ScamTrace AI

ScamTrace AI turns suspicious messages, URLs, and screenshots into evidence-backed fraud risk reports and actionable safety guidance, powered by Microsoft Foundry AI.

Comment

Inspiration

Digital scams are becoming increasingly sophisticated. Fake job offers, phishing links, fraudulent scholarship opportunities, and impersonation attempts can appear convincing even on legitimate platforms.

For students, job seekers, and everyday internet users, recognizing suspicious content is only half the challenge. The harder question is: What evidence suggests this might be a scam, and what should I do next?

We built ScamTrace AI to answer that question.

Our guiding principle is simple: Verify before you trust.

Rather than building another AI chatbot that simply labels content as safe or dangerous, we wanted to create an investigation tool that makes security analysis understandable, transparent, and actionable.

What It Does

ScamTrace AI is an evidence-first fraud investigation platform that transforms suspicious digital content into explainable risk assessments and practical safety recommendations.

Users can investigate content through three input methods:

  • Message Scanner: Analyzes suspicious conversations, recruitment offers, payment requests, and impersonation attempts.
  • URL Scanner: Inspects URL structures, suspicious patterns, and domain-related indicators without automatically visiting the destination.
  • Screenshot Scanner: Uses multimodal AI to examine screenshots of suspicious messages and identify potential fraud indicators.

An optional Public Page Inspection feature allows users to retrieve limited static content from publicly accessible HTTPS pages under strict security restrictions.

Each investigation produces:

  • A risk severity assessment with clear uncertainty disclosures.
  • Grounded evidence extracted from the submitted content.
  • Identified manipulation tactics and potential scam mechanisms.
  • Transparent separation between deterministic rules and AI interpretations.
  • Actionable recommendations for independent verification.
  • An exportable investigation report.

Our core innovation is Evidence-to-Action Intelligence: connecting observable fraud indicators to understandable explanations and safer next steps.

How We Built It

ScamTrace AI combines deterministic cybersecurity checks with multimodal AI reasoning.

Frontend and Application

We built the application using Next.js 16, React, TypeScript, and Tailwind CSS, with an editorial-style investigation interface designed to prioritize clarity, accessibility, and evidence.

AI Investigation Engine

We integrated GPT-5.4 Mini through Microsoft Foundry to analyze messages, URLs, and screenshots.

AI-generated results are validated through structured schemas, while textual evidence is checked against the original submission to reduce unsupported quotations.

Deterministic Security Engine

Our rule engine identifies observable indicators such as upfront recruitment fees, urgent payment demands, credential requests, authority claims, and suspicious URL patterns.

Rule-based findings and AI interpretations are combined with explicit provenance, helping prevent duplicate evidence from being counted repeatedly.

Secure URL Inspection

We implemented optional public-page inspection with safeguards including HTTPS-only retrieval, public-IP validation, DNS and connection verification, controlled redirects, response-size limits, and strict timeouts.

Untrusted page content is treated as evidence, never as instructions.

Threat Intelligence Architecture

We also implemented an optional reputation-first investigation architecture that can stop further AI analysis when a trusted provider confirms a known threat.

Google Safe Browsing integration is implemented but not configured for live reputation checks in the current deployment. PhishTank live lookup remains disabled because its documented check endpoint does not meet our HTTPS transport requirements.

The production application transparently communicates these limitations rather than claiming unavailable threat intelligence coverage.

Infrastructure and Quality Assurance

The application is deployed on Vercel, with Upstash Redis providing distributed API rate limiting to protect paid AI inference from excessive requests.

We use Vitest, TypeScript, ESLint, and automated production build checks to validate functionality and reliability.

Challenges We Faced

One major challenge was combining AI-generated interpretations with deterministic security findings without overstating certainty or producing repetitive reports.

We addressed this through evidence grounding, semantic deduplication, source attribution, and explicit separation between risk severity and model confidence.

Another challenge was safely inspecting untrusted websites. Allowing a server to retrieve arbitrary URLs introduces serious security concerns, including server-side request forgery (SSRF). We implemented defensive network restrictions and ensured that inspection remains optional.

Integrating Microsoft Foundry also required adapting model-specific API parameters, response validation, and multimodal request handling.

Finally, we had to ensure that failures in external services would not silently produce misleading security conclusions.

Accomplishments We're Proud Of

We successfully built and deployed an end-to-end AI cybersecurity application with working text, URL, and screenshot investigations.

Key accomplishments include:

  • Real Microsoft Foundry multimodal AI integration.
  • Evidence-grounded and explainable investigation reports.
  • Secure, optional public webpage inspection.
  • Distributed rate limiting with Upstash Redis.
  • Transparent handling of uncertainty and unavailable reputation services.
  • 121 passing automated tests at our final release validation.

We also created a reproducible evaluation suite containing 26 synthetic labeled cases for the deterministic rule engine.

The rules-only evaluation achieved:

  • 92.3% accuracy
  • 87.5% precision
  • 100% recall

These results apply only to our synthetic rule-based evaluation dataset. They do not represent independently validated real-world fraud detection accuracy or hybrid AI performance.

What We Learned

We learned that building trustworthy security AI requires more than selecting a capable language model.

Strong AI systems need explainable outputs, independently verifiable evidence, secure integrations, careful failure handling, and honest communication of uncertainty.

Perhaps our most important lesson was that a useful security product should empower users to verify information rather than replace their judgment with an automated verdict.

What's Next

Our next steps include expanding permitted live threat intelligence integrations, evaluating the system against more diverse real-world datasets, improving multilingual scam detection, and refining risk calibration.

We also want to explore detecting sophisticated recruitment fraud that occurs on otherwise legitimate platforms, where domain reputation alone cannot establish whether a listing is trustworthy.

Our long-term vision is to make evidence-based scam investigation accessible to everyone.

ScamTrace AI — Verify before you trust.

Live Demo: https://scamtrace-ai.vercel.app/

Built for ForgeHacks Online 2026 — AI + Cybersecurity Track.

Built With

  • azure-openai
  • gpt-5.4-mini
  • microsoft-foundry
  • next.js
  • node.js
  • react
  • tailwind-css
  • typescript
  • upstash-redis
  • vercel
  • vitest
  • zod
Share this project:

Updates

Submission history