Second Look

sarah-paused
ask-the-real-sarah
sarah-stopped
honest-member-one-tap
linda-silent-check
design-check

What inspired us

At kickoff, Sound's team told us something that stuck: scam victims are often embarrassed, they're told to keep it secret, and when the bank flags a payment, some go somewhere else and send it anyway. They also said most account takeovers start with someone handing over a code, and that alerts get buried.

Then we opened the starter kit. Sarah (M1003) clicked a fake Sound text, and in 34 minutes someone reset her password, changed her email and phone, added a recipient, and sent $3,006 by P2P. The alert went to her old email at 10 PM. Nobody saw it, and the money couldn't be pulled back.

What surprised us most: Sarah's stolen payments were about the same size as her normal ones. A "big spending" alert would never have fired.

What it does

Second Look pauses a payment when something looks wrong and shows a true fact from Sound's own records, before the money leaves.

Takeover (Sarah): when a password reset, a contact change and a new recipient line up, the payment stops before it's sent. Sound asks "Was this you?" only on contact info that didn't just change, so the scammer can't answer for her. Staff see the full timeline and can release, keep it stopped, or start recovery.
Honest members get through (M1039): someone who really moved and reset their password trips the same rule. Their phone didn't change, so one tap and their rent goes the same day.
Tricked members (Linda, preview): Linda lost $8,500 even after Sound held her wire, because a fake attorney told her to keep it quiet. Second Look shows her a plain fact ("your first wire in 6 years, to an account added 7 minutes ago") and a silent check she can tap without saying anything out loud. She still decides.

No AI makes the call. It's three facts from Sound's own data, so every pause can be explained to the member.

How we built it

A React + TypeScript app (Vite, Tailwind) that reads the starter kit's 7,471 events directly. The trigger rules are plain code with tests, and the "Design check" tab runs them on all 118 members, including the 20 honest look-alikes and a scam we miss (Michael's slow romance scam). Member and staff views stay in sync across laptops, so one person can play the member and another the bank. Hosted on Vercel.

Challenges

Our first ideas leaned on signals like "the member is on a phone call." The rules rule those out, so we rebuilt everything around data Sound actually has.
Designing for the honest person mattered as much as catching the scammer. 4 of the 20 look-alikes trip our takeover rule, so each needed a fast, respectful way through.
Being honest about what we miss. Slow romance scams slip past our rules, and we show that on purpose.

What we learned

Most of the protection isn't detection. It's where you ask. Sending "Was this you?" to contact info the scammer just changed is the gap that cost Sarah her money.

What's next

Tomorrow: Linda's flow working end to end, an optional member-chosen trusted contact (informed only, never given access), a staff inbox, and a 90-day pilot plan with every target stated as an assumption.