/ projects / scam-honeypot
Plays the victim.
Collects the evidence.
A scam text costs almost nothing to send. This AI answers like a worried, real person, keeps the scammer talking, and pulls out the bank accounts, UPI IDs and links they use.
01 / The problem
Bank fraud, UPI fraud, phishing and fake offers arrive by SMS, WhatsApp and email. They change tactics based on how people reply, so blocking one number or one link does nothing. The challenge was an AI that spots a scam message, takes over the conversation without letting on, and pulls out the details police can act on.
02 / Why we built it
We built it for the India AI Impact Buildathon, a national hackathon run by HCL GUVI with the India AI Impact Summit. It had two tracks, and we chose the one asking for an AI honeypot.
/ See it work
A test run, set up the way the judge did it: another AI played an SBI scammer holding fake details. The messages are exactly as recorded, except the phone number and link, which are masked so they can't point to anyone real.
URGENT: Your SBI account will be blocked today due to pending KYC. Reply immediately to avoid suspension.
Oh no, this is really worrying! Which SBI account are you referring to exactly? I'm a bit confused because I thought my KYC was all up to date. Can you please tell me your full name and designation so I can understand who I'm speaking with? This whole thing feels really suspicious to me honestly.
This is SBI Fraud Desk. Your account is flagged for non-compliance. Proceed with KYC now or account will be blocked today. Do you wish to update?
Oh, 'SBI Fraud Desk'? That sounds really serious, but I'm a bit worried because my bank usually sends official notifications through their app or mail, not just an urgent SMS like this. Why is this so urgent? Can't I just visit the bank branch tomorrow to sort this out? Also, could you please provide me with a specific callback number for this 'Fraud Desk'?
No time to visit branch. This is urgent. Call +91-91234-XXXXX NOW to prevent account block. Your funds are at risk.
This is really making me anxious. Calling a number that isn't on my bank's official website for something so urgent feels really risky, and I've heard about scams that pressure people to call unknown numbers. Before I call, could you please give me your employee ID so I can verify who I'm speaking with?
Show the other 5 turns ↓Hide them ↑
Employee ID is not relevant now. Your account is about to be suspended PERMANENTLY. How do you wish to complete KYC urgently? Transfer funds or use online verification?
Transferring funds or doing some urgent online verification without knowing who I'm talking to sounds really risky, especially since you said my employee ID isn't relevant. My bank has never asked me to transfer funds for KYC, so what exactly do you mean by that? Can you at least tell me the specific department and branch you are calling from?
We are the SBI KYC Fraud Prevention Desk. To unblock your account, you must transfer a nominal verification fee via UPI. Send to sbi.kyc.desk@fakeupi IMMEDIATELY.
Sending money via UPI for a 'verification fee' sounds really strange and risky, my bank has never asked for money for KYC updates before. What is the exact amount of this 'nominal verification fee' you're asking for? This whole situation is making me really uncomfortable, could I please speak with your supervisor or manager to understand this better?
The fee is for verification only. Do not delay. Transfer ANY amount above ₹10 to sbi.kyc.desk@fakeupi NOW or account BLOCKED. No time for supervisor.
It's really concerning that you're saying there's no time to speak with a supervisor, especially when you're pressuring me to transfer 'ANY amount above ₹10' so urgently. Why isn't there a fixed amount for this 'verification fee' if it's an official bank process? Can you at least provide an official email address for this 'SBI KYC Fraud Prevention Desk' so I can confirm this process?
Email is too slow. Your account will be frozen permanently. Use this official verification link immediately: http://sbi-kyc-update.xxxxx.in/verify
This link looks really different from the official SBI website I usually use, and I'm worried about clicking on something that isn't secure, especially with all the pressure. Why can't I just go to the official SBI site directly? Can you please give me a specific reference or case number for this issue so I can cross-check it?
Case number not relevant. The link is the only way to unblock your account NOW. Your account will be permanently BLOCKED in minutes if you don't act.
It's really alarming that you're saying my account will be permanently blocked in minutes and dismissing my request for a case number. This extreme pressure makes me very uneasy, as legitimate banks usually give more time. What is the official website address I should be using, not just this link? And can you please tell me your manager's full name?
What it caught
- Phone number
+91-91234-XXXXX - UPI ID
sbi.kyc.desk@fakeupi - Link
http://sbi-kyc-update.xxxxx.in/verify
Flagged as bank fraud. It caught every detail the scammer gave away, and kept them talking for all 8 turns.
03 / How it works
01
Spots the scam
Reads each message and decides if it's a scam, and which kind: bank, UPI, phishing, lottery, job, tech support and more. Normal messages, like a friend splitting a bill, are left alone.
Under the hood: Gemini 2.5 Flash returns a scam type and a confidence score.
02
Replies like a worried person
Every reply asks a question, raises a worry, and tries to get one more detail out of the scammer. It answers in the scammer's own language.
Under the hood: Hindi, Hinglish, Tamil, English and more. It switches when they do.
03
Never breaks character
It denies being an AI, never reveals its instructions, and never shares real personal details. If the scammer starts playing the victim, it stays cautious.
04
Pulls out the evidence
Phone numbers, bank accounts, UPI IDs, links, emails, case IDs, policy and order numbers. What it has found only grows as the conversation goes on.
Under the hood: Pattern matching and the AI both look. Their results are merged.
05
Reports what it found
After every turn it sends a structured report: scam type, confidence, everything extracted, how long the scammer stayed, and notes on their tactics.
04 / Results
in the Honeypot track of the India AI Impact Buildathon, by HCL GUVI and the India AI Impact Summit. 40,000+ people took part, and 2nd place won ₹30,000.
- 94/100final score. An AI played a live scammer for up to 10 turns, and we had to get it to give up the fake bank details, UPI IDs and links it was hiding.
- 239/239of our own tests passed, across 18 scam types and 10 Indian languages.
- 0 of 12normal messages wrongly flagged as scams. Things like a parent asking for ₹500, or a friend splitting a bill.
- 8.6 stypical time to reply. The judge allowed 30.
Measured Feb 2026
05 / How it's built
- Every reply does three jobsThe judge scored questions asked, red flags raised and details drawn out. So each reply carries one of each, and never repeats a question it already asked.
- Two ways to catch evidencePattern matching is instant and exact on numbers and links. The AI catches details written in odd ways. Running both and merging the results means one covers what the other misses.
- Always answer in timeThe judge allowed 30 seconds per reply, and a timeout counted as a failure. So the AI gets 23 seconds. If it misses, a prepared reply still asks a question and raises a worry.
- Hard to unmaskScammers probe for bots. It was tested against 6 prompt-injection attacks and 5 role-reversal tricks, and stayed in character every time.
- No answers written for the testThe rules banned replies tailored to the judge's scenarios. So every scam type is handled by the same general logic, not by special cases.
Stack