In the fast-paced world of FinTech, brand trust is everything. When a company like bKash becomes a household name, it also becomes a target for scammers who want to exploit that trust. I saw a critical, real-world problem: fraudulent websites using names like “bKash Betting Sites” to lure unsuspecting customers. The manual process of finding, verifying, and reporting these sites was slow, inefficient, and costly. I knew there had to be a better way.
I decided to solve this problem by building a fully autonomous AI agent—a “digital detective” that could patrol the internet 24/7, identify these threats, and report them on a live dashboard. This is the story of how we built it, the challenges we faced, and the powerful system that emerged.
Live Agent Link : https://bkash-scam-agent.vercel.app/
The Problem: The High Cost of Manual Security
Every day, new scam sites pop up. For a security or operations team, the task is a frustrating game of whack-a-mole:
- Manually searching Google with various keywords.
- Visiting dozens of potentially malicious links.
- Reading through content to determine if it’s a genuine threat.
- Copying and pasting the findings into a spreadsheet.
This process is not only a drain on time and resources but is also reactive. By the time a site is found manually, it may have already scammed users. This was an operational bottleneck that was costing real money and putting the brand’s reputation at risk. The solution needed to be proactive, intelligent, and automated.
The Blueprint: Designing the “Digital Detective”
I designed the agent with a clear, modular architecture, with each part having a specific job:
- The Hunter (The Searcher): Its job is to search the web with both English and Bangla keywords to find potential leads.
- The Investigator (The Crawler): Once a lead is found, this part visits the website and reads all of its text content.
- The Brain (The AI Analyst): This is the core of the system. It reads the text and makes a judgment: is this site a potential scam?
- The Archivist (The Database): It stores only the confirmed threats, creating a clean, actionable list.
- The Dashboard (The User Interface): A simple, live web page where the management team can see the results at any time.
The Journey: A Battle of Bugs, Timeouts, and Breakthroughs
Building a truly autonomous system is never a straight line. Here are the real struggles we faced and how we solved them—the part most tutorials leave out.
Struggle #1: The Vercel Timeout
Initially, I hosted the agent on Vercel, a fantastic platform for websites. However, its free plan has a short time limit for scripts—about 10-15 seconds. My agent, which had to search, scrape, and analyze ~20 websites, was taking several minutes. The result? A “504 Gateway Timeout” error, every single time. The agent was dying mid-mission.
The Solution: I realized Vercel was the perfect “display” but not the right “engine.” I moved the agent’s core logic to GitHub Actions, which offers much more generous run times. This architectural shift was the first major breakthrough, separating the heavy lifting (GitHub) from the presentation (Vercel).
Struggle #2: The AI Becomes Less Intelligent
At one point, the agent suddenly stopped finding scam sites that I knew existed. After hours of debugging, I realized the problem wasn’t the code—it was my instructions to the AI. In an attempt to simplify the code, I had shortened the “prompt” (the set of instructions for the AI). This made the AI too cautious and less accurate.
The Solution: I reverted to a more detailed, explicit prompt, telling the AI exactly what to look for and how to format its response. It was a powerful lesson in “prompt engineering”: the quality of your instructions to an AI directly determines the quality of its results.
Struggle #3: The Redundancy Revelation
What happens if one of our tools fails? If our primary scraping API is down, does the whole mission fail? Initially, yes. This was a single point of failure.
The Solution: I rebuilt the agent with a “waterfall” fallback system. Now, when it needs to perform a task like searching or scraping, it has a toolkit:
- It first tries a professional tool like SerpApi.
- If that fails, it automatically tries a second tool, ScrapingBee.
- If even that fails, it tries a direct request as a last resort.
This multi-tool approach made the agent incredibly resilient and reliable.
The Final Architecture: A Professional, Automated System
- Scheduler & Engine: GitHub Actions runs the two micro-agents (English and Bangla) on a fixed schedule every morning.
- Redundant Web Data: A waterfall system using SerpApi, ScrapingBee, and ScraperAPI ensures the agent can always get the data it needs.
- AI Analysis: Google’s Gemini 1.5 Flash model reads and understands the content.
- Database: A Supabase database stores only the confirmed threats.
- Live Dashboard: A clean, mobile-friendly frontend hosted on Vercel displays the results, grouped by date with a filter.
Future Improvements
This system is powerful, but it’s just the beginning. The next steps could include:
- Automated Alerting: Integrating email or Slack notifications for the security team the moment a new high-threat site is discovered.
- Trend Analysis: Building a historical view to track the frequency and types of scams over time.
- Image Analysis: Upgrading the AI to analyze screenshots of websites to detect cloned branding or logos.
Conclusion: Solving Real Problems with AI
This project started as a response to a tangible business problem that was costing time and money. By combining the power of modern AI, serverless architecture, and resilient design, we built a system that not only solves the problem but does so proactively and at a fraction of the cost of manual labor. It’s a testament to how we can leverage technology to build intelligent systems that protect both businesses and their customers.
This system was designed and developed by Taniv Ashraf. For more projects and insights, visit his website at tanivashraf.com.