CommBank & Truyu
AI-powered scam detection.
Research, Ideation, Experimentation, Product Strategy, UX and Visual Design.
↓
Discovery
In 2024, Australians lost over $2.74 billion to digital scams. Despite CommBank's significant investment in fraud prevention, the number of customers being scammed remained stubbornly stable. The Emerging Technology team saw an opportunity to use Generative AI to tackle the problem differently, not just detecting scams after the fact, but helping customers avoid them in the first place.
-
CommBank already had tools like NameCheck, CallerCheck, and CustomerCheck to help customers protect themselves. But the number of scam victims wasn't dropping. Internal data showed that 84% of scam complaints over a four-month period were text message scams — yet in research, customers consistently told us they were confident in their ability to spot them.
The gap between confidence and reality became the core of the problem we set out to solve.
-
I lead two rounds of qualitative research to understand the real behaviour behind scam vulnerability.
Round One
Twelve customer interviews to test desirability and concept preferences across five experience formats: a chatbot, a website upload tool, an in-payment notification, a message-forwarding service, and a proactive scanner.Customers liked the idea of ScamCheck, but felt they didn't need it. No concept emerged as a clear winner, and it was hard to tell whether people would actually use the tool in practice.
Round Two
Eight narrative interviews with people who had been scammed. We asked each participant to walk us through their experience from start to finish — what they were doing, how they felt, and what made them fall for it.What We Found
People don't fall for scams because they're careless. They fall for them because scams are designed to feel real. They arrive at the right moment, reference something relevant in the person's life, look legitimate, and create just enough urgency to short-circuit scepticism. Nobody feels suspicious at the moment they're being scammed. -
We presented our findings to Group Security executives, who made the call to build. Even with mixed desirability signals, the business case was clear: if a tool like ScamCheck could prevent even one person from being scammed, it had earned its place.
The vision was to build a ScamChecker Engine, a fraud and scam detection platform that could serve retail customers, business customers, frontline staff, and fraud analysts over time. The first use case: a text message checker for retail customers.
To get it to market quickly, we partnered with Truyu, an existing X15 venture, to build ScamCheck natively within their iOS and Android apps.
Delivery.
To implement the first use case, I lead the design across two teams, collaborating with CommBank engineers to map the UX according to technical requirements, and with the Truyu product team to design within their existing app.
The core flow
The core flow is simple. A customer receives a suspicious text message, opens ScamCheck in the Truyu app, and uploads a screenshot . Within seconds, they receive a verdict.
How it works
When a message is classified as likely a scam, the result is accompanied by up to eight educational indicators (things like unfamiliar sender details, suspicious links, urgency tactics, or threats) drawn directly from the AI's analysis. The indicators use plain, static language designed to build literacy, not just deliver a result.
Reflections.
This project sat in genuinely ambiguous territory. Customer research didn't hand us a clear green light — people told us they were fine, even when the data said otherwise. Navigating that tension, advocating for further research before committing to build, and then designing a tight, purposeful experience within a partner team's existing product was the real design challenge here.
It was a reminder that sometimes the problem isn't what the customer says. It's the gap between what they believe and what's actually happening to them.