You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This is a public MVP hosted on GitHub Pages. It is being built toward a validated, institution-ready scam safety platform for international students, families, counselors, education centers, and institutions. It detects **risk indicators** and provides safer verification steps; it does not claim certainty or replace legal, immigration, financial, emergency, or law-enforcement help.
7
+
This is a public MVP hosted on GitHub Pages. It is being built toward a validated, institution-ready scam safety platform for international students, families, counselors, education centers, and institutions. It detects **risk indicators** and provides safer verification steps; it does not claim certainty or replace legal, immigration, financial, emergency, or law-enforcement help.**This is being validated; it is not certified fraud detection.**
8
8
9
9
## Positioning
10
10
@@ -18,24 +18,25 @@ International students and families make high-stakes decisions across unfamiliar
18
18
19
19
- Local-first scam checker with score, level, top reasons, safe next steps, and copyable verification scripts.
├── src/lib/privacy/ # Redaction and anonymized report payloads
@@ -50,7 +51,7 @@ Routing remains hash-based and the Vite base path remains `/cross-border-scam-an
50
51
51
52
The analyzer uses transparent rules and combination boosts rather than fake AI claims. Rules cover urgency, account lock threats, identity verification, click/action pressure, credential/OTP risk, financial account/card risk, authority impersonation, sensitive-data requests, payment pressure, suspicious links/domains, unofficial payment methods, vague institutions, unrealistic guarantees, visa threats, housing scarcity, test-score upgrade claims, personal-account payments, cross-border bureaucracy confusion, language mismatch, and platform risk.
52
53
53
-
The benchmark tests assert that:
54
+
The owner-only `#eval` route summarizes total examples, examples by category and expected risk level, low/high mismatch counts, average score by category, weakest categories, failed tactics, and failed examples. The benchmark tests assert that:
54
55
55
56
- High-risk examples are not scored low.
56
57
- Low-risk legitimate messages are not high/critical.
Each pack includes who it helps, common scams, official verification steps, normal vs. suspicious requests, a safe script, related case tags, and official resource IDs.
74
+
Each pack includes who it helps, common scams, official verification steps, normal vs. suspicious requests, a safe script, related case tags, official resource IDs, last reviewed date, confidence level, source notes, required institution review flag, and student/parent/counselor scripts.
74
75
75
76
## Feedback loop
76
77
@@ -95,9 +96,23 @@ A 30-day pilot should:
95
96
96
97
Dashboard source modes make clear when data is sample, local browser data, or Firebase-backed.
97
98
99
+
## Product credibility and validation assets
100
+
101
+
- Evaluation dashboard: open `#eval` locally or on the GitHub Pages build to inspect benchmark behavior without uploading data.
102
+
- Evaluation results doc: [`docs/EVALUATION_RESULTS.md`](docs/EVALUATION_RESULTS.md) explains what the benchmark checks and what it does not prove.
103
+
- Resource review guide: [`docs/RESOURCE_REVIEW_GUIDE.md`](docs/RESOURCE_REVIEW_GUIDE.md) helps institutions replace starter guidance with approved official links.
104
+
- Institution setup guide: [`docs/INSTITUTION_SETUP_GUIDE.md`](docs/INSTITUTION_SETUP_GUIDE.md) lists required contacts, owners, and privacy guardrails before a pilot.
105
+
- Student safety guide: [`docs/STUDENT_SAFETY_GUIDE.md`](docs/STUDENT_SAFETY_GUIDE.md) gives calm verification steps for students and families.
106
+
107
+
Clear validation statement: **This is being validated; it is not certified fraud detection.**
The benchmark is a local, synthetic/labeled regression set for the rule-based scam analyzer. It is designed to check whether expected risk indicators continue to be detected for international-student safety scenarios and common phishing patterns.
6
+
7
+
The benchmark runs in Vitest and can also be reviewed in the browser at `#eval`. It uses `src/evaluation/examples.ts` and `analyzeMessage()` only; it does not upload examples or student data.
8
+
9
+
## Number of examples
10
+
11
+
Current benchmark size: **100 labeled examples**.
12
+
13
+
## Categories covered
14
+
15
+
The set includes examples across:
16
+
17
+
- General phishing and account-lock scams
18
+
- Bank card phishing
19
+
- OTP/code stealing
20
+
- Fake refunds
21
+
- Tuition account-change scams
22
+
- Visa, embassy, IRCC, SEVIS, CAS, and document-courier scams
23
+
- Scholarship finalist/processing-fee scams
24
+
- Fake housing lease and deposit pressure
25
+
- Telegram/WhatsApp education-agent scams
26
+
- Testing registration and test-score manipulation scams
27
+
- Legitimate low-risk institution reminders
28
+
- Borderline unclear messages
29
+
- Adversarial/euphemistic examples that avoid obvious scam wording
30
+
31
+
## What tests assert
32
+
33
+
The test suite checks that:
34
+
35
+
- The benchmark contains at least 100 examples.
