How ScamKavach Detects
13 Types of Indian Scams
A look inside the on-device detection engine — weighted scoring, bilingual pattern matching, and behavioral analysis.
Published April 2026 · By CloudTrunk Technologies
India is facing an epidemic of digital fraud. From fake CBI officers demanding "digital arrest" fines to UPI payment requests from fraudulent loan apps, scammers are evolving faster than traditional blocklists can keep up.
ScamKavach uses a multi-layered detection engine that runs entirely on your Android device. No cloud processing of your messages. No data uploaded. Here's how it works.
Architecture: Three Detection Layers
Layer 1: Pattern-Based SMS Analysis
40+ regex patterns across 13 scam categories, each with calibrated risk weights. Bilingual support for Hindi (Devanagari + transliterated) and English.
Layer 2: URL Threat Scoring
Multi-vector analysis of URLs — typosquatting detection, suspicious TLD scoring, brand impersonation checks, and shortened URL penalties.
Layer 3: Offline Database Lookup
360+ known Indian scam phone numbers, phishing URLs, and fraudulent UPI IDs bundled in the app. Works without internet.
The 120-Point Scoring Model
Every SMS is scored on a 0-120 point scale. Pattern matches contribute weighted points based on scam severity. The final score determines the verdict:
Confidence is calculated as a percentage of the 120-point maximum, capped at 98% — because no automated system should claim 100% certainty.
13 Scam Categories
Each category has dedicated patterns with calibrated weights. Higher weights mean higher confidence that the pattern indicates a real scam:
TRAI/RBI Sender Validation
Indian banks are required by TRAI and RBI to send transactional SMS using numeric sender codes (1600xx format) registered through the DLT platform. Promotional messages must use 140xx prefixes.
The Spoofing Signal
If a message contains banking keywords (OTP, account, debit, credit) but comes from a non-compliant sender — like an alphanumeric code pretending to be "HDFCBANK" — ScamKavach adds a +40 point penalty. Legitimate banks never send transactional SMS from alphanumeric IDs.
Bilingual Detection: Hindi + English
Indian scammers operate in Hindi, English, and Hinglish (transliterated Hindi in Latin script). ScamKavach matches all three:
English
"your account will be blocked", "verify KYC immediately"
Hindi (Devanagari)
"गिरेफ्तार", "केवाईसी", "वारंट"
Hinglish (Transliterated)
"giraftari", "kyc se juri", "paisa transfer"
URL Threat Scoring
URLs are analyzed across multiple threat vectors, each contributing points to a separate 0-100 score:
A whitelist of 40+ verified domains (Google, Amazon, Flipkart, major Indian banks) ensures legitimate URLs are never flagged. Brand impersonation detection maps 18 major brands with their official domain suffixes.
Digital Arrest Detection
"Digital arrest" is a uniquely Indian scam where criminals impersonate CBI, police, or customs officials on a phone call, keep the victim on the line for extended periods, and demand payment via UPI.
ScamKavach's DigitalArrestDetector uses behavioral signal fusion — correlating call metadata with SMS content:
Step 1: Call Pattern Detection
Monitors for calls from unknown numbers lasting 3+ minutes, OR 3+ repeated calls from the same number within 30 minutes.
Step 2: SMS Content Correlation
Within a 15-minute window after the call, scans incoming SMS for authority keywords (CBI, warrant, FIR), payment keywords (UPI, transfer, bail), and threat keywords (jail, freeze, arrest).
Step 3: Risk Classification
HIGH: Authority + payment keywords in same SMS. MEDIUM: Authority OR payment + threat keywords. LOW: 2+ threat keywords alone.
100% On-Device Processing
Every detection layer runs locally on the device:
RBI Licensed Lender Verification
ScamKavach bundles a database of 156 RBI-licensed financial institutions — banks, NBFCs, payment banks, small finance banks, and housing finance companies. When you check a UPI ID, the app instantly shows whether the recipient is a licensed lender or an unverified entity.
This is critical for detecting fake loan apps — one of the fastest-growing scam categories in India.
Open and Transparent
We believe security tools should be transparent about how they work. This article describes the actual detection algorithms running in ScamKavach today. We're committed to continuously improving our detection as scammers evolve their tactics.
If you have questions about our detection system or want to report a scam pattern we're missing, reach out at hello@cloudtrunk.tech.