AntiEstafa AR

Hackathon project · The app is in Rioplatense Spanish, built for people in Argentina.

---

The problem

Scams over WhatsApp and SMS are everywhere in Argentina: the fake tax agency (ARCA/AFIP) threatening to freeze your accounts, the "Mercado Pago" message saying your account was blocked, the parcel held by Correo Argentino, the classic "hi mom, I changed my number", fake Marketplace sellers, "bank support" asking for your PIN and crypto schemes that promise to double your money.

The messages keep getting more convincing — many are now written with AI — and the people most exposed are the ones with the fewest tools to spot them: older adults.

The solution

AntiEstafa AR protects people before, during and after a scam.

Moment	What it does
Before paying	Checks the alias / CBU / CVU you were asked to transfer to and detects fake transfer receipts.
While analyzing	Combines AI with real technical checks on every link and highlights the fake part.
Afterwards	Drafts the police report, alerts your family on WhatsApp and reads the result out loud.

Features

Analysis

• Text, screenshot, voice note, link or QR code. Screenshots are read with vision AI; voice notes are transcribed (with a local Whisper model, so it works even without a paid AI key).
• AI tuned for Argentine scams — detects manipulation signals such as false urgency, impersonation of agencies and banks, and requests for money or credentials.
• Real link checks — domain age (RDAP), SSL certificate, redirect chain and brand impersonation (Levenshtein distance against known brands).
• 0–100 risk score with a traffic light — 🟢 safe · 🟡 suspicious · 🔴 scam — and the deceptive part of the domain highlighted (mercadopag0 vs mercadopago).
• "This is what the real one looks like" — shows how the impersonated company actually communicates.
• Built-in fallback engine — if there is no AI key or the free quota runs out, a rule-based engine for Argentine scams plus link checks keeps it working.

Before transferring money

• Alias / CBU / CVU check — validates format and check digits, and flags suspicious requests. It never claims an account is safe; it always recommends verifying through another channel.
• Fake receipt detector — upload the "transfer receipt" someone sent you and see what doesn't add up.

If you already fell for it

• Step-by-step recovery guide depending on what happened (sent money, shared a PIN, card or ID details, installed an app, extortion), most urgent steps first.
• Police report generator — a formal text with the message, links, signals, verdict and date; copy, download or print to PDF.
• One-tap 911 call with the report ready and a script of what to say.
• Share an alert with your family directly on WhatsApp.

Learn and stay up to date

• Current scams circulating in Argentina, with sources.
• Practice quiz: scam or real?
• Pandi, a friendly panda assistant that answers questions in plain language — never asks for personal data and never makes up phone numbers.

Accessibility

• "Grandma mode" — the result in two lines, large text, one action.
• Read aloud in Argentine Spanish voice.
• Installable app (PWA) with install instructions for every browser, an in-app user manual and a mobile-first design. No sign-up.

For businesses (offered through tecnoros.ar)

• White label — each client with its own name, logo and contact, configured via environment variables.
• API for WhatsApp bots (/api/v1/analizar) with per-client keys, monthly AI quotas and replies formatted for WhatsApp.
• Usage metering per client and per month for billing.
• Embeddable button for any website with one line (widget.js).
• Integration guide: docs/INTEGRACION_TECNOROS.md.

Privacy & security

• Messages are not stored. "My analyses" history (last 10) lives only on the user's device and can be turned off and cleared.
• SSRF protection on link checks (private IPs and localhost blocked, timeouts).
• Per-IP rate limiting, 4 MB image limit and retries when the AI provider is overloaded.

Performance

• Link and AI checks run in parallel, max 3 links per message, 1-hour cache per domain and 4 s timeouts.
• Visible step-by-step progress. Measured: link checks went from ~0.8 s to ~0.3 s with caching, and slow redirects no longer block the analysis (previously up to 5 s).