36
+
- Example IDs are unique.
37
+
- High/critical expected examples do not score `low`.
38
+
- Low expected examples do not score `high` or `critical`.
39
+
- Each example score is within the expected minimum and optional maximum range.
40
+
- Expected tactic labels are detected when a labeled example requires them.
41
+
42
+
## Current limitations
43
+
44
+
- The examples are synthetic regression cases, not a representative field dataset.
45
+
- The tests assert rule behavior, not real-world detection accuracy.
46
+
- Passing tests does not measure precision, recall, false-positive rate, false-negative rate, demographic fairness, language coverage, or robustness to new scam campaigns.
47
+
- Some legitimate messages can contain payment, deadline, or portal language and still require human verification.
48
+
- Institution-specific payment links, contact channels, and escalation procedures must be validated separately.
49
+
50
+
## How to add new examples
51
+
52
+
1. Add a labeled row to the appropriate group in `src/evaluation/examples.ts`.
53
+
2. Include a stable ID prefix by placing the row in an existing mapped group or creating a new group.
54
+
3. Set `context`, `platform`, `expectedLevel`, score bounds, expected tactics, category, and notes.
55
+
4. Run `npm test`.
56
+
5. If the analyzer behavior changes intentionally, update the example notes and score bounds in the same pull request.
57
+
58
+
## Why this is not a guarantee of real-world accuracy
59
+
60
+
Scammers change wording, channels, payment methods, and impersonated authorities. This benchmark only confirms that the current analyzer handles the labeled examples in this repository. It should be treated as an engineering regression tool and pilot-readiness aid, not certified fraud detection or a guarantee that a real message is safe or unsafe.
This guide helps an institution prepare the MVP for a small validation pilot without collecting raw sensitive messages by default.
4
+
5
+
## What the institution must provide
6
+
7
+
- A named escalation owner for student-safety and scam reports
8
+
- A named privacy owner for data minimization, retention, and access review
9
+
- Approved official links and contacts for each student process
10
+
- A pilot success metric and review cadence
11
+
- A decision on whether Firebase is disabled, enabled for structured feedback only, or replaced with an institution-approved backend
12
+
13
+
## Official payment links
14
+
15
+
Provide the official tuition, deposit, refund, and payment-plan pages. Include rules for wire transfers, accepted payment methods, and how students can verify a changed payment instruction.
16
+
17
+
## Admissions contacts
18
+
19
+
Provide official admissions email addresses, phone numbers, applicant portal links, agent-verification pages, and after-hours instructions if available.
20
+
21
+
## Visa/immigration contacts
22
+
23
+
Provide the international office, DSO/immigration adviser, embassy/VAC guidance pages when appropriate, and approved scripts for checking visa threats, appointment changes, I-20/CAS/COE issues, or SEVIS-style payments.
24
+
25
+
## Housing contacts
26
+
27
+
Provide campus housing contacts, off-campus housing guidance, lease-review options, deposit guidance, and emergency housing escalation paths.
28
+
29
+
## Testing/advising contacts
30
+
31
+
Provide official testing-provider pages, campus testing/advising contacts, and rules for score reports, registration receipts, and fee questions.
32
+
33
+
## Escalation owner
34
+
35
+
Name the person or team who receives urgent cases, coordinates with student support/public safety/legal/IT, and decides when to involve banks, platforms, law enforcement, or government reporting channels.
36
+
37
+
## Privacy owner
38
+
39
+
Name the person or team who approves data fields, retention, access, deletion procedures, and whether structured feedback can be stored beyond local browser storage.
40
+
41
+
## Pilot success metric
42
+
43
+
Choose one or two measurable, modest goals, for example:
44
+
45
+
- Counselors can triage suspected scam messages faster using structured risk indicators.
46
+
- Students can identify official verification steps before paying or sending documents.
47
+
- Staff can identify top resource gaps without collecting raw messages.
48
+
49
+
Do not use the MVP to claim certified detection accuracy.
50
+
51
+
## How to avoid collecting raw sensitive data
52
+
53
+
- Keep the checker local-first and do not submit pasted messages by default.
54
+
- Use structured feedback fields such as risk level, context, platform, calibration, and tactic IDs.
55
+
- If reports are shared, store redacted payloads only and review redaction quality.
56
+
- Avoid screenshots, passport numbers, card numbers, OTPs, addresses, or full message bodies in pilot analytics.
57
+
- Publish deletion and access-review procedures before inviting students.
Resource packs are starter materials. Before a pilot, an institution should review and replace all links, contacts, and scripts with approved local information.
4
+
5
+
## Review owner
6
+
7
+
Assign one owner from international student services, admissions, student accounts, housing, or information security. Record who approved each resource pack and when it should be reviewed again.
