Demo Slide
Home Screen
Someone is behind you!
Hidden Screen
Scammer Laptop
We won!

TD Sidekick — 🏆 TD Fraud Hackathon Winner 🏆

What Inspired Us

Scams work because they exploit something remarkably human: our instinct to trust, to help, to act quickly when someone sounds urgent. We spoke with fraud professionals who mentored us during brainstorming, and the pattern they described was consistent, victims are isolated at the exact moment they need a second opinion. Sidekick puts that second opinion inside the banking app itself.

What We Built

Sidekick adds two layers of live defense to a mobile banking app:

BlindSpot watches for shoulder surfers. At sign-in, the front camera runs a surroundings scan (face-api.js, sampled twice a second). If it sees more than one face, the app instantly blurs your balance, full card number, and transaction amounts and raises your risk score. Look away from the camera and it stays hidden; once you're alone again, the score decays back to baseline on its own.

Live risk scoring + one-tap lockdown. Every suspicious signal (an exposure event, a phishing SMS you tapped, a sign-in from an unrecognized device) feeds a 0–100 risk meter. When a scammer with your stolen credentials tries to log in from a desktop, their session hangs on a fake "Verifying device…" spinner while your phone jumps to red and surfaces a full-screen alert. You tap No — LOCK IT DOWN, and the session is revoked, payees cancelled, contact changes reverted, and credentials rotated. Their window goes dead. The Victim becomes a Defender.

The demo runs as two browser windows of the same static app, the victim's phone and the scammer's desktop, synced live over a BroadcastChannel. No backend, all fake data, everything watermarked DEMO.

What We Learned

Designing something simple is very complex. Most of our time went into tradeoffs between a frictionless user experience and ideas that were genuinely novel. We learned that creativity in this space comes less from one brilliant insight than from merging two well-executed ideas into something that covers a gap neither did alone. Sidekick is literally that: shoulder-surfing detection and account lockdown, stitched into one risk score.

How We Built Our Project

Vite, React, JS, Claude

We initially scoped a full backend with OpenCV for facial recognition/shoulder surfing and camera detection. With three hours on the clock, we cut it and moved detection into the browser with face-api.js, redirecting the rest into a front-end complete enough to demo end-to-end. BroadcastChannel (with a localStorage fallback) gave us real multi-device sync without shipping a server so the scammer's window and the victim's phone genuinely talk to each other.

We also made the camera path fail-safe: if the model download or camera permission fails, it degrades silently and the deterministic demo path still works. Live demos in front of judges don't get a second take.

Challenges We Faced

Our biggest time sink was brainstorming toward the most pragmatic approach to the problem statement. We eventually voted and merged our two strongest concepts rather than picking one.
npm and access control fought us for much of the build since several packages wouldn't install or were blocked outright, so we had to work around them.
Claudemaxxing was essential part of the workflow to generate and refine components while simultaneously fleshing out the demo's execution flow for the judges. Since the hackathon was 3 hours long, prompting well became a real skill on the team by the end.