Inspiration
Scammers do not only exploit technology. They exploit moments of fear, urgency and isolation.
In Malaysia, online crime caused more than RM2.7 billion in losses across 67735 reported cases during the first eleven months of 2025. Many of these scams impersonate banks, police officers or government agencies. Victims are pressured to transfer money, reveal an OTP or keep the conversation secret before they have time to verify what is happening. Source: Royal Malaysia Police
Older adults, lower income households and people with lower digital confidence are especially vulnerable during this critical moment. Existing services such as bank hotlines, Semak Mule and Malaysia’s National Scam Response Centre are important, but users still need help understanding a suspicious interaction and deciding what to do before money leaves their account.
This inspired us to build Jaga, which means “to guard” or “watch over” in Malay.
Jaga is designed to be a pause button between pressure and payment.
What it does
Jaga - The AI Scam Circuit Breaker is a multilingual scam safety system delivered through three accessible interfaces.
Web application
Users can paste a suspicious message into the Jaga website. Jaga provides a risk assessment, identifies tactics such as urgency, impersonation, secrecy and credential requests, and explains the warning signs in plain language.
Telegram bot
Users or their family members can forward suspicious messages, links and payment requests to @jagaguardianbot. The bot returns a clear risk level, detected warning signals and recommended next actions without requiring users to install another dedicated application.
Physical voice companion
For older adults who may be less comfortable navigating websites or chatbots, we built a button activated ESP32-S3 voice companion.
A user can press one button and ask:
“Someone claiming to be from my bank asked me to transfer money and give them my OTP. Is this a scam?”
Jaga responds with a short, calm and spoken friendly explanation. The device is activated by the user and does not claim to monitor every phone call continuously.
All three interfaces follow the same safety principles. Jaga never requests passwords, PINs or OTPs. It encourages users to pause, avoid transferring money, verify through an official number and contact the appropriate response channel if money has already been transferred.
Jaga is designed to analyse Bahasa Malaysia, English, Manglish, Mandarin and Tamil messages. This allows users to seek help in the language and communication style they are most comfortable with.
How we built it
Jaga is built as a shared scam analysis platform rather than three disconnected prototypes.
The web application uses Next.js, React and TypeScript and is deployed on Vercel. Its server side analysis service is shared by both the website and Telegram bot, ensuring that users receive consistent assessments across interfaces.
The analysis layer follows a resilient provider chain:
- OpenRouter performs the primary AI analysis (GPT 5.6 Luna Model was used).
- Groq acts as the secondary AI provider and supports speech-to-text.
- An offline keyword detector provides a final zero-configuration fallback.
Every provider response is validated before it reaches the user. Risk scores are bounded between 0 and 100, required fields are checked and malformed responses trigger the next fallback. Suspicious messages are treated as untrusted content so that instructions embedded inside a scam message are analysed rather than followed.
The Telegram bot uses an authenticated webhook protected by a server side secret. It supports commands such as /start, /help and /privacy, while ordinary messages are passed to the same analysis service as the website.
For voice interaction, Jaga uses Agora RTC and Conversational AI with ElevenLabs text-to-speech. The physical companion is based on an ESP32-S3 device with 16 MB of flash and 8 MB of PSRAM. We backed up and validated its firmware, configured the Jaga voice persona, customised its visual assets and designed the interaction around physical buttons.
Jaga began as a web-based text checker. During OpenAI Build Week, we used Codex with GPT-5.6 to meaningfully extend it with:
- The secure Telegram workflow
- The OpenRouter to Groq to offline fallback architecture
- Shared and validated analysis logic
- The physical voice companion
- Agora and ElevenLabs voice integration
- Multilingual and responsible-AI safeguards
- Automated tests and production-build verification
- Judge facing documentation and deployment instructions
Codex helped us work across unfamiliar embedded hardware, firmware, full stack development and AI APIs. It assisted with diagnosing hardware behaviour, refactoring the analysis architecture, implementing the Telegram webhook, validating model outputs, testing the application and documenting the system.
