Elastic · Elasticsearch + Jina models

Scammers reuse their scripts, phone numbers and photos. Handshake remembers every scam it catches in Elasticsearch, so the next buyer who meets the same seller is warned, even when the words are different.

Try it live

Same details

Exact matches

Phone numbers, emails, Cash App tags, accounts and links are pulled out in code and matched exactly, in any format: (408) 555-0199 is 408.555.0199.

Elasticsearch keyword terms

Same tactics

Matched by meaning

“pls send thru friends n family, 2 more ppl asking” matches “Send as F&F, other buyers waiting”. Jina embeddings find candidates and the Jina reranker decides.

Jina embeddings v5 + reranker v3

Same photo

Reused pictures

Listing photos read by Kernel are embedded with Jina CLIP. The same photo resized or cropped still matches at 0.98; a different one scores about 0.64.

Jina CLIP v2 · kNN on dense vectors

How it works

Memory runs alongside every check: a deal pasted as text, a screenshot, or a link Kernel opened.

  1. 01

    Read the seller's side

    The scan keeps only what the seller wrote, never the buyer's messages or details, plus the exact phrases it flagged as tactics.

    AI · Structured output
  2. 02

    Ask memory three ways

    Exact details by keyword, tactics by Jina embeddings and reranker, photos by kNN. The three searches run in parallel with the price check.

    Elasticsearch
  3. 03

    Code weighs the evidence

    Details or photos confirmed by two different people are a known scam. A single sighting or similar wording is a warning that can't make a deal high-risk alone.

    Deterministic
  4. 04

    Remember what's caught

    High-risk scans are stored automatically, and a buyer can report one with a click. The same message seen again bumps its count instead of duplicating it.

    Upsert
  5. 05

    Count it live

    This page reads memory with ES|QL on every visit: how many scams, how often they were met, and which tactics are most common.

    ES|QL

Live from Elasticsearch

Read with ES|QL when this page loads. Seeded with common scam scripts, then growing with every scam Handshake catches.

Reading memory…

Built so it can't be abused

Two witnesses to convict

Pasting someone's phone number into a fake scam once doesn't brand them. Details only count as a known scam after buyers on two different networks reported them.

Reports point at real scans

A report names a scan Handshake ran in the last 30 minutes, which had to find warning signs, and only the person who ran it can report it. Nobody can submit their own text.

Only the seller's side

Memory never stores the buyer's messages, addresses or identity. Visitors are counted by a keyed hash, and buyers see only enough of a detail to recognize it.

Proof

0.41

reranker score for a reworded Friends & Family scam; honest listings scored below zero.

Jina reranker

0.98

photo similarity for the same scam photo resized; a different photo scored 0.64.

Jina CLIP

21

automated tests for fingerprints, matching rules, witnesses, reports and privacy.

Vitest

What we call

Fingerprint index

semantic_text · keyword · dense_vector

One document per scam: tactics embedded by Jina, details as keywords, photos as nested 1024-dim vectors.

Same tactics

retriever: text_similarity_reranker

A semantic match finds candidates and .jina-reranker-v3 keeps only real matches.

Same photo

knn on photos.vector

Photo vectors from .jina-clip-v2, matched above 0.92 cosine similarity.

Remember

_update with upsert

The same scam seen again bumps its count, adds new witnesses and keeps one document.

Live stats

POST /_query (ES|QL)

Counts and top tactics for this page, computed in Elasticsearch.

Docs & source

Check a deal Sell with Handshake