QuackTag

QuackTag Logo
Physical device that updates the fob with the secret key for authentification.
Physical device that updates the fob with the secret key for authentification.
A demo debt card and fob.
UI of the banking system using Nessie API.
Prompt that shows up when certain limit on transfer is surpassed or risky transaction.
Prompt of likely fraud.
Demo card reader as a checkout for a shop.
Demo purchase.

Inspiration

This project was something that came to us due to a shared frustration that our grandparents were targeted and fell for these scams targeted at them. Malicious actors increasingly rely on card skimmers and AI-automated voice calls to exploit the elderly. With this information, they either commit Debit Card fraud or have the elderly unknowingly send money to an account pretending to be someone else. Because these debit card transfers are immediate and difficult to reverse, the damage is quick and severe.

We wanted a payment method that ensures a thief can't commit fraud with the card and the PIN, and a safety net for the person who is being talked into a scam.

What it does

SwampTag adds a physical key with a rotating code to a debit card.

A key that keeps changing. A small Arduino-based key device (Adafruit Feather RP2040 + RC522) rewrites a fresh, signed code onto the key fob, updating every 15 seconds. Each code carries a counter, so a copied key goes stale the moment the real one is used again, and the terminal refuses it. If someone skims your fob, it will be completely useless as the counter will already be different.

A phone as the payment terminal. A Pixel phone reads the key over Web NFC and shows the amount and a clear indicator depending on whether the fob is approved or not. This served as a demonstration of how a real card reader will communicate whether the purchase was made using the Nessie API.

Your own tap limit. After linking a key, SwampTag asks, "How much can you spend before we have to run these checks?" (default $200). Payments below the limit go straight through, while the rest needs verification.

Voice scam check. Before a payment over the limit, or any transfer of $200+, SwampTag asks, "What is this for?" You can say it out loud or type it. If out loud, Whisper transcribes it on the laptop, and Gemini reviews it for scam patterns (a relative "in trouble", "the IRS told me to", gift cards). A red flag pauses the payment, reads a warning aloud, alerts a trusted contact, and offers to connect to a representative.

Nessie at work. Balances, purchases, transfers, deposits, and bills all come from Nessie. A live panel on the dashboard lists every Nessie API call as it happens, and Nessie decides "insufficient funds" at the pump.

Sign-in. Auth0 login (Google, MFA) stores the linked key in the user's profile.

How we built it

Key device: Adafruit Feather RP2040 + RC522 RFID reader, writing an NDEF record ST1:<keyId>:<counter>:<code>, where the code is an HMAC-SHA256 of the key ID and counter with a secret shared with the server.
Terminal and pump: web pages on a Pixel 6a using Web NFC, with a small Python relay that checks each code and counter.
Server: Python standard-library server that serves the site, forwards requests to Nessie while keeping the API key off the browser, relays between the dashboard and the phone, and runs the voice check.
Voice: faster-whisper for speech-to-text and the Gemini API for the scam review, with offline phrase rules as a backup so the demo never gets stuck.
Website: plain HTML, CSS, and JavaScript, no build step.

Challenges we ran into

The phone was not properly connecting to our local host, leaving us unable to test out our product until it was fixed.
A cheap tag can only be rewritten so safely; MIFARE Classic writes needed careful re-authentication.
Two of us built two halves (voice + Gemini, and the phone terminal) on separate branches, and had to merge them into one working version.
Difficulty making the device small-form while having the necessary components to write.

Accomplishments that we're proud of

A key whose code changes on every use, checked end-to-end from the key device to the card reader to the bank.
A scam check that actually listens to a worried person and answers in plain language, also giving the option for human assistance.
An entertaining video that both explains the technical side while letting us have some fun.

What we learned

How NFC and NDEF records work, how to make a signed rotating code with a counter.
How Whisper and Gemini fit together in one pipeline to translate speech to text back to speech.
How to properly hold documentation so we don't overwrite or lose important bits of code.

What's next for SwampTag

Challenge-response tags (such as MIFARE DESFire). Implementing our technology inside one tag.
A real hand-off to a bank representative and calls to a trusted contact (right now those are simulated, and no call is made.
Proper implementation with card reader terminals, not just the phone we had simulating one.