Capstone projectsMiddleLesson 3337 min read

Build a scam detector for your family

Simple rules and a score can flag many common scam messages. Learn to measure what it catches, what it misses and how often it raises a false alarm.

✦ Ask the tutor 🧪 Lab · 30 min 📝 Lesson test

Speed

Lesson in motion

In 60 seconds

Build a scam detector for your family

Simple rules and a score can flag many common scam messages. Learn to measure what it catches, what it misses and how often it raises a false alarm.

1/6

In simple words

A smoke alarm beeps when it senses smoke. If it beeps every time you make toast, the family gets annoyed and switches it off. If it never beeps, it is useless. A scam detector is the same: it must catch most real danger without crying wolf all day.

Many scam messages follow patterns you already know from AI scams: how to spot them and what to do: pressure to act fast, a threat, a prize that is too good to be true, a request for an OTP or PIN, a link, or a request for money. A small program can look for these signs and give each message a score. Your family still decides; the tool only says "be careful with this one".

How a rule-and-score detector works

1
Rules
Each rule looks for one warning sign, using a few keywords or phrases, and has a weight.
2
Score
Add up the weights of the rules that fire on a message.
3
Threshold
If the score reaches the threshold, flag the message as "likely scam".
4
Explain
Show which rules fired, so the person understands why.

Warning sign	Example words	Why it is suspicious
Urgency or threat	"blocked today", "will be cut tonight", "arrested"	Pressure stops people from thinking or checking.
Asks for a secret code	"share the OTP", "tell your PIN"	Banks and payment apps say they never ask for these.
Asks for money or a fee to receive something	"processing fee", "registration fee"	Real prizes and jobs do not ask you to pay first.
Too good to be true	"you won", "guaranteed double returns"	Nobody gives big money for free.
Unknown link	"click", a web address	Links can lead to fake pages that steal details.
Secrecy or a claimed authority	"do not tell anyone", "customs officer"	Scammers pretend to be officials and isolate the victim.

Misses and false alarms

Every detector makes two kinds of mistakes. A miss is a scam it did not flag. A false alarm is a normal message it flagged. Lowering the threshold catches more scams but gives more false alarms. Raising it does the opposite. You cannot make both zero with simple rules, so you choose a balance and measure it.

Python: how the threshold changes the balance (made-up scores)python

# Made-up scores from a rule-based detector.
scam_scores = [7, 6, 5, 5, 4, 4, 3, 2]     # 8 real scams
normal_scores = [0, 0, 0, 1, 1, 2, 3, 4]   # 8 normal messages

for threshold in [2, 3, 4, 5]:
    caught = sum(s >= threshold for s in scam_scores)
    false_alarms = sum(s >= threshold for s in normal_scores)
    print(f"threshold {threshold}: caught {caught}/8 scams, "
          f"missed {8 - caught}, false alarms {false_alarms}/8")

For a family tool, a miss can cost money, but too many false alarms mean people stop listening. Talk with your family about which matters more, and write the balance you chose in your plan.

Test on messages the rules have not seen

If you write rules while looking at your examples, they will look better on those examples than on new messages. Keep some labelled messages aside and test on them only at the end. Scammers also change their wording, so review the rules from time to time.

Weak approach

Rules copied from one example message
Tested only on the messages used to write the rules
Says "SCAM!" with no reason
Uses family members' real private messages without asking

Better approach

Rules for general warning signs
Tested on held-back messages, with misses and false alarms counted
Shows which signs it found and what to do next
Uses made-up examples, or real ones only with permission and with personal details removed

Do this

Add a "what to do" line to every flagged message: do not click links, do not share OTPs or PINs, call the person or organisation back on a number you already trust, and, in India, report cyber fraud on the helpline 1930 or at cybercrime.gov.in.

Where a model could help later

Rules are easy to understand and test, which is why they are a good first version. Later you could add a language model to catch new wording, using a placeholder like call_model() to ask "which warning signs does this message show?". Keep the rules as a backup, show reasons, and measure the model on the same labelled set before trusting it.

Watch out

Your detector will miss some scams. Say this clearly to your family and in your README. Never tell anyone "this message is safe" just because the tool gave a low score. A low score only means "no known warning signs found".

Try this. Ask two family members which scam messages they have received recently. Write made-up versions of them (with no real names, numbers or links) and add them to your test set.

Watch and read more

National Cyber Crime Reporting PortalGovernment of India · reading

Lab

A rule-based scam scorer that catches at least 8 of 10 made-up scams with at most 1 false alarm on 10 normal messages.

~30 min

The problem

All messages are made up. The links use .example addresses, which cannot be real websites.

Run the starter. It has one rule and catches very few scams.
Add rules to RULES for general warning signs: urgency or threats, asking for a code, asking for money or a fee, prizes and big returns, links, secrecy or claimed officials. Each rule is (name, [keywords], weight). Keywords are matched in lower-case text.
Adjust THRESHOLD and the weights until you catch at least 8 of 10 scams with at most 1 false alarm.
Look at the normal messages that mention an OTP or a bill. Make sure your rules do not flag them. Write two sentences on which mistake you think is worse for your family, and why.

Practice lab

Edit the code and run it. Python runs in your browser — nothing is sent to our server.

