FraudLens

The problem

Scams in Mauritius arrive in mixed Kreol and French: an SMS saying your MCB account is blocked, a WhatsApp "bank" asking for the one-time code it just sent, a fake MRA refund page. Generic filters don’t read Kreol, don’t know that mcb.mu is real and mcb.nu isn’t, and hand back a score nobody can explain.

How it works

• A language model reads the message and may only return tactic codes from a fixed list, each with a quote copied from the message. Code checks every quote against the original and drops anything it can’t find there.
• A versioned rules engine turns those findings into the score, the verdict and the advice, and lists every point it added.
• A registry of official domains for seven Mauritian banks, telecoms and government bodies catches look-alike links, including Cyrillic letter swaps.
• The web app, a Chrome extension and an Outlook add-in all call the same backend. None of them has its own copy of the detection logic.
• PDFs and Word files are checked for how they were made, such as a pasted signature or edits after signing, and reported as warning signs, never as “forged”.

Design decisions

• It still works when the AI is down. If the model fails or times out, the rules return a full verdict on their own. It was designed for a live demo on bad Wi-Fi.
• The same findings always give the same score. The model never scores anything.
• Phone numbers, emails and account numbers are redacted in the browser before a message is sent.

My part

• Built the test pages, ran the QA rounds and wrote the fix-check harness.
• Built the PDF and Word document forensics.
• Reviewed the Kreol scam dataset and tested Kreol consistency. Only the 61 human-reviewed rows are used.

Not done yet

• No user accounts or per-user access control yet.
• SQLite and in-process rate limiting suit one demo instance, not real traffic.
• Uploaded documents are stored unencrypted, and nothing deletes them yet.