AegisDial
AegisDial (Sabr)
AegisDial is the only consumer app combining real-time fraud prevention and full recovery in one product. Prevention runs at the system level via four iOS compilation targets: a CallKit caller-ID extension that delivers verdicts before the user answers, an ILMessageFilter SMS extension that scans messages before they appear, the main iOS app, and a watchOS companion with an End Shield button and status tile. Recovery runs through a 52-type scam catalog where each scam type has a deterministic recovery sequence — the exact steps for that specific fraud, with FTC and IC3 complaint narratives pre-populated, an evidence locker for photos and documents, and an AI Companion powered by Claude Sonnet that provides voice-output guidance in plain language. All customer PII is encrypted at rest using AES-256-GCM. 35 hand-rolled database migrations. 111 tests passing before the first TestFlight build.
The Challenge
Consumer phone fraud costs Americans billions annually. The market is fragmented: Truecaller does caller-ID, RoboKiller blocks robocalls, AARP has a hotline, the FTC has a report form. None of them do recovery, and recovery is where victims are left completely alone. A product that prevents scams but has no recovery surface fails the exact users who need it most. The technical challenge matched the product scope. CallKit caller-ID extensions and ILMessageFilter SMS extensions cannot be shipped from a single app bundle — Apple requires separate compilation targets with their own entitlements and provisioning profiles. Shipping caller-ID verdicts in the incoming call interface, SMS filtering before message delivery, a watchOS End Shield button, and a full recovery surface from a single development effort required four targets sharing state via a Keychain access group.
Our Solution
Four native iOS targets (AegisDial, CallerIDExtension, SMSFilterExtension, AegisDialWatch) built in Swift, sharing credentials via a Keychain access group. A Flutter app for cross-platform coverage. A Fastify backend on Node.js 22 (TypeScript strict, ESM) with Postgres and Redis. Five prevention pillars: Live Shield (real-time Twilio Lookup V2 caller-ID with Redis single-flight locking for sub-1-second latency), SMS Filter (URL reputation via Google Safe Browsing), Safe-Words (guardian challenge flow to detect AI voice clone attacks), Breach Monitoring (Enzoic for email and phone exposure alerts), and Guardian Alerts (named guardian SMS with 5-minute escalation). Recovery: a 52-type scam catalog where each type has a deterministic recovery sequence with pre-filled FTC/IC3 narratives, a PhotosPicker evidence locker, step completion tracking, and a Claude Sonnet AI Companion with AVSpeechSynthesizer voice output. When 10+ users report the same pattern within 7 days, the system generates aggregate FTC/IC3 reports.
Results
Live on TestFlight. Full iOS product surface operational across all four compilation targets. 111 tests passing. 35 database migrations applied. AES-256-GCM encryption on all PII fields. Stripe subscription billing wired for Pro Annual, Recovery Session, Recovery Monthly, and Recovery Annual tiers. Developer B2B portal live at the marketing site.
What it does.
Live Shield
Real-time caller-ID verdicts in the incoming call interface via CallKit. Twilio Lookup V2 enrichment with Redis single-flight locking for sub-1-second latency on unknown numbers.
SMS Filter
System-level message scanning via ILMessageFilter before messages appear. URL reputation via Google Safe Browsing. Runs without the main app open.
Safe-Words Guardian Challenge
Challenge flow designed to detect AI voice clone attacks. Guardians verify a caller is real before any action is authorized.
52-Type Recovery Catalog
Each of 52 scam types has its own deterministic recovery sequence with pre-filled FTC/IC3 narratives, an evidence locker, and step completion tracking.
AI Companion
Claude Sonnet with recovery context and the victim's specific scam type. Voice output via AVSpeechSynthesizer. Knows what step the user is on and why it matters.
AES-256-GCM Encryption
All PII encrypted at rest before database write. Call transcripts, evidence files, AI messages, breach identifiers, session tokens. Database breach yields ciphertext.
Technical details.
Want one like it?
Tell us what you're building. We'll tell you straight whether we're the right shop.