C:\ARCHIVE\R_002_RUKO\case_study.txt

R 002Trust & safety · Accessibility

Ruko

A warning people believe, at the second it matters.

Scammers rush parents into paying. Ruko is a safety layer inside a payment app. It pauses the payment, says plainly what will happen to their money, and puts family one tap away.

Ruko stop screen: a red Stop and You are about to PAY ₹5,000, not receive it, with a Hindi line, an arrow showing money going out, a Decline request button and Call Amit (son) first.
Role
Solo: UX research and product design
Research
6 interviews, aged 48 to 68
Platform
Android, inside a UPI payment app
Timeline
Oct 2026

Ruko is Hindi for “stop”. It’s a working name.

01TL;DR

Parents knew the rules. Under a scammer’s pressure they forgot them.

The problem

Scammers keep parents on the phone and rush them. Today’s warnings look like every other pop-up, so they get tapped away.

What I did

6 interviews with relatives aged 48 to 68 about their scams and who they trust, plus a test of three warning messages.

What I designed

A stop screen that names the money, explains why in their language, and offers one tap to call family.

If this exact message had popped up on my screen last year… my ₹4,000 would still be in my pocket today!
P4, family friend, 61, on the warning that names the OTP trap

02The scene

He knew banks never ask for an OTP. With 30 seconds on the clock, he read one out.

30 s P4, a retired officer, was told his bank KYC had expired. A caller asked for the “KYC verification number”.
In that moment of panic, you forget the rule that ‘banks never ask for OTP.’
P4, family friend, 61
Timeline of P4’s scam in six steps. A fake bank text arrives, a caller rushes him with 30 seconds, he reads out a debit OTP and loses ₹4,000, cuts the call before a second ₹25,000 OTP, then his daughter has him call 1930. A marker shows where Ruko would step in: an OTP arriving during a stranger’s call.

03Method

Six conversations with family aged 48 to 68: close enough to be honest, too close to be neutral.

Six participant cards. P1 aunt, 52, daily UPI user, fake electricity-bill text. P2 uncle, 56, daily user, fake buyer’s QR to receive ₹8,000. P3 aunt, 48, sometimes, prize-fee message. P4 family friend, 61, sometimes, fake bank KYC text and OTP; lost ₹4,000. P5 grandmother, 68, rarely, fake police call about her grandson. P6 uncle, 64, rarely, fake customs digital arrest call.
How

30-minute talks in Hindi and English about real payments and real scams, then three test warnings read aloud (in Hindi for P5).

Strength and bias

They told me things they’d never tell a stranger, like P4’s loss. But they come from one family circle, found by referral, and they may have been kind to my ideas.

04Scams they met

All 6 had met a scam. Fake “account blocked” texts and fake officers led.

Out of 6. One scam can carry several patterns.

Redrawn chat from P2’s fake buyer asking him to scan a QR and enter his UPI PIN to receive ₹8,000, and to stay on the call. The number and the QR are hidden.
P2’s fake buyer, redrawn
Redrawn texts from P4: a fake bank KYC warning, then the real debit OTP for ₹4,000, which the caller called a KYC verification number.
P4’s texts, redrawn

Every scam borrowed something real

4 of 6

An official look

“an army uniform photo… makes you respect the person” (P2)

4 of 6

A ticking clock

“Sir session will expire in 30 seconds” (P4)

3 of 6

Staying on the call

“He stayed on the phone line continuously” (P2)

2 of 6

Timing from real life

“just two days before, your uncle had paid the bill online” (P1)

2 of 6

Renaming the risky step

A debit OTP, called a “KYC verification number” (P4)

2 of 6

Keep it secret

“don’t tell anyone in your neighborhood” (P3)

05Who they trust

6 of 6 trust family first. The app is trusted only when it explains itself.

