), natural spoken responses, a "family phone" panel, and a live log of MCP calls.
  • 119 automated tests, including end-to-end tests over Streamable HTTP with the official MCP client, plus a detection benchmark of 96 real-world messages (54 scams, 42 ordinary): every scam flagged, zero false alarms. To keep myself honest: on the last batch, written after tuning and checked before any changes, the rules alone scored 16/18 with zero false alarms, which is why Bedrock is there as a second opinion.

Challenges I ran into

  • Designing for the real user. Every string had to be readable aloud to an 80-year-old: no jargon, one action per line, and never "verify your identity." Alexa's answers rotate natural openers so they never sound canned.
  • False alarms vs. misses. A real bank call shouldn't trigger panic, so naming an organization alone adds no risk; it only counts alongside a real tactic. Gift cards are context-aware: buying one as a present is fine, paying someone with one is not.
  • Bedrock quota on a brand-new AWS account. The daily token quota for new accounts is very low, so I added a circuit breaker: when Bedrock reports a daily limit, ScamShield pauses it and keeps answering instantly from the playbook.
  • MCP Apps SDK versions. The latest ext-apps package targets the v2 MCP SDK packages, while my server uses the stable 1.x SDK. I implemented the small postMessage bridge directly from the spec, which works with any compliant host.
  • SMS vs. email alerts. US SMS through SNS needs a registered origination number, so for the hackathon I used SNS email subscriptions, which work instantly.

Accomplishments that I'm proud of

  • A complete loop: voice → MCP → AI + rules → memory → family alert → visual card, working end to end on live AWS.
  • Every scam caught and no false alarms on my 96-message benchmark.
  • A privacy design a security reviewer would sign off on: redaction before anything leaves the process.
  • An interface that feels calm rather than alarming.

What I learned

  • How MCP tool design changes when the "user" of the tool is an LLM speaking to an older adult: the spoken field and server instructions mattered as much as the logic.
  • MCP Apps makes rich, accessible UI possible for voice-first devices.
  • Graceful degradation matters most for safety tools: a scam check must answer even when the AI behind it can't.

What's next for ScamShield

  • Proactive Echo Show check-ins after a flagged week.
  • A caregiver view in Alexa+ for the family member.
  • Playbook updates from new FTC alerts within days.
  • A Ring integration for door-to-door scams.
  • A path to the Alexa+ catalog so any family can enable it.

Built With

Share this project:

Updates

Submission history