UNMASK-AI

• 

• 

• 

• 

• 

Inspiration

Digital scams are becoming increasingly difficult to recognize. A message can appear to come from a bank, company, delivery service, or trusted organization while directing the victim to a fake phone number, QR code, or website.

I wanted to solve a deeper problem than simply asking whether a message "looks like a scam."

Can the identity and contact information behind a suspicious message actually be trusted?

That question inspired UNMASK AI, a multimodal verification system designed to help people investigate suspicious digital communications before they act.

What It Does

UNMASK AI allows users to analyze suspicious PDFs, screenshots, images, URLs, phone numbers, and QR codes.

It extracts relevant information such as:

Claimed organization Phone numbers URLs and domains QR-code destinations Urgency and social-engineering signals

The system then analyzes these signals and, where verification information is available, compares extracted contact details and domains against trusted information.

Instead of simply saying "This is a scam," UNMASK AI shows the evidence behind its assessment.

For example, it can identify that:

The supplied phone number does not match the trusted contact information.

A QR code points to a domain different from the expected domain.

The message contains high-pressure or urgent language.

The claimed identity could not be independently verified.

UNMASK then provides a clear risk assessment and recommends a safer next action, such as contacting the organization through an independently sourced official channel.

How I Built It

I built UNMASK AI as a full-stack application with a Next.js and TypeScript frontend and a FastAPI backend.

The document-analysis pipeline combines several technologies.

PyMuPDF extracts text directly from text-based PDF documents.

Tesseract OCR allows UNMASK to read text from screenshots, images, and scanned documents.

QR-code detection extracts destinations hidden inside QR codes.

Phone-number and URL extraction converts unstructured document content into structured evidence.

Entity extraction identifies organizations, contact information, and relevant claims.

The verification layer compares available contact and domain information against trusted verification data.

The risk engine combines multiple observed signals to determine whether the communication has low, suspicious, or high-risk characteristics.

A major design principle behind UNMASK AI is separating observed facts from inference.

For example, if UNMASK detects a phone number, it reports that the phone number exists. It does not automatically claim that the number belongs to a scammer.

Similarly, if information cannot be verified, the system can mark it as unverified rather than automatically treating it as malicious.

This makes the results more transparent and explainable.

What I Learned

Building UNMASK AI taught me that an effective cybersecurity system should not simply generate a prediction.

A useful security tool should provide:

Evidence → Verification → Explanation → Action

I also learned how different forms of information can work together during security analysis.

A phone number alone may not reveal much. A QR code alone may not reveal much either. But when the phone number, domain, QR destination, claimed identity, and language of the message are analyzed together, they can provide much stronger evidence of potential impersonation.

Working on the project independently also gave me experience across the complete development process, including frontend development, backend APIs, OCR integration, document processing, security logic, testing, debugging, and connecting the complete analysis pipeline.

Challenges I Faced

One of the first challenges I encountered was processing documents that contain images instead of selectable text.

I solved this by combining PDF text extraction with Tesseract OCR, allowing UNMASK to process both normal PDFs and image-based content.

Another important challenge was avoiding false certainty.

A cybersecurity system can become unreliable if it confidently labels something malicious without sufficient evidence. Because of this, I designed UNMASK around explainable findings and clear verification states such as Verified, Mismatch, Suspicious, and Unverified.

Integrating multiple components into one pipeline was another challenge. OCR, QR detection, entity extraction, URL analysis, verification, risk assessment, the FastAPI backend, and the frontend all needed to work together while keeping the user experience simple.

What's Next

UNMASK AI is designed as a foundation that can be expanded with additional trusted verification sources, threat-intelligence providers, domain reputation services, and stronger multimodal AI analysis.

Future versions could also support suspicious voice recordings and analyze them for potential AI-generated impersonation indicators.

The platform could eventually evolve into a browser or communication-layer security assistant that helps users verify suspicious interactions before responding, calling a number, opening a link, scanning a QR code, or sharing sensitive information.

My goal with UNMASK AI is simple:

Don't ask users to blindly trust an AI verdict. Give them the evidence they need to make a safer decision.

Built With

• fastapi
• next.js
• opencv
• pydantic
• python
• react
• tailwind
• tessesractocr
• typescript