ScamCheck

Problem Statement

Students often receive internship and job opportunities through messaging apps, email, and social media. Many offers look realistic at first glance but hide suspicious demands such as upfront payments, urgent deadlines, or requests for sensitive information. ScamCheck helps students check opportunity text and screenshots before they trust a message.

Solution

ScamCheck is a beginner-friendly web app that combines rule-based scam detection with a lightweight machine learning model. Users can paste an opportunity message or upload a screenshot, and the app returns a risk score, risk level, indicator explanations, recommended actions, and a history of prior analyses.

Features

• Paste internship or job opportunity text for analysis
• Upload a screenshot and extract text with OCR
• Rule-based scam detection for payment, urgency, salary, selection, contact, URL, and sensitive data requests
• Lightweight ML/NLP prediction using TF-IDF + Logistic Regression
• Transparent scoring with explanations and recommendations
• History dashboard for saved analyses
• SQLite database for local persistence
• Modern responsive UI

Architecture

ScamCheck follows a simple modular architecture:

• Frontend: React + Vite
• Backend: FastAPI + SQLAlchemy + SQLite
• OCR: Tesseract + pytesseract + Pillow
• ML: scikit-learn TF-IDF + Logistic Regression

Tech Stack

• React
• JavaScript
• FastAPI
• Python
• SQLite
• SQLAlchemy
• scikit-learn
• pandas
• numpy
• pytesseract
• Pillow

Folder Structure

scamcheck/
├── backend/
│   ├── main.py
│   ├── database.py
│   ├── models.py
│   ├── schemas.py
│   ├── routes/
│   │   ├── __init__.py
│   │   └── analysis.py
│   ├── services/
│   │   ├── __init__.py
│   │   ├── analyzer.py
│   │   ├── ocr_service.py
│   │   └── history_service.py
│   ├── ml/
│   │   ├── train_model.py
│   │   ├── model.py
│   │   ├── dataset.csv
│   │   ├── scam_model.pkl
│   │   └── vectorizer.pkl
│   ├── uploads/
│   ├── requirements.txt
│   └── .env
├── frontend/
│   ├── src/
│   │   ├── App.jsx
│   │   ├── main.jsx
│   │   ├── pages/
│   │   │   ├── Home.jsx
│   │   │   ├── Analyze.jsx
│   │   │   ├── ScreenshotAnalysis.jsx
│   │   │   ├── Results.jsx
│   │   │   └── History.jsx
│   │   ├── services/
│   │   │   └── api.js
│   │   └── styles.css
│   ├── index.html
│   ├── package.json
│   └── vite.config.js
├── .gitignore
├── README.md
└── demo_messages.py

Installation

1. Clone the project.
2. Create a Python virtual environment.
3. Install backend dependencies:

   cd scamcheck/backend
   pip install -r requirements.txt

4. Create your local environment file from the example:

   copy .env.example .env

   Then set your Google Places API key in .env:

   GOOGLE_PLACES_API_KEY=your_google_places_api_key_here

5. Install frontend dependencies:

   cd scamcheck/frontend
   npm install

6. Install Tesseract OCR:
   • Windows: install from https://github.com/UB-Mannheim/tesseract/wiki
   • Ubuntu/Debian: sudo apt-get install tesseract-ocr
   • macOS: brew install tesseract

Run Backend

cd scamcheck/backend
uvicorn main:app --reload --host 0.0.0.0 --port 8000

Run Frontend

cd scamcheck/frontend
npm run dev -- --host 0.0.0.0

Deploy

The frontend is configured for Vercel from the repository root. The root vercel.json builds frontend and serves the React SPA entrypoint, including client-side routes.

The FastAPI backend should be deployed separately because it uses SQLite, filesystem uploads, Tesseract OCR, and scikit-learn. Suitable Python hosting must provide those runtime dependencies and persistent storage if history and uploads need to survive restarts. The included Dockerfile and Procfile provide the backend startup configuration.

Vercel frontend

1. Import the repository into Vercel with the repository root as the project root. Do not set frontend as the root directory when using the root vercel.json.
2. Add this Vercel environment variable for Production:

   VITE_API_BASE_URL=https://your-backend.example.com/api

3. Deploy. The site will be available at the Vercel project domain.

For local development, keep frontend/.env based on frontend/.env.example, which points to http://localhost:8000/api.

Separate backend

Deploy the backend directory to a Python host that supports FastAPI and Tesseract. Start it with:

gunicorn -k uvicorn.workers.UvicornWorker main:app --bind 0.0.0.0:$PORT

Set these backend variables on that host:

APP_ENV=production
PORT=8000
DATABASE_URL=sqlite:///./scamcheck.db
CORS_ORIGINS=https://your-vercel-project.vercel.app
GOOGLE_PLACES_API_KEY=your_google_places_api_key
TESSERACT_CMD=tesseract

Set CORS_ORIGINS to the exact deployed Vercel origin, without a trailing slash. The frontend API URL must end in /api, for example https://your-backend.example.com/api. The text and screenshot endpoints are then available at /api/analyze and /api/analyze-image.

Train the ML Model

cd scamcheck/backend/ml
python train_model.py

API Endpoints

• POST /api/analyze
• POST /api/analyze-image
• GET /api/history
• GET /api/history/{id}
• GET /api/health

Example Input

We are hiring interns. You are selected without interview. Pay a registration fee of ₹299 today to confirm your placement. Guaranteed salary of ₹45,000 per month from home.

Example Output

{
  "risk_score": 85,
  "risk_level": "HIGH RISK",
  "indicators": [
    "payment request",
    "urgency",
    "instant selection",
    "unrealistic salary"
  ],
  "explanation": [
    "The opportunity asks for a registration fee.",
    "The message pushes immediate action and payment.",
    "The candidate is allegedly selected without interview."
  ],
  "recommendation": "Do not pay any fee and verify the company independently before proceeding."
}

Limitations

• The rule-based checks rely on text patterns and are best used as a warning system rather than a definitive verdict.
• The ML model is a lightweight demonstration model and should be retrained with larger real-world datasets.
• OCR quality depends on screenshot clarity and lighting.

Future Improvements

• Add a better fraud dataset and model tuning
• Add user login for personal history
• Add email and WhatsApp parsing utilities
• Include company verification API integration
• Add multi-language support for scam detection

Important Note

This project is designed for educational and demo purposes. It should be used as a decision-support tool, not as a legal or definitive scam detector.