The problem
The old advice was to look for bad spelling and odd formatting. That advice is dead. Modern scams copy the exact tone, logo and phrasing of organisations you already deal with, and they arrive on the same channels those organisations use.
The people most often targeted — parents, grandparents, students taking a first internship offer — do not need another verdict to trust. They need to understand what they are looking at, so they recognise the next one without help.
Why rules and AI, not AI alone
An AI asked “is this a scam?” will answer confidently either way, and you have no way to check it. So ScamShield runs a deterministic engine first: explicit rules for the mechanics scams depend on, and structural analysis of any link. That engine produces a complete report on its own.
The AI layer adds what pattern matching cannot judge — the pressure being applied and what the sender is actually trying to achieve. If it is unavailable, ScamShield says so on the report and falls back to the rules rather than failing. That is an architectural property, and it is covered by the test suite.
The architecture
User input
A message, link or screenshot. Validated and size-limited server-side before anything runs.
Deterministic security engine
Pattern rules and URL structure analysis. No AI involved. Runs on every single request.
AI analysis
Gemini reads intent and pressure. Submitted content is fenced as untrusted data and never obeyed as instructions.
Risk engine
Both scores are deduplicated by signal group, weighted, and combined into one auditable number.
Structured threat report
Score, evidence, attack path and contextual actions — every claim traceable to a detected signal.
Privacy and safety
Submitted messages are never written to application logs — errors record a reason code only. Nothing is stored unless you explicitly save a report, and saved reports live in your own browser, not on a server.
Links are parsed as text. ScamShield never opens, resolves, crawls or expands a submitted URL, including shortened ones, which are reported as unexpanded rather than followed. The AI key is read only in server-side code and is never sent to the browser.
What it will not claim
ScamShield reports risk, not certainty. It never states that a domain or sender is definitively malicious, and it fabricates nothing — no reputation scores, no malware scans, no domain ownership records. It has access to none of those.
A low score means no known patterns matched the text you provided. It is not confirmation that a sender is genuine. Where a capability is missing, ScamShield says so rather than faking it.