How it works

text / image / audio ──► /api/analyze ──┬─► links ─► RDAP · SSL · redirects · brands   (parallel, cached)
                                        └─► Gemini (JSON with responseSchema)
                                                 │
                                    combined score + verdict ─► UI

link                     ──► /api/link           ──► RDAP · SSL · redirects · brands
alias/CBU + message      ──► /api/transferencia  ──► format validation + Gemini
receipt screenshot       ──► /api/comprobante    ──► Gemini vision
question to Pandi        ──► /api/asistente      ──► Gemini (short answers, fixed rules)

File	Responsibility
src/lib/links.ts	Link extraction and checks, brand Levenshtein, anti-SSRF, timeouts
src/lib/gemini.ts	Prompt with Argentine scam context, validated JSON output, model fallback and retries
src/lib/score.ts	Combines technical signals with the AI verdict
src/lib/transferencia.ts	Alias, CBU and CVU validation (check digits)
src/lib/comprobante.ts	Transfer receipt analysis
src/lib/denuncia.ts	Police report text
src/lib/pwa.ts	Manifest and browser detection for installation
src/components/	UI: analyzer, traffic light, grandma mode and each feature

Stack: Next.js (App Router) · TypeScript · Tailwind CSS · @google/genai (Gemini with vision and audio) · Whisper tiny + sherpa-onnx (offline speech recognition) · RDAP · Vercel.

Quality: 100+ automated tests (Gemini and network mocked, so they don't consume quota), lint and build on every change.

Run locally

npm install
cp .env.example .env.local   # add GEMINI_API_KEY (without it, the built-in engine is used)
npm run dev                  # http://localhost:3000
npm test

On Windows (PowerShell) use Copy-Item .env.example .env.local instead of cp.

1. Fake ARCA tax debt → 🔴 scam

ARCA INFORMA: Registrás una deuda de $187.430 en Ganancias. Para evitar el embargo de tus cuentas regularizá HOY en https://arca-regularizacion.com/pago antes de las 24 hs.

2. Fake Mercado Pago → 🔴 scam — mercadopag0 (with a zero) is highlighted

Mercado Pago: tu cuenta fue BLOQUEADA por actividad inusual. Validá tu identidad en http://mercadopag0-seguridad.xyz/validar o perdés tu saldo.

3. "Hi mom, I changed my number" → 🔴 scam — detected through social engineering, no links

Hola ma, cambié de número, agendá este. Estoy en un apuro, ¿me podés transferir $85.000 al alias pago.rapido.mp? Después te explico, no me llames que no puedo hablar.

4. Fake Correo Argentino → 🔴 scam — correoargentlno uses an "l" instead of an "i"

Correo Argentino: tu paquete está retenido por falta de pago de $1.250 de aduana. Abonalo en https://correoargentlno-envios.com/pago para recibirlo mañana.

5. Legitimate message → 🟢 safe

Hola! Te confirmo el turno con la Dra. Gómez el martes 28 a las 10:30 en el consultorio de siempre. Si no podés venir, avisanos por este medio. Gracias!

The demo video is recorded automatically with Playwright, walking through every feature:

npx playwright install chromium   # first time only
npm run dev                       # in another terminal
npm run demo:video                # creates public/demo/demo.mp4, portada.jpg and demo.vtt

It uses fixed sample responses so the video is always the same. Options: --url=https://antiestafa-ar-2.vercel.app to record the deployed version and --real to use the real AI. Requires ffmpeg.

Documentation

Documentation is written in Spanish.

• 📘 User manual (PDF)
• 📗 Functional specification (PDF)
• 🏢 Business integration with tecnoros.ar

Team

Member	GitHub	Contribution
Manuel Angiulli	@Ridioortv	Core app: AI and vision analysis, link checks, scoring, rate limiting and Vercel deployment; tabbed redesign, link check, recovery guide and analysis history.
María Sofía Genta	@sofiigentaa	Alias/CBU check, fake receipt detector, police report, WhatsApp sharing, voice, examples, highlighted domain, "the real one", follow-up questions, history, installable app and performance work.

Built during a hackathon with the help of AI coding agents (Claude Code) working in parallel on the same repository.