Messages you receive
The web app
Paste an SMS or WhatsApp message, drop a screenshot, or upload a PDF or Word document. FraudLens highlights the exact words and links that give it away, and gives you a short plan for what to do next.
Phishing here doesn't look like phishing anywhere else
Scam messages in Mauritius switch between Kreol, French and English in one sentence, borrow the names of local banks and ministries, and link to addresses one letter away from the real thing. Generic filters don't read Kreol, don't know mcb.mu from mcb.nu, and answer with a score nobody can explain. So people check scams the only way they can: by asking someone they trust, often after they've already clicked.
SMS
Ou kont MCB pou bloke zordi. Konfirm ou OTP lor mcb-secure.top
Web page
MRA: you are eligible for a tax refund of Rs 4,850. Enter your card to receive it.
Work email
Please note our bank details have recently been updated. Kindly settle the attached invoice today.
Three ways in, one engine
Scams reach people in three places, so FraudLens meets them in all three. Every client calls the same backend; none of them carries its own copy of the detection logic, so a rule fixed once is fixed everywhere.
Sites you open
The Chrome extension
Checks every site you visit against the Mauritius institution registry, lookalike rules, phishing and malware lists, domain age and the site's certificate. The Security Report grades a site and tells a badly built one from a hostile one.
Email at work
The Outlook add-in
Runs inside the email a business receives and looks for invoice and CEO fraud: supplier lookalike domains, changed bank details, a Reply-To that doesn't match, and payment requests from personal addresses.
Language
An AI model reads the message for tactics like urgency, threats or a request for an OTP. It must quote the exact words, and any quote not in the message is thrown out.
Facts
Deterministic code checks the links, domains, claimed identity, payment details, certificates and threat lists. Nothing here is guessed.
Verdict
A versioned rule engine turns both into a score, a verdict and an action plan. The same message always gets the same answer, and it still works when the AI is down.
Made for Mauritius, from the lexicon up
Two things a generic scam filter can't do: read Kreol Morisien the way people write it, and know which domains belong to which Mauritian institution.
A Kreol engine that understands negation
The lexicon has Kreol rules next to the English and French ones, and it knows the difference between advice and a request. The language model is grounded with a Kreol translation memory where every row carries its review status, and only human-reviewed rows feed it.
- “Partaz ou OTP ar nou”A request for your code
- “Pa partaz ou OTP ar personn”The bank's own advice
- “Ou kont pou bloke si ou pa konfirm”A threat to block the account
It knows the local domains
An institution registry lists the official domains of MCB, SBM, Absa, Bank One, my.t, Emtel and the MRA. The parser understands .mu suffixes like gov.mu and com.mu, and every lookalike explanation names the real domain.
- internet.mcb.muMCB's own site
- mcb-secure.topBrand name on an unrelated domain
- mcb.nuSame letters, wrong country code
- mсb.muA Cyrillic с posing as a c
What FraudLens checks
Every check below is deterministic code with tests. The AI only ever reads language.
Lookalike links
Typos, swapped letters, brand names on unrelated domains and Unicode homoglyphs, for Mauritian institutions and global brands.
Certificate identity
Who a site's certificate was issued to, at what validation level, and whether it is valid. The old green bar, read for you.
Threat lists
OpenPhish phishing pages and URLhaus malware, refreshed from the feeds, plus Google Safe Browsing when a key is set.
Brand-new domains
Registration dates and certificate history, because scam sites are set up days before they are used.
Phishing-kit tells
Pages cloned from a real bank, logos loaded from its site, and form data sent to Telegram bots.
Screenshots
On-device OCR reads a screenshot of a message so it can be checked like pasted text.
Forged documents
Metadata, error-level analysis and layout checks on PDFs, Word files and images of receipts.
Scam waves
Privacy-minimised fingerprints connect repeated reports into campaigns, without storing the messages.
Get FraudLens where you need it
The web app runs in any browser. The extension and the add-in install from the source while their store listings are pending.
Chrome extension
Link Guard for Chrome, Brave and Edge.
- Download the project from GitHub and unzip it.
- Open chrome://extensions and turn on Developer mode.
- Choose Load unpacked and pick the extension folder.
Outlook add-in
For Outlook on the web and new Outlook for Windows.
- Get the add-in's manifest.xml from the team.
- Go to aka.ms/olksideload, then My add-ins and Custom add-ins.
- Choose Add from file and pick the manifest.
Web app
Works on any phone or computer. Add it to your home screen to use it like an app.
Check a message nowFull source on GitHubBuilt by Dhruv & Friends
Four students, one weekend-shaped month, and a lot of scam messages forwarded by family. FraudLens was built for the Finnovate Web and AI Hackathon 2026.
Dhruv Bisht
Backend, browser extension and forensics
- The detection backend and its deployment
- The Chrome extension and site Security Report
- Document forensics for forged screenshots
Oleg Narainen
Product design and web app
- The phone-first web app and its design system
- Motion, layout and the desktop experience
- Kreol and French interface copy
Joshua Wang
Risk engine, Outlook add-in and Kreol
- The deterministic risk engine that owns every verdict
- The Outlook add-in for workplace email fraud
- The reviewed Kreol scam corpus and translation memory
Caellum Buys
Quality, testing and document checks
- Test pages, QA rounds and the fix-check harness
- PDF and Word document forensics
- Kreol review and consistency testing