Trust map from most to least trusted. First call: family, 6 of 6. Trusted with conditions: the app, 3 of 6, if it actually locks the transaction and explains clearly why; the bank in person, 2 of 6. When no one is home: people nearby, 3 of 6. Not trusted: texts claiming to be the bank, bank logos on chat profiles, helpline numbers from search, English pop-ups.
I don’t know what ‘the app’ or ‘the phone’ is thinking, I only trust family.
P5, grandmother, 68

06What I got wrong

I thought the gap was knowing the rules. It was remembering them under pressure.

My assumption: people fall for scams because nobody told them the rules.

2 of 6 knew the exact rule and still nearly fell, or did fall, for the scam (P2, P4).
I have seen it 100 times, yet when that Army fellow was pressuring me on the call, my brain didn’t read the top banner!
P2, on the app’s “Never enter UPI PIN to receive money” banner
What changed

Ruko is not an awareness feature.

It repeats the rule at the second it is being broken, on the screen where it is being broken.

07The warning test

Asked which warning would stop them, 6 of 6 named the one that says where the money goes.

Three warnings side by side. Warning 1, generic, this may be a fraud, do not proceed: chosen by 0 of 6. Warning 2, Stop. You are about to PAY ₹5,000, not receive it: named by 6 of 6. Warning 3, This person asked for your OTP. Banks never ask for OTP. Call your son?: named by 5 of 6.
WarningWordingNamed itReactions
1 · Generic“Warning: this may be a fraud. Do not proceed.”0 of 63 would dismiss it, 2 would freeze, 1 would stop
2 · Names the money“Stop. You are about to PAY ₹5,000, not receive it.”6 of 6“This is 10 out of 10. It directly breaks the hypnosis.” (P2)
3 · Names the trap, offers a person“This person asked for your OTP. Banks never ask for OTP. Call [son] before continuing?”5 of 6First choice for P3 and P5. “like getting oxygen” (P5)

Each person heard all three, said what it meant and what they’d do, then said which would stop them. Some named two.

08Insights

Three insights, each heard more than once.

1 · Generic warnings get a reflex, not a reading.

“phones write so many things in English every day… So we get the habit of pressing ‘OK’ without reading deeply.” (P1)

  • 0 of 6 chose the generic warning
  • 5 of 6 have a habit for clearing pop-ups
  • 3 of 6 struggled with English like “proceed”
Four stacked pop-ups that all look alike: storage almost full, update available, security notice, and a fraud warning with Cancel and OK. A handwritten note reads Same box, same OK.

2 · A person, not a pop-up, ended 4 of the 6 scams.

“seeing my grandson’s name on the screen is like getting oxygen. I will press that button immediately.” (P5)

  • 4 of 6 scams ended by another person
  • 6 of 6 trust family first
  • 2 of 6 were told to keep it secret
How each scam ended. P1 said my son is coming and the caller hung up. P2’s daughter took the phone. P3’s son blocked the number. P5’s neighbour called the real grandson. P4 cut the call himself after ₹4,000 had gone. P6 recognised the scam from the newspaper.

3 · The amount can’t spot a scam. The live call can.

“Never allow a collect request or QR scan from WhatsApp to work while a person is actively on a phone call with an unknown number.” (P2)

  • 5 of 6 scams ran over a live phone call
  • ₹10, the smallest ask, was below any real recent payment
  • 3 of 6 don’t want checks on routine payments
A log-scale line of rupee amounts. Real recent payments sit between ₹65 and ₹820. Scam asks range from ₹10 to ₹30,000 and overlap with them; four of the five came with a live call.

09Design principles

Three rules every warning screen had to pass.

From the warning test: 6 of 6

Say what will happen to the money, in their words.

“PAY ₹5,000, not receive it.” In Hindi, and read aloud on request.

Insight 2: 5 of 6 chose it

Offer a person, not just a warning.

“Call Amit first”, by name, while the payment waits.

Insights 1 and 3

Step in at the risky moment only.

On a call with an unknown number, yes. On the ₹65 ironing bill, never.

Flow diagram. A payment goes request, check amount and person, enter PIN, money sent. Ruko checks just before the PIN pad. If a signal fires: the stop screen, then why it looks like a scam, then call family with the payment held, then decline or pay after a check.
Where Ruko steps in Ruko checks once, just before the PIN, and stays silent for everyday payments. Four signals already live in the payment app; two would need partner data.

