ScamSense

About the Project

Would you recognise a scam if it arrived as a whole team?

I built ScamSense: Inbox Defender, a colourful desktop browser game where players face realistic scam rings before real ones find them. Across 6 cases, from easy to expert, each case is one organised scam operation whose members hand you to each other, back each other up and reuse details. A few genuine contacts are mixed in, and some of them sound just as pushy as the scammers.

Rationale

Scams rarely arrive as one message. A “courier” hands you to a “police officer”, who hands you to a “prosecutor”, and each one vouches for the last. When it happens you are alone and under pressure, and posters and tip lists don’t prepare you for that moment. Practice does.

How It Plays

There are no multiple-choice buttons and no timers. Instead:

• players type their own questions, such as “can I call you back on the number on my card?”;
• a “Your life” card gives facts to check claims against, though some scammers know real details, so the easy checks pass;
• players collect warning signs, good signs and contradictions between ring members, such as two “officials” quoting different case numbers; and
• each chat is judged Scam or Real: going along with a scammer costs your savings, while accusing a genuine sender costs trust.

A debrief at the end explains how the operation worked. A Scanner power-up also runs the real multi-party scam analyser from a larger project of mine, with PII redaction, deterministic rules for things like look-alike domains, and cross-party reasoning. It only ever says Likely scam, Suspicious or Can’t tell, never “safe”.

How It Works

The game is vanilla JavaScript, HTML and CSS running entirely in the browser, so there is no install and no account. The characters are voiced by a Python service on Groq using gpt-oss-120b. Each turn, one call works out what the player meant; then code, not the AI, decides whether the character should slip, so clues are grounded and fair. A second call writes the in-character reply. On harder cases, a tell only appears if you press the same angle twice.

Responsible AI

The AI can only voice a fixed cast of fictional characters. Attempts to make it write a scam message or break character get an in-character shrug, and only pre-written links and numbers can appear. Personal details such as NRIC and phone numbers are stripped from what players type before it reaches the AI, and nothing is stored on a server.

All scenarios are fictional and written by me, based on commonly reported scam patterns, and the game has not yet been playtested with large numbers of real people.