Vouch

Home: Check a message, On a call, and “My people”.
Alex’s own phone signed “this wasn’t me”. Vouch shows a full-screen STOP before any money moves.
“Possible family-emergency scam”, with three steps and “Ask Alex’s phone now”.
Alex’s phone confirmed with a signed Yes, and both the server and this phone checked it. Only a person can clear a request.

Inspiration

Scams work because you can't tell who is really on the other end. AI can now clone a voice in seconds, and a spoofed number or a polished message proves nothing. The FTC reported that consumers lost more than $12.5 billion to fraud in 2024, and $2.95 billion of that was imposter scams. Imposter scams often borrow a familiar voice, like a grandparent getting a call from a "grandchild in trouble". Detecting fakes is a losing arms race, so we asked a different question: what if you could check the person instead?

What it does

Vouch is two-factor authentication for people.

Friend check. When a text or call claims to be a friend asking for money, you tap Check. Your friend's real, paired phone asks, "Did you just ask Grandma for $200?". Their Yes or Not me is signed with a key that never leaves their phone, and both our server and your phone verify the signature before showing a result. A scammer can fake a voice or a message, but not your friend's own phone.
Rotating code word. Paired phones share a two-word phrase that changes every minute. On a live call, you ask "What's our word?" and type what they say. A wrong answer or a dodge is a red flag.
Bigger amounts need more proof. Under $25 is a signed Yes. Up to $200 also needs the retyped amount and the code word. Over $200 needs a second trusted person. Gift cards, wires, and crypto never go green on a Yes alone.
Warnings for scams that aren't about money. A fake bank asking for a verification code, a remote-access request, password and card-detail phishing, a fake delivery link, or an ID request gets a plain-words warning with three steps to take. On a live call, the app listens and warns as the scam unfolds, for example, when the caller asks you to read out a code.

AI can warn; only a person can clear. Rules and Gemini add warnings and a plain explanation. They never produce a verdict and can never clear a request. Everything works with no AI at all.

How we built it

A phone web app in plain JavaScript (no build step) using Web Crypto: ECDSA P-256 signatures and ECDH shared secrets, with non-extractable private keys kept in the browser's IndexedDB.
Node.js, Express, Socket.IO and SQLite on the server. The server is the source of truth. It stores only a SHA-256 of the normalized message text, the amount and the answer, never the message itself.
A pure decision engine that turns the friend's signed answer, the payment method, the amount and the timing into red, amber or green. We tested it across about 4,800 input combinations.
A risk layer of phrase rules plus Google Gemini (structured JSON, a model fallback chain, a 3-second timeout and a rule-based fallback). Gemini can only add caution.
A call engine that scores a call as a scam script unfolding in stages, with red lines such as "read me the code".
ElevenLabs for spoken alerts and for speech-to-text on calls and voice notes.
An optional Telegram bot that runs on the same server, hosted on Render.
322 automated tests.

Challenges we ran into

Keeping the safety rule. The AI can't be allowed to approve anything, so Gemini can only raise a warning. We ran our scenarios with a bogus key and got verdicts identical to rules-only.
Avoiding false alarms. A real bank saying "we will never ask for your PIN" must not trigger a warning, and a friend asking for $15 for pizza must not look like fraud.
Gemini model availability, which changed during the hackathon, so we built a fallback chain.
Real-time call detection on phones. Echo, noise, and browser limits mean live listening depends on the phone letting a web app use the microphone. We tested it on staged calls, and we say so.

Accomplishments that we’re proud of

A friend check that is real end-to-end: real keys, real pairing and real signatures, with nothing simulated.
A phone that still warns you about scams with no AI and no connection. The friend check needs a connection, because it asks your friend's real phone.
Plain, calm warnings written for someone scared in the middle of a call.

What we learned

Trust is the product. The strongest design was not a better detector but a smaller promise: only a person can clear a request.

What’s next

Native push and a store app, so warnings can reach you without keeping a tab open.
Persistent storage, since the free hosting tier loses pairings when it sleeps.
Testing with real users and a proper study, including older adults.
Automatic screening of incoming messages and calls, which needs native permissions.
More languages.