VCheck

Medium-risk01
Main page
Input message
Medium-risk01

Inspiration

I almost became a scam victim once. What frustrated me most was how believable and urgent the message felt in the moment. Scam messages are designed to pressure people into acting before they have time to verify what is happening.

Existing spam classifiers can produce a label, but users still need understandable answers:

What exactly looks suspicious?
Does the link really belong to the organisation?
Which evidence can be trusted?
What should the user do next?

That experience inspired VCheck, with one simple goal:

NO MORE SCAMMERS.

VCheck helps users pause, check and verify suspicious messages before clicking, replying or transferring money.

What it does

VCheck is a DataHub-aware scam-risk assistant for analysing suspicious messages, screenshots and links.

Users can:

paste a suspicious message;
upload a screenshot for OCR text extraction;
receive a Low, Medium or High risk assessment;
view the warning signs that contributed to the score;
inspect extracted links and domain findings;
distinguish trusted demonstration domains from possible lookalikes;
see which evidence sources DataHub selected or excluded;
ask follow-up questions about the current assessment; and
submit a sanitised report as unverified community evidence.

VCheck combines explainable rules, a supporting machine-learning classifier, URL analysis, OCR and DataHub-governed evidence selection.

Its main innovation is that it does not only explain why a message appears suspicious. It also explains why the evidence behind that assessment should or should not be trusted.

For example, DataHub context may allow reviewed guidance and verified-domain evidence to support a decision, while excluding an unverified community report from authoritative domain verification.

VCheck provides a risk indication rather than definitive proof that a message is legitimate or fraudulent. Important requests should still be verified through official channels.

How we built it

VCheck was built as an end-to-end browser application using a Python and FastAPI backend with an HTML, CSS and JavaScript interface.

The analysis pipeline works as follows:

Message or screenshot
        ↓
OCR extraction when required
        ↓
Explainable scam-warning rules
        ↓
Machine-learning classification
        ↓
URL and domain analysis
        ↓
DataHub context and evidence selection
        ↓
Final risk score, explanation and recommended actions

The machine-learning component uses word and character TF-IDF features with logistic regression. Its contribution is capped at 30 risk points so that deterministic warning signs remain visible and auditable rather than allowing the model to dominate the final result.

The URL-analysis layer checks for signals such as:

raw IP-address links;
non-HTTPS links;
suspicious top-level domains;
URL shorteners;
punycode domains;
exact trusted-domain matches;
trusted subdomains;
possible lookalike domains; and
misleading nested domains.

Screenshot text is extracted using Tesseract OCR and then passed through the same analysis pipeline as pasted text.

DataHub acts as VCheck's context and governance layer. The project registers datasets, evidence metadata, ownership, classifications, review status, freshness information and training-data lineage in DataHub. VCheck accesses this context through the DataHub Agent Context Kit.

DataHub directly affects the application's behaviour by determining whether an evidence source is appropriate for a particular role. For example, the verified-domain dataset is used only when it is selected as trusted evidence. Unverified community reports are excluded from authoritative domain-verification decisions.

The data used includes:

the public UCI SMS Spam Collection;
deterministic synthetic Malaysian-style scam messages;
synthetic legitimate messages;
manually structured official scam guidance;
a small verified demonstration-domain dataset; and
fictional or sanitised community reports for testing.

Community reports are sanitised and written back as unverified evidence rather than immediately being treated as confirmed scam information.

Challenges we ran into

One major challenge was making DataHub an essential part of the application rather than simply displaying metadata.

I had to design an evidence-selection policy that could:

select reviewed and reliable evidence;
use synthetic data only in appropriate supporting roles;
exclude unverified community reports;
explain every selection or exclusion; and
control whether verified-domain evidence was allowed to influence a result.

Another challenge was combining several analysis layers without double-counting risk. The rule engine, machine-learning model and domain analyser all had to contribute useful signals while producing one consistent final score.

Domain verification also required careful implementation. A simple substring check could incorrectly trust a domain such as:

bank.vcheck-demo.test.fake-site.com

VCheck therefore checks complete hostnames and distinguishes between exact trusted domains, valid trusted subdomains and possible lookalikes.

The local development environment created additional challenges, including configuring DataHub Quickstart, working with Agent Context Kit authentication, handling Windows security restrictions affecting the DataHub command-line executable and connecting Tesseract OCR correctly.

Finally, I had to make a technically detailed system understandable to normal users. The interface needed to present warning signs, provenance, evidence decisions and limitations without overwhelming the user.

Accomplishments that we're proud of

I am proud that VCheck became a complete end-to-end working MVP rather than only a classifier or concept.

The finished project can:

analyse suspicious text;
extract and analyse text from screenshots;
produce explainable risk levels and scores;
identify possible lookalike domains;
protect against misleading nested-domain matching;
retrieve DataHub context through the Agent Context Kit;
display trusted and excluded evidence;
show training-data lineage;
answer contextual follow-up questions;
sanitise and submit community reports; and
write those reports back as unverified evidence.

I am especially proud that DataHub directly affects the agent's decisions. If trusted verified-domain evidence is unavailable or excluded, VCheck does not silently claim that a domain is verified.

The project also includes automated tests, demonstration examples, complete setup instructions, a judge testing guide and an Apache 2.0 open-source licence.

What we learned

This project taught me that building a responsible AI agent involves much more than training a model.

I learned how DataHub can provide context about:

data origin;
ownership;
classifications;
review status;
freshness;
lineage;
reliability; and
permitted evidence roles.

I also learned how provenance and governance can influence application logic rather than existing only as documentation.

Technically, I gained experience with:

FastAPI application architecture;
DataHub metadata registration;
the DataHub Agent Context Kit;
TF-IDF and logistic-regression classification;
OCR integration with Tesseract;
URL parsing and domain-security checks;
frontend development using HTML, CSS and JavaScript;
Pydantic validation;
automated testing with pytest; and
code-quality checks using Ruff.

Most importantly, I learned that explainability should include not only how a prediction was produced, but also whether the evidence used to support it was appropriate.

What's next for VCheck

The current version is a prototype using public, synthetic and demonstration data.

Future development could include:

expanding the verified-domain dataset through authorised partnerships;
supporting more Malaysian and ASEAN languages;
improving OCR for noisy mobile screenshots;
adding more advanced brand and domain-similarity checks;
creating a review workflow for community reports;
adding evidence approval and moderation roles;
integrating authorised official scam-warning feeds;
deploying the application as a publicly accessible service;
conducting user testing with students, families and less digitally confident users; and
developing browser or mobile integrations that allow users to check suspicious content more quickly.

A future production version could help organisations and communities share scam intelligence without allowing unverified reports to become trusted facts automatically.

VCheck's long-term vision is simple:

Help people pause, check and verify — with DataHub making the evidence transparent.

NO MORE SCAMMERS.