ScamPause

Devpost write-up

ScamPause

A check step between receiving a suspicious message and sending money.

Who it is for, and the risk

Older adults, students living away from home, people less familiar with the internet, and the family members who look out for them. Scammers pretend to be the police, a bank, a courier or a relative. They create panic and ask you to transfer money, share a one-time code or tap a link. Under pressure, people struggle to think clearly.

What it does

• Gives a 0–100 risk score and a level the moment you paste a message.
• Explains each warning sign in plain language and highlights the exact words in the message.
• Checks links offline for lookalike domains, borrowed brand names, shorteners and risky endings, without ever visiting them.
• On high-risk messages, makes you pause for 10 seconds, then shows a checklist matched to the warning signs.
• Drafts a message you can copy and send to someone you trust.

How it is built

Plain HTML, CSS and JavaScript with no third-party libraries. The engine combines rules in 10 categories, negation handling (so “never share your TAC” is not treated as a request), combination bonuses for classic scam scripts, and link analysis. Lookalike domains are caught with character normalisation (rn→m, 1→l, 0→o) plus edit distance. All processing happens in the browser. The interface switches between English and Chinese, and both rule sets run on every message, so mixed-language messages are checked too.

One safer outcome

A grandmother gets a message from “Inspector Lim” saying her IC is linked to money laundering, and that she must move her savings to a safe account within 2 hours and tell no one. ScamPause scores it 100, high risk. It flags the claimed authority, the threats, the deadline, the request for money and the demand for secrecy, pauses her for 10 seconds, and tells her to hang up and call the police on the official number. She sends the drafted message to her daughter and does not transfer anything.

One limitation

Rules only catch known scripts. Two deliberately gentle scams in the dataset were missed: an “investment teacher” inviting you to a group chat, and a “platform team” asking for your WhatsApp. A real police anti-scam reminder was flagged as “be careful” because it mentions transfers and a safe account. ScamPause cannot verify who is really on the other end. It prompts you to stop and check; it does not replace your judgement.

Built during the hackathon vs. pre-existing

About the data

All 60 messages are invented. Names, numbers and domains are fictional. The lookalike domains have not been checked for registration, so please do not visit them.

What is next

• Screenshot upload with on-device text recognition
• A language-model second opinion for gentle scripts the rules miss
• Malay support
• A share-sheet shortcut so you can send a message to ScamPause straight from your chat app

Devpost 项目说明

ScamPause 防诈暂停键

在收到可疑消息和转账之间，加一个检查步骤。

目标用户与风险

长辈、刚到外地的留学生和不熟悉网络的人，以及他们的家人。诈骗者冒充警察、银行、快递或亲友，制造紧急感，要求转账、提供验证码或点链接。人在慌张时很难冷静判断。

解决方案

• 粘贴消息后立即给出 0–100 风险分和等级。
• 用大白话列出可疑点，并在原文里标出触发的词句。
• 离线检查链接：相似域名、借用品牌名、短链接、可疑后缀，从不访问链接。
• 高风险时强制「先停 10 秒」，再给出对应的检查清单。
• 一键生成「问问家人」的消息，复制后发给信任的人。

技术

纯前端，HTML、CSS 和原生 JavaScript，没有第三方库。检测引擎由 10 类正则规则、否定语境识别（例如「请勿透露验证码」）、组合加分和链接分析组成。仿冒域名用字形归一化（rn→m、1→l、0→o）加编辑距离识别。所有计算在浏览器本地完成。界面可以在中文和英文之间切换，两套规则对每条消息都会运行，中英混杂的消息也能检查。

一个更安全的结果

奶奶收到「刑侦支队李警官」的消息，说她的银行卡涉嫌洗钱，要她 2 小时内把钱转到安全账户，并且不能告诉家人。ScamPause 给出 100 分高风险，标出冒充权威、要求保密、要求转账、制造紧急、威胁恐吓五个可疑点，先让她停 10 秒，再提示挂断后拨打官方电话核实。她把生成的消息发给了女儿，没有转账。

局限性

规则只能识别已知话术。合成数据集里有两条故意写得很温和的诈骗没有被发现：一条是「理财老师带你赚钱」的引流消息，一条是「平台工作人员」要加联系方式。另外，警方发布的反诈提醒会因为提到「安全账户」「转账」被误判为需要警惕。ScamPause 无法验证对方的真实身份，它的作用是提醒你停下来核实，不能代替判断。

比赛期间构建与已有组件

数据说明

60 条消息全部为虚构。人名、号码和域名都是编造的。仿冒域名没有核实是否已被注册，请不要访问。

下一步

• 截图上传和 OCR 识别
• 用大语言模型做第二道判断，处理规则漏掉的温和话术
• 马来语支持
• 做成手机分享菜单入口，收到消息直接转给 ScamPause