Six names. Three scams. Same playbook.
Scam posts in group chats are copy-paste jobs. The sender changes and the wording shifts, but the script, and often the phone number, stays the same. Judged one message at a time, every one of them looks harmless.
Two senders. The same message word for word, and the same number.
hiii everyone! is anyone interested in my parking pass i sold my car and i couldn't get a refund for the pass, please text me if you want it (309) •••-••34
hiii everyone! is anyone interested in my parking pass i sold my car and i couldn't get a refund for the pass, please text me if you want it (309) •••-••34
New names and new wording, with one phone number behind both.
Hi guys! Giving away concert tickets for free, lmk if anyone is interested in it. (646) •••-••09
Selling my 3 concert tickets, lmk if anyone is interested in it. I'm down to sell them separately. (646) •••-••09
The same pitch from rotating numbers, so no blocklist ever catches up.
I'm giving away my concert tickets for FREE, text me if you're interested +1 (410) •••-••00
Anyone interested in free concert tickets? Text me: +1 (973) •••-••67
Detection stops at one message.
Each post is judged alone. Copy-paste scams with new names and wording look harmless every time.
Blocklists only catch links someone already reported. A fresh scam has no history to match.
Verifying means searching the number, the link, and the story, or handing an app access to your private messages.
The same payment link or number can appear across GroupMe, Instagram, and iMessage, and no single person sees all of it.
Share a screenshot. Get clarity.
Ravel is a scam checker built into your iPhone's Share menu. No copy-pasting, no research, and no handing an app access to all of your messages. You choose exactly what to send, and nothing else is read.
Choose one image from Photos, or share it from any app with the iPhone Share menu.
Paste or type the text you were sent. Nothing is read automatically.
Parse a URL without opening it. The destination is never visited.
Prefer not to download anything? Text the Ravel agent and get the same verdict back.
Four steps to an answer.
Ravel turns a confusing message into structured evidence, then a strict server-side policy decides what it means. The model never gets the final word.
-
1
Share
Screenshot a message, ad, or conversation, or share a link, straight from any app.
-
2
Extract
Gemini reads the content and pulls out scam signals: urgency, payment requests, requests for passwords or codes, account threats, and links.
-
3
Compare
Coming next: signals are matched against sanitized, opt-in reports from other people to connect a message to known or emerging campaigns.
-
4
Verdict
You get the evidence, the uncertainty, and recommended precautions in plain English, then confirm or reject each flagged signal yourself.
Gemini extracts the claims. Ravel's policy decides the verdict.
Free concert tickets! Pay a $20 transfer fee before delivery.1 tickets.example/offer2 Act now!3
- 1Transfer fee requested before delivery
- 2Destination: tickets.example, not visited
- 3Urgency pressure: "Act now"
Verified fraud: false. Evidence: AI-extracted, unverified. Next step: verify through the official ticket platform before paying.
The model flags it. You make the call.
Gemini marks every signal it finds directly on your screenshot and numbers it, so you can check each one against the original. Confirm it, reject it, or mark it unsure, and Ravel reassesses the message using your review.
Try it on this message.
"Campus account support: Your account will be suspended today. Send your password and verification code to restore access."
A request for a password or a verification code is still in play. Do not share either one. Open the official app yourself or use a contact you found independently.
You were unsure about a key signal, so Ravel will not guess. Look at the original message again before you act on it.
Without a request for a password or code, urgency and an account warning alone are not enough to flag this message. That is not the same thing as safe.
Every signal is outlined on your screenshot and numbered, so you can see exactly what Gemini read and where.
Present, not present, or unsure. Each answer goes straight back into the assessment, and the verdict updates in place.
Gemini's original observations stay on record, unchanged. Your review sits alongside them, never on top of them.
Honest answers, in plain English.
Ravel never claims to prove fraud, and it never calls something safe just because it found nothing. Every result separates what was observed from what was verified, and ends with something useful to do next. Try a few synthetic examples.
Free concert tickets. Pay a $20 transfer fee before delivery: https://tickets.example/offer. Act now!
A payment combined with urgency is a classic advance-fee pattern.
Your account will be suspended unless you act now. Reply with your password and PIN to verify your account.
Requests for login secrets are flagged even when no money is involved.
Your verification code is 123456. Never share this code with anyone. Enter it only in the official app you opened.
Delivering a code to you is not the same as asking you to share one.
https://new-offer.example/item
Parsed into a sanitized origin, https://new-offer.example. The path is dropped and the page is never opened.
No download? Just text Ravel.
Photon Spectrum puts the Ravel agent in iMessage. Forward a message or a link, and the same backend and the same policy as the app reply with a plain-English verdict.
Ravel
Your check stays yours.
Ravel only ever sees the one item you deliberately choose. That is not a setting. It is the architecture.
Nothing is read automatically. No inbox access, no background scanning, no contact lists.
A link on its own is parsed without being visited, resolved, or sent to AI. Paths and query tokens are dropped.
Selected content lives in app memory and is cleared when you dismiss the check or the app goes into the background.
Screenshots are decoded and re-encoded before analysis, removing embedded metadata from the file.
No AI key ships in the app. Every request passes through Ravel's backend and its strict safety policy.
A private check never creates a community report. Future campaign matching will be strictly opt-in.
In connected mode, the text or screenshot you choose is also sent to Google Gemini for analysis under Google's provider terms. A link checked on its own is never sent to Gemini.
Engineered to be checked.
One backend serves both the iPhone app and the iMessage agent. Gemini returns typed observations, strict parsing validates them, and the verdict comes from Ravel's own policy.
The stack.
From isolated checks to collective defense.
Today every check is private and stands alone. The opt-in report contract is already defined in the API, so when people choose to share, Ravel can connect reports by destination, language, and timing, and surface the campaign behind the messages.
review
-
Today
Protect people in their communities
Students and group chats get a fast, private way to check a message before they pay.
-
Next
Real-time alerts
When a new campaign starts spreading, everyone nearby hears about it early.
-
Then
Verified threat intelligence
Confirmed malicious links and payment destinations, shared across the network.
-
Future
Infrastructure for trust
APIs that let banks and payment apps flag risky destinations, plus browser analysis.
The team behind the work.
Built at HackNC 2026 for the Google Gemini and Photon tracks.
Dhairya Agarwal
Computer Science (BS)Environmental Science (BS)
Osman Taka
Physics (BS)Computer Science (BS)
Ali Çiçek
Data Science (BA)Communications (BA)