Team Reflex, National Forensic Sciences University

Every check passed.
The decision was not theirs.

Every bank verifies who is transacting. SWAYAM verifies whether the decision is genuinely the customer's own. This page explains the whole system, and lets you play with the parts so it actually sticks.

0genuine users stopped on the bank's records
34 msmedian decision
0.877keystroke AUC, unseen users
400 Bper customer template
269backend tests passing
7 / 7attacks held

1. The problem, in one screen

A digital arrest scam does not steal a password. It steals the decision.

What is really happening

A caller says he is the police. He says a parcel in her name had drugs in it. He keeps her on the phone for four hours. He tells her to move her money to a safe account for verification. She is terrified.

She logs in herself. Types her own password. Reads her own OTP. Sends the money herself.

What the bank sees

Password correct. OTP correct. Device correct. Face correct. Location correct.

Every check passes, because every check asks the same question: who is this? And the answer is right. It really is her.

The gap. Nobody is asking the question that matters: is this decision the customer's own? That question is what SWAYAM answers. The name says it: स्वयं means "of one's own accord".

2. Score lab, build a decision yourself

Move the sliders. These are the real weights from app/domain/score/fusion.py and the real thresholds from the config. This is exactly how a decision is formed.

6
ALLOW
0 to 40, no friction
0 allow41 step up76 block

Weights: coercion 0.30, sonar 0.25, rhythm 0.20, biometric 0.10, transaction 0.10, context 0.05.

Try this. Push coercion to 100 on its own and watch it still not block. Now add sonar and rhythm too. The engine needs more than one signal to agree before it escalates, which is exactly how it avoids stopping honest people.

3. The eight stage loop, click any stage

Every feature is a stage in one loop. A feature is only finished when a real action enters at stage one and comes out as sealed evidence.

4. The models, honestly labelled

Three models trained by us on real public data, one fusion model that is shipped but currently switched off, and two classical algorithms with no training at all.

Why we never use one signal alone. A single behavioural signal from a short phrase has an equal error rate around 20 percent. That is normal, and it is published honestly. It is also exactly why six families are fused, and why a rhythm mismatch produces a step up rather than a block: the cost of being wrong becomes one OTP, not a stopped customer.

5. Typing lab, feel the idea yourself

Type any ten digits below, twice. First the way you would type your own phone number, from memory. Then slowly, as if somebody were reading it to you down a phone line. Watch the bars.

0digits typed
0average gap, ms
0.00unevenness
0listening pauses
waitingverdict

A listening pause is a gap over 500 ms. This uses the same features the engine uses: average gap, unevenness of the gaps, and how many pauses there were. Nothing you type is stored or sent anywhere.

What you just proved. A number you know arrives in fast even bursts because your fingers remember it. A number being read to you arrives one digit at a time with a pause before each. That difference is measurable, it needs no camera and no microphone, and it is how SWAYAM catches a victim being talked through a payment.

6. The four channels

The problem statement names four. Here is exactly what exists in each.

7. The fraud console, page by page

The product a bank's fraud team runs all day. Six surfaces, all driven by real traffic. There are no demo buttons that play a canned story.

8. Forensics, the five steps

An alert on its own proves nothing later. When a case reaches a court, three questions get asked in order, and the Evidence panel answers them in that order.

The likelihood ratio, and why a score is not enough

What a court cannot use

"Risk score 87." A judge cannot weigh that. How often is it wrong? Wrong in which direction? There is no answer, because a black box score has no measured error rate.

What a court can use

"The behaviour is about 8 times more probable if produced by someone other than the account holder." That is a likelihood ratio, the standard way forensic science states evidence of identity, and it is validated so its error is known.

MeasureValueWhat it means
Cllr0.6530 is perfect, 1 carries no information. Ours carries real, measurable information.
Cllr min0.6294The discrimination floor. How much of the cost is unavoidable.
Calibration loss0.0236The small part that is bad calibration rather than weak discrimination.
Comparisons6,208 + 6,208Genuine and impostor pairs it was measured over.
How to defend 0.653. It is not DNA level and we never say it is. It means the test carries real information and, unlike a black box score, its error rate is known. That is the difference between a number and evidence.

9. Seven attacks, and one control

Real attacks fired at the real production defences, on demand from the console. The last row is not an attack.

Why the control row exists. Anyone can build something that blocks everything. The control is a calm genuine customer sending a normal amount to a known payee, in the same run. Score 13, allowed, zero friction.

10. What we are honest about

A system a bank deploys must know its own limits. Saying these out loud is worth more than hiding them, and a jury will find them anyway.

LimitThe honest statement
Single signal accuracyKeystroke equal error rate about 20 percent, touch about 21 percent. One behavioural signal from a short phrase is not enough alone. That is why six families are fused.
The XGBoost fusion modelTrained and shipped, weight in the live decision is zero today. The live score is rule fusion plus the trained keystroke biometric. We never claim six models vote.
Heart rate from a cameraSensitive to lighting and movement. A bounded capability, graded, never a blocking decision on its own.
Dictation cadenceA calibrated behavioural signal, not a trained detector. Stated on the screen itself.
Court admissibilityEvidence is prepared to meet Section 63. Whether it is admitted is for a court.
iOS SDK1,736 lines of Swift that have never been compiled. Source, not a shipped SDK.
Fraud recall50 percent of individual fraudulent transactions on the labelled feed. We report the misses. Campaign level detection is 14 of 14.

11. Test yourself

Click a question, try to answer it in your head first, then open it. If you can answer all of these you can present this project without notes.