SpoofShield (browser+mobile)

Who it's for

Individual consumers in countries with STIR/SHAKEN or robust regulator complaint portals (e.g., US, UK, EU member states); today they use carrier call-blocking, Do Not Disturb apps, or manual complaint forms on regulator sites as a substitute.

The problem

Time + legal friction: users waste hours dealing with repeated spoofed/robocalls, struggle to document evidence for complaints, and regulators require specific packetized evidence (call metadata, timestamps, originating number) that consumer apps don't collect — so most spoofing goes unreported.

How to build it

A browser extension (Chrome/Edge) that scans web pages/email for clickable tel: or tracking links and a tiny mobile webhook app (iOS/Android) that collects incoming-call metadata (via user-granted permissions or carrier SMS callback) to verify STIR/SHAKEN attestation and present a one-click 'Block + File Complaint' flow that submits a regulator-compliant packet (JSON + .pcap-like call metadata) via HTTPS.

How it makes money

Freemium consumers: free core blocking + 3 free complaint filings/month, $3–7/mo for unlimited filings, advanced export, and multi-device sync; small consumer-advocacy orgs pay $30–100/mo for team dashboards and CSV exports of incidents for regulatory campaigns. They pay because regulators accept documented complaints and organizations need exported evidence; a free option is too limited (rate-limited filings and no CSV/export).

Why it doesn't exist yet

Incumbent carriers don't expose easy, standardized attestation APIs to third parties; platform vendors avoid call metadata hooks for privacy reasons; regulators accept rich evidence but lack easy consumer tooling. An indie can glue existing public STIR/SHAKEN attestation sources, open carrier reputation lists, and regulator web forms with a compact UI — the coordination and lightweight UX glue is what's missing.

First users

Early users: US/EU privacy-activists and people on call-blocking subreddits will adopt for immediate relief; journalists covering robocall stories will use it to produce evidence packs; small advocacy groups will promote it as an easy reporting tool — all attracted by the promise 'block + file complaint in 60s' and hands-on evidence generation.

Build size

2 people x 10 weeks: includes browser extension UI, small mobile webhook app, STIR/SHAKEN attestation aggregator (serverless), complaint-form automations for 6 country regulators, and subscription/payments. Excludes carrier-level deep integrations or native dialer replacements.

Biggest risk

If major mobile platforms or carriers expose native per-call STIR/SHAKEN UI + one-click complaint filing, the indie loses its core advantage; alternatively, regulators could standardize and publish their own complaint API that incumbents bundle into carrier apps.

Conditions for a hit (all 3 required)

• Verified-block list: for any incoming call or clicked tel: link, the product shows an attestation status (e.g., 'Full STIR attestation', 'Partial', 'No attestation') and a risk score computed from 3 public signals within 3s of event.
• One-click complaint packet: produces and submits a regulator-ready JSON packet (caller number, timestamp, attestation, originating ASN, optional recorded call hash) to the regulator's web form or email endpoint within 60s, and returns a submission ID to the user.
• Evidence export: allows export of all incidents as a CSV/ZIP containing the raw JSON packets and a human-readable summary (max 10,000 incidents) so an advocacy org can import into spreadsheets or press releases within 5s.

How it's judged (in 6 months)

Chrome Web Store installs >= 10,000 OR Product Hunt daily top-5 launch OR 3 consumer-advocacy orgs on paid plan (publicly announced)(judgment date 2027-02-12)

AI self-confidence 55/100 — self-reported likelihood of meeting the criterion, not a business success rate