VibePay

Inspiration

Digital payments have become incredibly convenient, but convenience often comes at the cost of security. Most transaction security systems focus on identifying suspicious users or unusual payment patterns, but they often overlook a fundamental question: Did the user actually intend to make this purchase?

A legitimate user can still be manipulated into purchasing an overpriced product, accepting an unauthorized seller, or paying hidden additional charges.

We wanted to approach transaction security differently.

Instead of asking only "Who is making this transaction?", we asked another important question: "Does this transaction match what the user originally authorized?"

This idea led to VibePay, a transaction security platform that independently verifies identity and purchase intent before making an authorization decision.

What It Does

VibePay introduces an additional layer of security between a user's purchase intent and transaction authorization.

It works through two independent verification layers:

1. WHO: Identity Verification

VibePay evaluates whether the transaction is being initiated under expected user conditions by checking:

Recognized and unfamiliar devices.
Known and unusual locations.
Unusually large transaction amounts.
Unusual transaction timings.
Machine learning-based anomaly signals.

2. WHAT: Intent Verification

VibePay compares the actual checkout against the user's original purchase authorization.

It checks:

Product and price consistency.
Authorized seller.
Permitted quantity.
Unauthorized additional charges.
Other purchase-condition changes.

3. Deterministic Policy Engine

Both verification results are evaluated by a rule-based policy engine.

Depending on the results, the transaction receives one of three primary decisions:

APPROVE: Identity and purchase intent match.
VERIFY: Identity appears suspicious, requiring additional verification.
HOLD: The transaction violates the original purchase intent and requires user intervention.

When both identity and intent raise concerns, VibePay requires additional identity verification while keeping the transaction on hold.

4. Tamper-Evident Evidence

Every important transaction event is recorded in a hash-chained audit log. This makes unauthorized changes detectable and provides a traceable record of the security decision.

5. AI-Powered Explanations

AI helps explain why a transaction was flagged in simple language. It does not approve transactions or override the policy engine.

How We Built It

VibePay follows a modular full-stack architecture.

Frontend

React.js
TypeScript
Tailwind CSS

Backend

Node.js
Express.js
TypeScript
MongoDB

Machine Learning

Python
Flask
Scikit-learn
Isolation Forest for anomaly detection

Security and Intelligence

JWT-based authentication using HTTP-only cookies.
Email-based OTP verification.
SHA-256 hashing for tamper-evident event records.
Rule-based drift detection.
Deterministic transaction policy engine.
LLM-powered transaction explanations.

The application uses a simulated payment environment to demonstrate transaction verification and authorization without processing real payments.

Challenges We Faced

One of the biggest challenges was designing two independent verification mechanisms that could work together without depending entirely on AI.

We wanted the system to remain predictable and explainable, especially during suspicious transactions.

Other challenges included:

Designing a reliable identity risk-scoring mechanism.
Detecting subtle differences between authorized purchase intent and actual checkout details.
Preventing OTP verification from bypassing purchase-policy violations.
Maintaining transaction evidence integrity through hash chaining.
Integrating machine learning signals without allowing them to control authorization decisions.
Keeping the architecture modular while connecting multiple services.

What We Learned

Building VibePay helped us understand that transaction security is not just about detecting suspicious activity. It is equally important to preserve what the user actually agreed to.

We explored how deterministic policy engines, machine learning, authentication mechanisms and cryptographic audit trails can work together to create a more transparent security architecture.

Most importantly, we learned that AI should assist security decisions rather than blindly control them.