Sound Guardian

Inspiration

Account takeovers follow one pattern: a password reset, a contact change, then a new payee and a fast payment. Once the attacker controls the email or phone, every "is this you?" check goes to them.

What it does

Sound Guardian watches the sequence, not single events. A reset plus a new email or phone plus a new payee puts the account in QUARANTINE, and the payee is confirmed through the contact on file before the change. A reset plus an address-only change gets a LIGHT one-tap check, so real movers are not blocked. Staff get a console with the case, the timeline and the exact signals that fired.

Results on the synthetic data (118 members)

• 12/12 account takeovers quarantined, at the moment the payee was added, 3–9 minutes before the first payment
• 0/106 other members quarantined
• $37,855 attempted in takeovers; $19,245 was actually sent in the data
• Honest gap: authorized scams (the member sends the money themselves) are not caught yet. That is our next lane.

How we built it

React + TypeScript + Tailwind, built with Vite and deployed on Streamlit. Three agents: Sentry (signals), Arbiter (deterministic rules that decide the tier) and Guardian (plain-language explanations, with templates as fallback). The answer key is never used to make decisions.

Challenges

Not blocking real customers who moved, and making sure the confirmation never goes to a phone the attacker controls.

What we learned

In this data, timing is the strongest signal. The takeover always comes together within minutes of the new payee.

Live app: https://sound-guardian-prl4imbpxxprtslqjwz76g.streamlit.app

Built With

• gemini
• react
• streamlit
• tailwind
• typescript
• vite