Why we built scam detection on WhatsApp instead of as a separate app

The initial version of FamAI's scam checker was designed differently. We had a tab. You'd open FamAI, paste the suspicious text, hit "Check." Clean UI. We were proud of it.

Nobody used it.

Not because parents didn't receive scams — they received them constantly. The problem was the workflow. When your parent gets a suspicious message, the suspicious message is in WhatsApp. The check tool was somewhere else. That gap — however small — was enough to make the feature feel like work.

The forwarding insight

Elderly Indian parents forward things on WhatsApp constantly. Good morning messages, religious content, health tips, political news. The act of forwarding is so ingrained that it requires no thought. We decided to route into that existing habit.

Now when a parent receives something suspicious, the check doesn't require opening a different app or pasting anything. They just forward it to FamAI — the same action they'd do with any other message they wanted to share. The friction is close to zero.

This sounds obvious in hindsight. Most useful product insights do.

Why we don't auto-scan chats

The technically ambitious version of this feature would scan all incoming messages automatically and flag scams before the parent even reads them. Some messaging apps do something like this. We considered it.

We chose not to for two reasons.

First, privacy. Auto-scanning would mean FamAI reads every incoming message — not just the ones the parent forwards. We decided early that FamAI should only know what the parent explicitly shares. This isn't just a legal question; it's a trust question. Parents who understand how this works should not feel like they're being watched.

Second, control. There's something important about the parent deciding what gets checked. When they forward a message, they're making a judgment call: "this looks suspicious, let me verify." That's the right instinct to reinforce — not to replace with a passive system that makes the decision for them.

What FamAI actually checks for

The scams targeting Indian seniors cluster into a few recognizable patterns. We focused on these first:

• KYC expiry links. "Your HDFC/Jio/Airtel KYC expires today — click to update." Banks and telecoms do not send KYC links over WhatsApp.
• Lottery and prize wins. "You have won ₹25 lakh in the government lottery." There is no government lottery.
• Digital arrest threats. Someone claiming to be CBI, ED, or Supreme Court calling to say you or a family member will be arrested. This pattern is extremely effective at terrifying people who don't know it's a script.
• OTP and verification requests. Anything asking your parent to share an OTP or verification code — for any reason, from any person they don't physically know.
• Fake electricity/gas/water bills. Threatening disconnection and asking for immediate payment via a QR code or link.
• Investment and high-return schemes. WhatsApp groups promising guaranteed returns.

FamAI also handles fake news and health misinformation — the "forward this to 10 people" type of content — though these are less urgent than financial scams.

The Hindi-language challenge

Most scam detection tools are trained on English-language scams. The majority of scams targeting Indian seniors arrive in Hindi or Hinglish. "Aapka KYC expire ho raha hai, abhi update karein." "Supreme Court se arrest warrant hai aapke naam." "Aapka bijli connection kal kat jayega."

These don't look the same as their English equivalents to a pattern-matching system. Code-switching makes it harder: "Your HDFC account mein suspicious activity hai — verify karein." Half the sentence is English, half is Hindi, and the scam structure spans both.

Getting this right required building with Hindi-language scam examples from the start, not as an afterthought. We're still improving — our Indian language coverage is better than most tools but not perfect.

The verdict format

We tried several formats for the response. Long explanations didn't work — parents stopped reading after the first sentence. Short verdicts without reasoning felt arbitrary. We landed on three parts: the verdict in large clear text (safe / suspicious / scam), one sentence of reason, and one concrete action.

Example: 🚨 Scam lagta hai. Banks kabhi WhatsApp pe KYC links nahi bhejte. Is link pe mat click karo — apne bank ko directly call karo.

The parent can act on that without reading further. If they want more context, they ask. That's the right information hierarchy for this use case.