Ctrl + Enter to run

# Made-up labelled messages: 1 = scam, 0 = normal
MESSAGES = [
    ("Dear customer, your bank KYC is pending. Your account will be blocked today. Update now at http://kyc-update.example", 1),
    ("Congratulations! You won Rs 25 lakh in the lucky draw. Pay a small processing fee to claim your prize.", 1),
    ("Hi Mum, I dropped my phone in water. This is my new number. Please send money urgently, I will explain later.", 1),
    ("Your electricity connection will be cut tonight because the last bill is not updated. Call this officer immediately.", 1),
    ("Work from home! Earn 5000 daily by liking videos. Pay a registration fee to start.", 1),
    ("This is a customs officer. A parcel in your name has illegal items. Stay on video call and do not tell anyone, or you will be arrested.", 1),
    ("Share the OTP you just received to cancel the wrong transaction. Hurry, the money will be debited.", 1),
    ("Your parcel is on hold due to an incomplete address. Click http://parcel-help.example to pay a redelivery charge.", 1),
    ("Guaranteed double returns in 30 days on our crypto plan. Limited seats, invest now.", 1),
    ("Scan this QR code to receive the payment for the old sofa you listed.", 1),
    ("Reminder: parent-teacher meeting on Saturday at 10 am in the school hall.", 0),
    ("Your order has been delivered. Thank you for shopping with us.", 0),
    ("Beta, did you reach the hostel? Call when free.", 0),
    ("Your OTP for login is 482913. Do not share it with anyone.", 0),
    ("The water supply will be off tomorrow from 10 am to 2 pm for repair work, says the society office.", 0),
    ("Happy Diwali to you and the family! See you at the puja.", 0),
    ("Your electricity bill for this month is ready. Pay through your usual app before the due date.", 0),
    ("Cricket practice is moved to 6 pm today because of rain.", 0),
    ("Payment received. Thank you for your purchase at the general store.", 0),
    ("Reminder: your bank will never ask for your PIN or OTP. Stay safe.", 0),
]

# (rule name, keywords to look for, weight)
RULES = [
    ("prize", ["won", "lucky draw"], 3),
]
THRESHOLD = 3

def score(text):
    t = text.lower()
    fired = [name for name, keys, w in RULES if any(k in t for k in keys)]
    total = sum(w for name, keys, w in RULES if name in fired)
    return total, fired

def is_scam(text):
    return score(text)[0] >= THRESHOLD

scams = [m for m, label in MESSAGES if label == 1]
normal = [m for m, label in MESSAGES if label == 0]
caught = sum(is_scam(m) for m in scams)
false_alarms = sum(is_scam(m) for m in normal)
print(f"Caught {caught}/{len(scams)} scams, false alarms {false_alarms}/{len(normal)}")
for m, label in MESSAGES:
    s, fired = score(m)
    if is_scam(m) != bool(label):
        kind = "MISSED" if label else "FALSE ALARM"
        print(f"{kind:12} score {s} {fired}  {m[:60]}")

Output

No output. Add print(...) to see values.

You are done when

At least 8 of 10 scams caught and at most 1 false alarm
Rules describe general warning signs, not whole copied messages
The normal OTP and bill messages are not flagged
You wrote which mistake matters more for your family, and why

Hard questions

Try to answer before you reveal. If you can answer these, you understood the lesson.

Q1A friend makes the lab pass by adding a rule whose keywords are the first words of each scam message. Why is this a bad detector, even though the check passes?Reveal

It has memorised these exact messages instead of learning warning signs. A new scam with different wording will get no score at all. This is overfitting. To see it, write five new scam messages and five normal ones that the rules have never seen, and measure again. General signs, like "asks for a fee" or "asks for an OTP", carry over to new messages much better.

Q2Your family tool catches every scam in testing but flags a third of normal messages. What will happen in real use, and what would you change?Reveal

People will soon learn to ignore the warnings, so even real scams get ignored. Make keywords more specific (for example "share the OTP" instead of just "OTP"), give weak signs a lower weight so one sign alone does not reach the threshold, and require two signs together for a flag. Then measure misses and false alarms again on held-back messages.

Please sign in to continue.

Questions people ask

Why not just use a big AI model for everything?

You can try, but rules are free, fast, run on a phone without the internet, and explain themselves. They are also easy to test. Many good tools combine both: rules for known patterns and a model for unusual cases, with both measured on the same labelled messages.

Where do I get labelled messages?

Write made-up ones based on patterns described by trusted sources such as banks, police and government awareness pages. If family members share real messages, ask first, and remove names, numbers and links before saving them.

What threshold is right?

There is no single right value. Count misses and false alarms at a few thresholds on your labelled messages, and choose with your users. Write the choice and the reason down.

Can scammers get around my rules?

Yes. They change words, spellings and languages. That is why the tool should say "be careful" rather than "safe", why you keep testing with new examples, and why teaching people the warning signs matters more than any tool.

Lesson test

5 questions. Get 3 right (60%) to pass and complete this lesson.

Build a scam detector for your family

Build a scam detector for your family

How a rule-and-score detector works

Rules

Score

Threshold

Explain

Misses and false alarms

Test on messages the rules have not seen

Where a model could help later

Watch and read more

The problem

Practice lab

You are done when

Hard questions

Questions people ask