Vero by Team Rahaar

Vero: Privacy-First Scam & Phishing Shield "Verify before you trustm privacy-first AI protection against SMS and digital payment scams."

Inspiration

As digital wallets like eSewa, Khalti, and ConnectIPS have transformed the economic landscape of Nepal, they have also unfortunately opened the doors to highly sophisticated digital fraud. Users are daily bombarded with urgent, deceptive SMS alerts, fake social media/Telegram task recruitments, and malicious QR codes.

Traditional security apps often rely on invasive inbox scanning, checking private bank OTPs and conversations, compromising user privacy. Furthermore, once users fall victim, they have no central community repository to verify if a suspect phone number or payee bank account has been flagged.

Team Rahaar created Vero to break this cycle. We set out to build a highly localized, privacy-first mobile shield that acts as a proactive defense mechanism without ever requesting sensitive credentials or invading personal messages.

What it does

Vero provides a multi-layered security ecosystem to safeguard Nepalese mobile users:

Non-Invasive Notification-Based Interception: Replaces intrusive bulk SMS inbox scanning with an event-driven NotificationListenerService that monitors incoming notifications from SMS, WhatsApp, Telegram, and other messaging platforms in real time. Local Multi-Dimensional AI Scoring: Evaluates messages using an integrated Naive Bayes model trained on a dataset of 1,000 Nepalese scam texts. It computes a Scam Likelihood Score (0–100%) based on five key behavioral vectors: Urgency & Panic (e.g., "Verify today or account blocked") Financial Targets (requests for money, OTPs, tax clearances) Brand Impersonation (e.g., eSewa, Khalti, Nabil Bank) Link & QR Threats (untrusted domains or shortened redirects) Reward Promises (lotteries, gift boxes, job earnings) Isolated In-App Sandbox Web Browser: Deep-links suspicious links to a secure, Javascript-disabled WebView container, allowing users to safely inspect redirect targets and final destinations without risking device compromise. Verified Bank Payee Name Alignment: Prevents "mule account" scams by validating bank credentials. When users input a payee's bank, account number, and expected name, Vero queries the threat database and runs a custom Levenshtein fuzzy matching algorithm to ensure the registered name aligns with the user's input. Gold-Tier Verified Reporting System: Employs a Level 0–3 tiered community reporting system. Gold-tier reporting leverages citizenship OCR scanning, biometric liveness simulation, and selfie checks to prevent spam reports and ensure community-verified integrity. Gemini-Powered Intelligence: Integrates Gemini 3.5 Flash to generate clear, objective plain-text summaries of flagged entities, and Gemini 2.5 Flash to analyze consistency of evidence screenshots and resolve disputes.

How we built it

We developed Vero using a modern, scalable, and decentralized tech stack:

Frontend Mobile Client: Built natively with Android Jetpack Compose, utilizing a dark, premium Bento-Grid inspired styling system. Local Machine Learning: Created a lightweight Naive Bayes Classifier implemented in pure Kotlin for instant, offline notification tokenization and probability calculations. Gemini LLM Integration: Communicated with the Gemini API via OkHttpClient to handle real-time vision checks for evidence consistency and automated report summaries. Local Storage: Configured Android Room Database to cache threat registries, manage local blocked senders, and index intercepted notification alerts. Backend API Service: Integrated with a FastAPI backend server hosted on Render (https://viro-z4q1.onrender.com/), which handles user authentication, secure OTP verification, report syncs, and file uploads.

Challenges we ran into

Privacy vs. Security (SMS Access): Requesting the READ_SMS permission is a major red flag for security apps. We solved this by switching to a notification listener which intercepts only transient notifications from active messaging apps, ensuring zero-read access to a user's private message history. Spelling & Alias Mismatches in Bank Checks: Nepalese names are transliterated into English with many spelling variations (e.g., Sita Kumari Gurung vs. Sita K. Gurung). We solved this by combining standard Levenshtein distance with a word-overlap intersection parser to achieve high-accuracy name alignment. Offline Compute Constraints: Low-end devices struggle with heavy deep-learning classifiers. We designed our custom Naive Bayes tokenizer with Laplace smoothing to keep classification blazing fast and 100% offline.

Accomplishments that we're proud of

Preventative Mule-Account Shielding: Successfully implemented a system that flags bank mismatch anomalies before a user hits transfer on their payment gateway. Sleek, Premium Dark Aesthetics: Crafted an immersive, high-contrast user interface featuring glassmorphic components, micro-animations, and structured bento boxes. Dual-Engine Validation: Blended instant, local statistical model execution (for offline scanning) with cloud-based LLM validation (for verification and reporting consistency).

What we learned

Avoiding Anti-Pattern Pitfalls: We realized that a security app asking for credit cards or credentials mimics the exact behavior of the scams it tries to block. Vero remains strictly read-only and metadata-driven to command absolute user trust. Notification-Driven Architecture: Moving from passive database searches to real-time notification interception is the most reliable way to stop scams before a user even opens the messaging app.

What's next for Vero by Team Rahaar

Live Gateway Name Resolution: Integrate directly with Nepalese API systems like ConnectIPS or eSewa Developer Sandbox for real-time interbank name lookups. Carrier-Level Auto-Blocking: Partner with telecommunication networks to block flagged SMS headers at the carrier level. On-Device Gemini Nano: Leverage Android AICore to run LLM checks entirely on-device, achieving absolute privacy and offline intelligence.