How to detect vishing calls automatically

1. Relay and capture. Your phone system or carrier sends the call to the hop. It is forwarded unchanged to its destination. The media passes through a relay that captures each direction, so the recording has the caller on one channel and the callee on the other. Nothing is injected into the call.
2. Transcribe per channel. After hangup each channel is transcribed on its own, which gives a reliable CALLER: / CALLEE: label on every line without guessed diarization, with timestamps per segment.
3. Score the transcript. A language model reads the labelled transcript with the call's metadata and answers a fixed schema: a probability from 0 to 100, a category, the entity the caller claimed to be, how they identified themselves, numbered red flags each tied to something said, a telemarketing compliance note, a summary and a recommendation. A score above 70 needs a hard sign in the transcript: a request for money, cards, codes or credentials, a threat, a deadline, impersonation or remote access. A caller who merely fails to identify themselves is not, on that alone, a scam.
4. Deliver. The verdict is stored with the call, returned by the API, posted to a signed webhook, and sent by e-mail or to Slack when it crosses your threshold.
5. Act on the next call. An automation rule puts a flagged number under control. Its next call is refused with a SIP 403 or diverted to voicemail, a security line or an AI agent, for the window you set.

{
  "probability": 95, "category": "credit_card_scam", "recommendation": "block",
  "entity": "'Card Services fraud department' (no issuer or bank named)",
  "caller_identity": "'Andrew Martin', fraud department agent",
  "red_flags": [
    "1. Caller asks for the full card number, expiry and CVV to 'cancel a charge'.",
    "2. Five-minute deadline: 'the charge will post if we do not act now'.",
    "3. No issuer named; 'Card Services' is not a bank.",
    "4. Instructs the callee to stay on the line and not call the bank."
  ],
  "tcpa_comment": "Not a marketing call; impersonation for card data.",
  "summary": "A caller posing as a card fraud desk pressures the callee to read out card details under a deadline."
}

The transcript, the stereo recording, the SIP log and a PDF report stay with the call, and a password-protected share link puts them in front of a bank, an insurer or the police without an account. Six more scripts and their scores.