Your Prince Is Not Real: Catching Scams While They're Still Happening

What I Built

Your Prince Is Not Real (YPINR) — a system that catches scams during the interaction, not after you've already lost the money.

Most scam tools are website checkers: they flag a bad URL after you've clicked it. But the scams doing the most damage today don't route through a browser — they're a cloned voice on the phone claiming to be your grandson, a "bank" calling about fraud on your account, or a DM sliding into urgency and a gift-card request. By the time you're on the call, existing tools have nothing to say.

YPINR is built around that gap, split into three surfaces sharing one "brain":

Outpost — a Mac sidecar that clips the opening seconds of a call and sends it to the detector for scoring.
Sherpa — a Chrome extension that highlights risky sentences in DMs and comments, entirely on-device, no account or telemetry.
Hub — the public site (yourprinceisnotreal.net) with an adaptive questionnaire, a searchable scam-pattern catalog, and a place to report a method (not a person).

Under the hood, the detector screens the first ~30 seconds of audio for AI-voice and known scam phrasing, and only escalates to a full transcription + classification pass if something looks sensitive — that gate matters both for cost and for false positives. If it's confirmed a scam, it upserts the pattern (not the person) into Postgres and can fire off a plain-text SMS warning.

The thing we kept coming back to as a design principle: we're building a living encyclopedia of scam methods, not a surveillance log of people. The corpus stores platforms, demands, and phrases — never names, numbers, or account details.

What I learned: gating an expensive model call behind a cheap first-pass classifier is the difference between a demo-able pipeline and one that falls over under real usage — and writing SMS copy that a provider like Textbelt won't reject (no URLs!) is its own small design constraint you don't think about until you hit it.

Demo

Link: yourprinceisnotreal.net

Show Image

YPINR (Your Prince is Not Real) | Devpost

AI made scams cheap and convincing. YPINR fights back. Outpost flags scam calls live, Sherpa catches scam texts before you reply. AI vs. AI, privacy-first. You don't have to be bulletproof. We are.

devpost.com

Partner Technologies

ElevenLabs — this is the one we went deepest on, and it earned us the Best ElevenLabs Award. We used ElevenLabs' speech classification as the first-pass screen on every call: scoring the opening clip for AI-generated voice before deciding whether to escalate at all. The final scam confidence is a weighted blend — 40% ElevenLabs' AI-voice score, 60% the downstream classifier's confidence — which meant a huge part of our tuning time went into finding where ElevenLabs is actually reliable (strongest on ElevenLabs-style synthetic voices in that early window) versus where it isn't, and designing the escalation gate around that honestly rather than overselling it as a universal deepfake detector.

xAI / Grok — Grok Voice Transcribe handles speech-to-text on the escalated clips, and Grok 4 does the actual classification, returning structured JSON (is_scam, type, confidence, method, target, reasoning) that we ground with retrieved rows from our scam catalog before prompting.

Cursor — we didn't just use Cursor to write code faster, we gave it an actual seat on the team: our repo has a dedicated cursoragent contributor account that shipped real commits alongside the five of us, including restoring the GitHub Pages build for the React hub and polishing the live web version of Outpost. We leaned on it for the repetitive, well-scoped work — indexing our seed scam TSVs for the TF-IDF/Grok RAG lookup, wiring up dynamic news-wire fetching from the database, and chasing down a Pages deploy that kept breaking until we tracked down a missing frontend/src/lib/api.js file. What surprised me was how well it held context across a multi-service repo (Python detector, React hub, a Chrome extension, and a Tkinter desktop app all in one tree) without us having to re-explain the architecture every time we handed it a task.

GoDaddy — the public hub at yourprinceisnotreal.net is the thing every other product points back to: Outpost's verdicts, Sherpa's "what we watch for" page, and the scam catalog all live there, so having a real domain rather than a raw GitHub Pages URL made the whole project feel like a product instead of a school assignment.

Bloomberg Philanthropy — the Postgres-backed pattern catalog (seeded with public reports, merged down to about 132 distinct scam types) is the piece aimed at this track: it's meant to grow as a public-good encyclopedia of scam methods, not an ad-targeting dataset, and not something that stops mattering once the hackathon judging ends.

Hackathon Experience

I attended HopHacks 2026 at Johns Hopkins University, and it was one of the best hackathon experiences I've had. Our team finished as a Top 10 finalist out of 200+ contestants and took home the Best ElevenLabs Award.

Looking back at our commit history says a lot about the weekend: messages like "[wip] wire up the web app backend" and "I forgot what I even changed here i think Discord functionality bot" late in the build window, followed by a scramble to fix a broken GitHub Pages deploy right before submission. That's basically the emotional arc of the hackathon in a nutshell — heads-down building, losing track of your own changes at 2am, and then the relief of watching the hub actually go live on the real domain with the pipeline working end to end. Five of us ended up shipping to that repo, humans and our Cursor agent included, across a stack that spanned Python, React, a Chrome extension, and a Tkinter desktop app — keeping all of that in sync under deadline pressure was its own kind of stress test.

Huge thanks to my teammates, the other hackers for the energy, and the sponsors and organizers at Johns Hopkins for running such a well-organized event.