Why no single signal can hold a payment in Lookout
Lookout holds a risky PayPal payment until a trusted contact agrees. The score is a fixed table, the model only reads the words, and here is the AWS version.
The scam that breaks nothing
The payment scams that hit older adults hardest do not need to hack anything. A caller says they are from the IRS, says there is a warrant, says to stay on the line and not tell anyone, and asks for $2,000 by instant transfer. The person logs in with their own credentials and pays. By the time family hears about it, the money is gone.
Lookout is a payment pause I built for the PayPal AI Hackathon 2026, on the PayPal sandbox. No real money moves. It sits between PayPal's approve step and the capture. Orders are created with intent AUTHORIZE, so after the person approves on PayPal's page the money is held but not captured. Lookout scores the attempt and picks one of three outcomes:
- Allow captures right away.
- Verify waits for the person to confirm.
- Hold waits for a trusted contact.
A denial, a cancel, or no answer within 10 minutes voids the authorization. In the demo, Rosa is the account holder and Maya is her trusted contact.
The score is a table, not a model
Every signal is worth a fixed number of points, and the total decides the outcome: 0 to 39 is allow, 40 to 69 is verify, 70 and up is hold.
| Signal | Points | Where it comes from |
|---|---|---|
| New recipient | 15 | Payment history |
| Unusual amount (over $200 and more than 1.5x the largest past payment) | 10 | Payment history |
| Irreversible method (instant transfer, wire, gift card, crypto) | 15 | The payment |
| Authority claim (IRS, Social Security, tech support, bank fraud team) | 10 | The words |
| Threat or reward (arrest, warrant, frozen account, a prize) | 15 | The words |
| Urgency | 10 | The words |
| Secrecy | 15 | The words |
| Request for gift cards, codes, a wire, or remote access | 15 | The words |
| Still on the phone with them | 10 | The person says so |
| Pulse or breathing up from a baseline | 10 | Camera reading, only after a baseline exists |
| The reason they gave for the payment ranks as threatening | up to 15 | A ranking that updates from past approvals and denials |
| Number reported as a scam by other people | 20 | Shared reports |
The largest single signal is 20 points, so one signal on its own cannot even reach verify, let alone hold. There is a test for exactly that: it turns on each signal alone and checks that the outcome stays allow.
I made that choice because single signals misfire all the time. A real tax bill says "IRS." Every new plumber is a new recipient. A big purchase is an unusual amount. The scam is the combination, so the rule only acts on combinations.
Here is the IRS script from the demo, against a wallet whose largest past payment was $900:
- The words alone (authority, threat, urgency, secrecy) add up to 50. That is verify.
- The payment alone ($2,000 to a new recipient by instant transfer) adds up to 40. Also verify.
- Together they reach 90, which is a hold.
A $140 electric bill to a payee Rosa has paid before, sent by bank transfer, scores 0.
The model only reads the words
Gemini labels the five message patterns. It returns a JSON object of true or false flags, each with one plain sentence of reason, at temperature 0, and the prompt tells it not to give a score. With no key, or if the call fails, offline keyword rules in English and Spanish label the same five patterns. The IRS tests run on the offline rules, so the demo holds with no model at all.
The model can change which flags fire. It cannot change what a flag is worth or where the thresholds sit, and the reasons the person sees come from the same fired flags, so every hold can say why.
One rule that skips the score
At checkout, Lookout writes down what the person or their AI agent was shown: the amount, the payee, a hash of the page, and the message that asked for the money. After PayPal authorizes, it compares PayPal's amount, currency, and payee with that record. Any mismatch forces a hold, whatever the score. The comment on that function in the code says the model never gets a vote on this one.
This is the rule I expect to matter most as agents start paying for people. An agent can be shown one invoice and approve a different payee, and no reading of the words will catch that. Comparing two sets of facts will.
What the trusted contact sees
Maya sees PayPal's amount and payee, not the caller's or the agent's words, so a convincing script cannot talk her into approving. Verification codes and passcodes are redacted from the message before anyone else sees it. Rosa cannot release a hold herself. Only Maya's approval captures the money.
How I would build this on AWS
Lookout ran on the PayPal sandbox, Gemini, and a single docker-compose host, so none of it touches AWS. This is how I think it maps over, going by the documentation. I have not built it.
| Lookout piece | What it does | What I would try on AWS |
|---|---|---|
| The hold | Waits for Maya, voids after 10 minutes | AWS Step Functions with the .waitForTaskToken callback pattern and TimeoutSeconds on the task. Maya's answer calls SendTaskSuccess or SendTaskFailure, and the timeout path voids. |
| Reading the words | Five yes or no labels | Amazon Bedrock with a JSON schema, or Strands Decider 2B |
| The score | A fixed table and thresholds | Plain code in an AWS Lambda function. There is no reason to move it into a model. |
| Telling Maya | Lets her know a payment is waiting | Amazon SNS text messages |
Strands Decider 2B is an interesting fit, because the five labels are typed yes or no questions about one piece of text, which is the shape it is built for. It returns calibrated probabilities instead of booleans, and that raises a question I have not settled. I could threshold each probability into a flag and keep the table exactly as it is, or scale each signal's points by its confidence. The first keeps every hold explainable. The second uses information the table throws away.
If you have built a hold-and-approve flow, how did you handle the trusted contact not answering: void after a timeout like Lookout does, or fall back to a second confirmation from the person?
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article