Our team remained responsible for the key product decisions. We selected the target users, designed the safety workflow, chose a button first physical interaction and defined the boundaries that prevent Jaga from requesting sensitive credentials or taking autonomous financial actions.
Challenges we ran into
Hardware that did not match our expectations
Our first display board appeared to match its advertised specifications, but its touchscreen was unreliable and often required repeated presses. Rather than forcing an inaccessible interaction, we changed to a smaller ESP32-S3 board and created a simpler three button workflow.
Working with precompiled firmware
The physical device came with precompiled firmware rather than a fully editable application. We first had to identify its flash configuration, create a complete backup and verify the correct partitions. This allowed us to update the firmware and Jaga branding without damaging the device.
Making voice interaction dependable
Voice systems introduce latency, connectivity and session management challenges. Long greetings and responses made the product feel slow, so we shortened Jaga’s welcome message and designed spoken answers around one immediate action at a time.
Sharing one safety engine across different interfaces
The website, Telegram and physical device have very different interaction patterns. We had to ensure that Jaga remained consistent while adapting the length and presentation of its response to each interface.
Preventing unsafe AI confidence
Scam detection is probabilistic. An incorrect but confident answer could create additional harm. We added structured output validation, visible uncertainty, provider fallbacks and clear instructions to verify through official channels.
Supporting multilingual and informal messages
Scam messages often contain abbreviations, mixed languages and informal expressions. Manglish messages, for example, may combine English and Bahasa Malaysia in the same sentence. We designed Jaga to preserve the user’s language where possible and explain risks without technical terminology.
Accomplishments that we're proud of
We are proud that Jaga developed into a working product rather than remaining a concept.
Our key accomplishments include:
- Building a complete experience across web, Telegram and physical hardware
- Creating a multilingual workflow for users with different levels of digital confidence
- Implementing three levels of analysis resilience
- Integrating a voice first interface using Agora and ElevenLabs
- Making the deployed website and Telegram bot testable without accounts or API keys
- Creating safeguards for prompt injection, malformed model responses and provider failures
- Designing a product that recommends safe human action instead of making autonomous decisions
- Winning third place at the Codex Community Hackathon Kuala Lumpur 2026
The third place result provided early external validation, but our biggest achievement was making one coherent safety workflow function across three very different interfaces.
What we learned
We learned that accessibility is not an additional feature added at the end of development. It changes the entire product architecture.
A website may be convenient for one person, while another person may be more comfortable forwarding a message through Telegram or pressing a physical button and speaking. Supporting these different behaviours made Jaga more useful than a single-interface scam checker.
We also learned that responsible AI requires more than adding a disclaimer. It requires treating user content as untrusted, validating model outputs, showing uncertainty, protecting credentials, designing fallbacks and directing users towards human support.
Our hardware journey taught us to verify the actual behaviour of a device instead of relying entirely on its advertised specifications. When the touchscreen proved unreliable, simplifying the interaction produced a better product.
Most importantly, we learned that scam prevention is not only about identifying malicious content. It is about interrupting the emotional pressure that causes someone to act before verifying.
What's next for Jaga - The AI Scam Circuit Breaker
Our next step is to conduct a structured pilot with older adults, caregivers and multilingual families.
We want to measure:
- How quickly users receive and understand a warning
- Whether they identify the correct next action
- False positive and false negative rates
- Performance across languages, dialects and informal writing styles
- Whether Telegram forwarding helps family members intervene
- Whether the physical voice companion improves accessibility
Planned product extensions include:
- Screenshot and QR code analysis
- Telegram voice note transcription and assessment
- Structured incident summaries for reporting
- Improved offline detection for limited connectivity environments
- Direct navigation to verified bank and public response resources
- Optional caregiver alerts with explicit user consent
- A library of emerging scam patterns and locally verified guidance
Longer term, Jaga could be distributed through banks, telecommunications providers, senior care organisations and community programmes.
Jaga began by addressing the needs of Malaysian families, but urgency, fear, impersonation and financial manipulation are universal scam tactics. Our goal is to make an accessible second opinion available to anyone who needs a moment to pause before acting.
Scammers create pressure. Jaga creates the pause.
Log in or sign up for Devpost to join the conversation.