SecondLook

SecondLook (多看一眼) helps Chinese-speaking elders check a suspicious link or app before they tap. Rules decide the risk, Claude explains it in 中文/English, and family sees the warning live.

Comment

Inspiration

Chinese-American elderly immigrants get pushed into "investment app" scams: a friendly text or WhatsApp message leads to a fake crypto-trading app installed from a link, outside the app store. They can't tell it's a scam until the money is gone.

Americans 60 and older reported $7.7 billion in losses to the FBI's Internet Crime Complaint Center in 2025 (AARP, on the FBI's 2025 Internet Crime Report), up from $4.88 billion in 2024, when they reported the most losses of any age group (InvestmentNews). Many of these are "pig butchering" scams: scammers build trust online or through messaging apps, then steer victims to fake crypto investments.

This problem is personal for us. A friend of Sophia's mother, in China, spent a month messaging someone claiming to be a U.S. serviceman online before he asked her to wire money. This pattern, often run out of scam compounds in Myanmar, has drawn global attention. Sophia has seen news coverage of elderly victims being stopped by police at bank counters mid-transfer, and she got a scam call herself the day she wrote this. Her mother now sends her every suspicious link or app before clicking. Most people her generation don't have that safety net. SecondLook tries to give them one.

What it does

  • Pair two phones with a 6-character code: the elder's and a family member's. No accounts.
  • Check before tapping or installing: the elder pastes a link or the whole scam text message, or picks an APK. We pull out the real link, including scammer tricks: look-alike letters (аpple with a Cyrillic "а"), [email protected], Chinese domains, full-width text, links broken across lines.
  • A rules engine decides the risk. For links: look-alike brand domains, suspicious endings like .top, redirects (followed without downloading anything) and urgent wording. For APKs: dangerous permissions, signing certificate, hardcoded crypto wallets, apps that are just a web page in a wrapper.
  • Claude explains the verdict in plain Chinese and English, labeled as AI, next to the rules' actual findings. A fixed "What to do" line, chosen by the rules, tells the elder: don't tap, call your family first.
  • The family phone gets the same warning live. View-only by design: elders keep their autonomy.

How we built it

  • SpacetimeDB is the whole real-time backend. Our Python analysis service writes each verdict with one HTTP call to the report_verdict reducer, and every phone paired to that code is subscribed, so both phones update live. No server of ours relays the alert. The reducer only accepts the analysis service's identity, which the database owner authorizes at runtime, so no identity sits in our public repo. We tested it on two real phones.
  • React + TypeScript (Vite) web app: pairing, the elder's check screen, the family feed, one language per phone with a 中文/English toggle, large text and big touch targets for older users. Live at 2ndlook.us.
  • Python + Flask + androguard analysis service and rules engine. Scam samples are analyzed statically, never installed.
  • Claude Haiku (Anthropic) writes the explanation from the rules' findings only. It never sees the pasted message and never sets the risk.
  • Process: we used Claude Code to write and test code, with a Claude Code review agent checking commits before they landed, and a UX critic agent checking every screen at phone width in both languages.

Challenges we ran into

  • Phishing links fight back. Our first link extractor checked the wrong site for https://[email protected] (a browser opens evil.top), for https://www.icbc.com中国.evil.top, and for an IP-address link. We rebuilt it so the browser's own URL parser decides the host, and wrote 39 regression tests.
  • A pasted message silently changed the domain. A single-line text box strips line breaks, so "Visit https://evil.top." + "click to confirm" became evil.top.click. Real scam texts copied from a screenshot (iPhone Live Text) also split links across lines.
  • Scam links die fast. Our real fake-Fidelity link no longer resolves, so the rules judge the address itself and still rate it high risk.
  • We caught a leaked credential mid-hackathon. A token was committed through the GitHub website, which skips .gitignore. We treated it as burned, re-minted it, and redesigned the database lock so no identity is hardcoded in the repo.

Accomplishments that we're proud of

  • The full loop works live on two real phones: paste a real scam text on the elder's phone, and a high-risk warning appears in Chinese for her and in English on her family's phone.
  • The look-alike demo: a link that starts with "apple.com" (really аpple.com-verify.top) shows up as "Will check: https://xn--pple-43d…", the domain it really is.
  • No black-box verdicts for a vulnerable group: every card separates "AI explanation (Claude)" from "Found by rules".

What we learned

  • Real-time sync doesn't need a custom backend; putting the security rule inside the database reducer kept the write path to one check.
  • Phishing defense is mostly about agreeing with what the browser or phone will actually open.
  • An independent reviewer, even an automated one, catches the bugs the author is blind to.

Where Claude could go wrong

Claude may soften a warning or mistranslate urgency, and for an elder reading in Chinese that can be the difference between stopping and paying. That's why Claude never decides the risk.

We saw it happen in testing: for low-risk links, Claude wrote "This link appears to be safe" / "看起来是安全的", when the rules had only found no warning signs, and it called a link it couldn't reach "a minor issue". A scam site that's been taken down looks exactly like that. So the card's "What to do" line is fixed text chosen by the rules, and for low risk it says "this doesn't guarantee it's safe". We also told Claude never to call a link "safe" and to say plainly when it couldn't check where a link leads. A prompt can't guarantee it, which is why the advice and the risk level never come from Claude.

What's next

  • An Android share-sheet app: share a suspicious text or APK straight from WhatsApp or Messages (the web side is already ready for it).
  • Both parents covered: a family phone that follows several codes, with each alert labeled "Mom" or "Dad".
  • Vietnamese and Spanish, for communities hit by the same scams.
  • Per-family access control on verdicts, and a larger labeled test set for accuracy numbers.

Disclosures

  • Claude Code helped write, test and review code and docs.
  • The scam messages are from real scam reports, used as text only and never opened.
  • APK samples: one synthetic scam-pattern sample built by our team (not live malware), plus two open-source F-Droid apps as benign comparisons. APK upload from the app isn't tested yet; the demo uses the link path.
  • The pasted SMS goes to our analysis service for the rules; Claude only gets the rules' findings.
  • The verdict table is publicly readable (hackathon limitation). Small test set, so accuracy numbers are indicative only. Rule reasons are English-only for now.

Built With

Share this project:

Updates

Submission history