Sound Guardian

Stops account takeovers at the moment a new payee is added, before money moves, by confirming through the contact info on file before it was changed.

Comment

Inspiration

In Sound's synthetic data, Sarah clicked a fake login page at 10 PM. In under half an hour a scammer reset her password, swapped her email and phone, added a payee and sent two P2P payments. P2P can't be recalled, and she found out two days later.

What it does

Sound Guardian looks at which contact detail changed, not just that something changed.

  • QUARANTINE tier: password reset + email or phone change + new payee. The payee is locked the moment it's added, before any payment. Confirmation goes only to the contact info on file before the change (Sound keeps it 90 days), so a scammer holding the new phone can't approve it. The message warns: "Sound will never call or text asking for this code."
  • LIGHT tier: reset + address-only change + new payee (people who move). One tap, "Was this you?", releases in seconds.
  • Staff console: dashboard of held items; our reason code and the exact flagged events next to the existing risk score; next-business-hours queue; branch requests on top; two-person release for quarantine; full audit log.
  • Recovery: an always-visible "I think I've been scammed" button opens a case, pauses outgoing payments and books a callback.

Walkthroughs

  • Anchor, Sarah (M1003), takeover, caught: payee locked at 22:19, 3 minutes before the first payment. Real Sarah taps Freeze & Recover; both payments stopped.
  • Look-alike, M1039, legitimate mover: flagged LIGHT, one tap, released in 8 seconds. "I'd like to talk to someone" is the appeal path.

What it misses, honestly

James (M1004), government impersonation: no reset, no contact change, $7,000 cash in a branch. Our rules don't fire. Branch mode still shows the teller the Contact Center note from the day before and asks "Has anyone told you to keep this secret?"; the member decides. Phase 2 adds an authorized-scam layer and an optional trusted contact the member chooses.

Evidence (synthetic data, illustration only)

The QUARANTINE rule fired on 12/12 takeover journeys and 0/106 others (20 look-alikes, 50 routine, 36 other scams), 3–9 minutes before the first payment.

Data used / not used

Used: observable events in the provided synthetic dataset. Not used: the answer key, age or demographics, device intelligence, biometrics, voice/telecom, consortium feeds, members' messages. Rules decide; the LLM only writes explanations from tokenized data, and the app works with AI off.

90-day pilot (baselines and targets are assumptions)

Days 1–30 shadow mode (log only, measure baseline and false positives) → 31–60 limited live slice → 61–90 measure and expand. Targets: 50–80% lower new-payee losses after credential + contact changes; median LIGHT release under 5 minutes; false positives no higher than today's holds.

Privacy & accessibility

Tokenized IDs and masked numbers, no deceptive screens, no-blame wording, English/Spanish, large-text mode, WCAG AA, keyboard and screen reader support, phone or branch alternative at every step.

How we built it

Gemini (planning, PRD) → Google AI Studio Build (React, TypeScript, Tailwind) → Antigravity (local dev, review, deploy to Streamlit).

Built With

Share this project:

Updates