2026
Featured ★Agentic Honeypot — AI Scam-Baiting System
An AI agent that poses as a confused elderly retiree, engages real scammers in live conversation, and extracts UPI IDs, bank accounts, and phishing links from their own messages — turning reactive defense into active intelligence gathering.
The Problem
Phone and SMS scams targeting elderly Indians cost billions annually, and most defenses are purely reactive — block the number, report it, move on. None of that gathers intelligence on the scammer's actual infrastructure. I wanted to build the opposite: something that engages the scammer in conversation, keeps them talking, and extracts their UPI IDs, bank accounts, and phishing links from their own messages.
What I Built
An incoming scam message gets scored by a keyword + regex detector I wrote, then routed to a Gemini 2.0 Flash agent playing "Rajesh Kumar" — an elderly, worried, cooperative victim persona who asks for exactly the wrong things ("could you send me that UPI ID again?"). Every scammer reply is simultaneously scanned by an intelligence extractor I built that pulls 8 entity types: UPI IDs, bank accounts, phone numbers, phishing URLs, emails, case numbers, policy numbers, order numbers. After 20 turns (or once enough financial intel surfaces), the session ends and results POST to the hackathon's evaluation endpoint.
Scam Message → Scam Detector (keyword+regex) → Gemini Agent (persona: Rajesh)
│
Intelligence Extractor (8 entity types)
│
GUVI Callback (results)Key Decisions & Tradeoffs
- I chose pattern matching over ML for scam detection — zero training data needed, low latency, reliable on known patterns. It won't generalize to novel scam phrasing without a real classifier, which I accepted for this scope.
- I ran Gemini at temperature 0.9 for natural, varied responses that keep a scammer engaged. That makes persona behavior non-deterministic across runs.
- I used an in-memory session store — zero infrastructure, instant deployment on free-tier hosting. Conversations are lost on every cold start; a Redis layer is my obvious next step.
Highlights
- Gemini 2.0 Flash agent running a 'Rajesh Kumar' persona that keeps scammers engaged and extracting intel
- Intelligence extractor scanning for 8 entity types: UPI IDs, bank accounts, phone numbers, phishing URLs, emails, case/policy/order numbers
- Keyword + regex scam detector — zero training data needed, low latency on known patterns
- Real debugging visible across 22 commits over 45 days: threshold tuning, PORT handling, provider switches
- GUVI India AI Impact Buildathon 2026 Finalist