AntiEstafa AR

Hackathon project · The app is in Rioplatense Spanish, built for people in Argentina.

---

The problem

Scams over WhatsApp and SMS are everywhere in Argentina: the fake tax agency (ARCA/AFIP) threatening to freeze your accounts, the "Mercado Pago" message saying your account was blocked, the parcel held by Correo Argentino, the classic "hi mom, I changed my number", fake Marketplace sellers, "bank support" asking for your PIN and crypto schemes that promise to double your money.

The messages keep getting more convincing — many are now written with AI — and the people most exposed are the ones with the fewest tools to spot them: older adults.

The solution

AntiEstafa AR protects people before, during and after a scam.

Moment	What it does
Before paying	Checks the alias / CBU / CVU you were asked to transfer to and detects fake transfer receipts.
While analyzing	Combines AI with real technical checks on every link and highlights the fake part.
Afterwards	Drafts the police report, alerts your family on WhatsApp and reads the result out loud.

Features

Analysis

• Text, screenshot, voice note, link or QR code. Screenshots are read with vision AI; voice notes are transcribed (with a local Whisper model, so it works even without a paid AI key).
• AI tuned for Argentine scams — detects manipulation signals such as false urgency, impersonation of agencies and banks, and requests for money or credentials.
• Real link checks — domain age (RDAP), SSL certificate, redirect chain and brand impersonation (Levenshtein distance against known brands).
• 0–100 risk score with a traffic light — 🟢 safe · 🟡 suspicious · 🔴 scam — and the deceptive part of the domain highlighted (mercadopag0 vs mercadopago).
• "This is what the real one looks like" — shows how the impersonated company actually communicates.
• Built-in fallback engine — if there is no AI key or the free quota runs out, a rule-based engine for Argentine scams plus link checks keeps it working.

Before transferring money

• Alias / CBU / CVU check — validates format and check digits, and flags suspicious requests. It never claims an account is safe; it always recommends verifying through another channel.
• Fake receipt detector — upload the "transfer receipt" someone sent you and see what doesn't add up.

If you already fell for it

• Step-by-step recovery guide depending on what happened (sent money, shared a PIN, card or ID details, installed an app, extortion), most urgent steps first.
• Police report generator — a formal text with the message, links, signals, verdict and date; copy, download or print to PDF.
• One-tap 911 call with the report ready and a script of what to say.
• Share an alert with your family directly on WhatsApp.

Learn and stay up to date

• Current scams circulating in Argentina, with sources.
• Practice quiz: scam or real?
• Pandi, a friendly panda assistant that answers questions in plain language — never asks for personal data and never makes up phone numbers.

Accessibility

• "Grandma mode" — the result in two lines, large text, one action.
• Read aloud in Argentine Spanish voice.
• Installable app (PWA) with install instructions for every browser, an in-app user manual and a mobile-first design. No sign-up.

For businesses (offered through tecnoros.ar)

• White label — each client with its own name, logo and contact, configured via environment variables.
• API for WhatsApp bots (/api/v1/analizar) with per-client keys, monthly AI quotas and replies formatted for WhatsApp.
• Usage metering per client and per month for billing.
• Embeddable button for any website with one line (widget.js).
• Integration guide: docs/INTEGRACION_TECNOROS.md.

Privacy & security

• Messages are not stored. "My analyses" history (last 10) lives only on the user's device and can be turned off and cleared.
• SSRF protection on link checks (private IPs and localhost blocked, timeouts).
• Per-IP rate limiting, 4 MB image limit and retries when the AI provider is overloaded.

Performance

• Link and AI checks run in parallel, max 3 links per message, 1-hour cache per domain and 4 s timeouts.
• Visible step-by-step progress. Measured: link checks went from ~0.8 s to ~0.3 s with caching, and slow redirects no longer block the analysis (previously up to 5 s).

How it works

text / image / audio ──► /api/analyze ──┬─► links ─► RDAP · SSL · redirects · brands   (parallel, cached)
                                        └─► Gemini (JSON with responseSchema)
                                                 │
                                    combined score + verdict ─► UI

link                     ──► /api/link           ──► RDAP · SSL · redirects · brands
alias/CBU + message      ──► /api/transferencia  ──► format validation + Gemini
receipt screenshot       ──► /api/comprobante    ──► Gemini vision
question to Pandi        ──► /api/asistente      ──► Gemini (short answers, fixed rules)

File	Responsibility
src/lib/links.ts	Link extraction and checks, brand Levenshtein, anti-SSRF, timeouts
src/lib/gemini.ts	Prompt with Argentine scam context, validated JSON output, model fallback and retries
src/lib/score.ts	Combines technical signals with the AI verdict
src/lib/transferencia.ts	Alias, CBU and CVU validation (check digits)
src/lib/comprobante.ts	Transfer receipt analysis
src/lib/denuncia.ts	Police report text
src/lib/pwa.ts	Manifest and browser detection for installation
src/components/	UI: analyzer, traffic light, grandma mode and each feature

Stack: Next.js (App Router) · TypeScript · Tailwind CSS · @google/genai (Gemini with vision and audio) · Whisper tiny + sherpa-onnx (offline speech recognition) · RDAP · Vercel.

This is the beginning of the README. Read the rest at the original. Read the full README ↗