8
+
9
+
## Review steps
10
+
11
+
1.**Replace placeholder official resources.** Update each pack's official resource IDs or linked materials with the institution's published payment pages, admissions pages, housing contacts, visa/immigration contacts, and testing/advising contacts.
12
+
2.**Validate links manually.** Type official domains directly, confirm HTTPS, and avoid copying links from unverified messages.
13
+
3.**Confirm payment instructions.** Student accounts or finance should approve every statement about tuition, deposits, refunds, wire details, and accepted payment methods.
14
+
4.**Confirm visa/immigration wording.** Designated school officials, international advisers, or immigration compliance staff should approve visa-related scripts.
15
+
5.**Confirm escalation scripts.** Counselors should know exactly where to send urgent threats, suspected fraud, or already-paid cases.
16
+
6.**Localize language.** Translate scripts only after the English source is approved, and back-review translations with bilingual staff.
17
+
7.**Set review dates.** Resource packs should have a last reviewed date and a next review date before launch.
18
+
19
+
## Replacement checklist
20
+
21
+
- Official payment portal URL
22
+
- Official student accounts contact
23
+
- Official admissions contact
24
+
- Official international office or visa advising contact
25
+
- Official housing office contact
26
+
- Official testing/advising contact
27
+
- After-hours safety or urgent support contact
28
+
- Privacy contact for pilot-data questions
29
+
30
+
## Pilot rule
31
+
32
+
Do not send a resource pack to students until required institution review is complete. If a pack is not reviewed, label it as draft guidance and route students to a counselor rather than specific links.
This guide is for international students and families. It is not meant to scare you. It gives calm steps to verify messages before you click, pay, or send documents.
4
+
5
+
## Before clicking
6
+
7
+
- Pause and read the message again.
8
+
- Do not use links from urgent texts, DMs, or emails if the message asks for login, payment, identity, or account recovery.
9
+
- Open the official university, bank, embassy, testing-provider, or housing website by typing the address yourself or using a saved bookmark.
10
+
- If the message says an account is locked, check from the official app or website, not from the message link.
11
+
12
+
## Before paying
13
+
14
+
- Confirm the fee inside an official portal or with a published office contact.
15
+
- Be careful with wire transfers, crypto, gift cards, mobile money, personal accounts, or urgent “new account” instructions.
16
+
- Ask whether the payment method is normal for your school or government process.
17
+
- If someone pressures you to pay within hours, slow down and verify.
18
+
19
+
## Before sending documents
20
+
21
+
- Do not send passport scans, visa documents, bank statements, selfies with ID, student portal passwords, OTPs, or card details through chat unless an official process clearly requires it.
22
+
- Ask the school or agency which secure upload portal should be used.
23
+
- Remove unnecessary personal information before sharing documents when possible.
24
+
25
+
## If threatened
26
+
27
+
- Save the message, phone number, email, or username.
28
+
- Do not argue with the sender or send money to stop a threat.
29
+
- Contact your international office, counselor, parent/guardian, or trusted adviser using a known contact method.
30
+
- If there is immediate danger, contact local emergency support or campus safety.
31
+
32
+
## If you already paid or shared information
33
+
34
+
- Contact your bank or card provider quickly and explain what happened.
35
+
- Change passwords from the official website or app.
36
+
- If you shared an OTP or login code, secure that account immediately and enable new security settings.
37
+
- Tell your school counselor or international office so they can help with next steps.
38
+
- Keep records, but avoid forwarding sensitive documents unless a trusted official asks for them through a secure channel.
39
+
40
+
## How to verify official channels
41
+
42
+
- Use the institution website, official portal, or contact information printed on official admission materials.
43
+
- For government processes, start from official government domains typed manually.
44
+
- For testing, use the official provider account or approved test center.
45
+
- For housing, ask the campus housing office or an off-campus housing adviser to review leases and payment requests.
46
+
47
+
## Safe message to send to a counselor or parent
48
+
49
+
> I received a message asking me to take action about school, visa, housing, testing, documents, or payment. Before I click, pay, or send information, can you help me verify it through an official website or published contact? I can share a redacted copy with personal details removed.
counselorEscalationScript: 'I am reviewing a student message that may involve this process. Please verify the official payment, document, or portal instructions using institution-owned contacts before the student responds.',
125
+
parentFriendlyScript: 'We are going to pause and verify this through the school or government website we type ourselves. Please do not send money, codes, or documents until an official contact confirms it.',
126
+
studentFriendlyScript: 'Pause, save the message, and ask your counselor or international office to verify it through an official website or published contact before you click, pay, or send documents.',
sourceNotes: `${pack.title} uses general safety guidance and placeholder official-resource IDs. Replace or confirm all links and scripts with institution-approved sources before a pilot.`,
0 commit comments