A bottom sheet looked like every other pop-up. A full-screen stop won.

Grey wireframe of a bottom sheet over a payment screen, with Decline and Call family buttons.
A · Bottom sheet Lighter, but the Pay screen stays visible behind it.
Grey wireframe of a full-screen stop: PAY ₹5,000, an arrow from you to them, Decline and Call family.
B · Full-screen stop (chosen) The amount and its direction are the only things to read.
  • P2: “if it looks like an advertisement banner at the top or bottom of the screen, my eyes skip right over it.”
  • P3 panics over “which button is safe?” One screen, one safe button.
  • Full screen only for the stop moment, so it never becomes wallpaper.

10Final design

Name the money. Explain in their language. Hand them a person.

Ruko stop screen with PAY ₹5,000 not receive it, an arrow from you to an unknown person, Decline request and Call Amit (son) first.
1 · Request takes money out “PAY” in red, the amount huge, and an arrow for anyone who reads little English.
Warning shown during a call with an unknown number: Don’t share your PIN or OTP on this call, in English and Hindi.
2 · PIN asked during a call Names the caller’s trick. PIN entry pauses until the call ends.
Three plain reasons in English and Hindi, each with an icon, and a Listen in Hindi button at the top.
3 · Why this looks like a scam Three plain reasons with icons, never colour alone. Listen in Hindi.
Payment on hold. A large A avatar for Amit, your son, with a Call Amit button, a Message button, and a second contact, Priya.
4 · Call family first A named person, not “contact support”. Nothing is sent while they call.
Setup in three steps: who should we call, warning language Hindi with read-aloud on, and when Ruko should step in.
5 · Set up together Family had set up the payment app for 4 of 6 already.
It’s not your fault. Four steps: call the 1930 cyber crime helpline, tell your bank to block, block this number, and tell Amit.
6 · After a scam “It’s not your fault” comes first. Then 1930, the bank, and family.

Names and amounts in the screens are samples.

11Research to design

Research turned a pop-up people tap past into a stop they read.

Before: a small grey dialog saying This may be a fraud. Do not proceed. with Cancel and OK, over a ₹5,000 payment request. After: the Ruko stop screen with four numbered changes.
  1. The money and its direction come first. “Number 2 tells me the exact rupee amount going out.” (P1)
  2. An arrow, not a word like “proceed”. 2 of 6 stumbled on “proceed”.
  3. Their language, spoken aloud. Asked for by P1 and P5.
  4. One safe main button, and a person. The generic warning “just scares you without telling you what to do next.” (P5)

12Measuring success

Success is scams stopped, not warnings shown.

What I’d measureHowSignal of success
Risky payments stoppedShare of warned payments declined or checked with familyHigh, and holding
False-alarm rateShare of warnings on payments confirmed as genuineLow, and falling
Family call-throughShare of stop screens where the trusted person is calledRising after setup
Losses after “pay anyway”Reports to the bank or 1930 after a warned payment went aheadClose to zero
The risk: warning fatigue

If Ruko fires on the ₹65 ironing bill, it becomes one more “storage full” pop-up, and the real stop gets tapped away too. Every false alarm spends trust the next warning needs.

Guardrail

Never block people from their own money without a way forward.

13Next and learnings

Next: test the stop screen with people outside my family.

01

Usability test with 5 people aged 45+.

Spot a “receive” request that pays out, call family from the stop screen, recover after a scam.

02

Recruit beyond family.

Other cities and languages, and people who have lost money.

03

Check feasibility with a bank.

The OTP-during-a-call and reported-account signals need partner data.

What I learned: designing for people unlike me meant borrowing their words and their trust. The best copy in this project is “paise kat jayenge” (money will be cut from your account), and the best button is a son’s name.

Next folder / B 003

Berth →

The one answer a train traveller needs right now: where to stand, and when to wake.