A phone scam does not succeed simply because someone answers an unfamiliar number. It succeeds during the conversation. A caller poses as a bank or security team, claims an unauthorized transfer has occurred, and pressures the person on the other end to make a payment.

The scale of the problem is substantial. According to the FTC figures cited in the WiLine Workforce use-case document, reported U.S. fraud losses reached $15.9 billion in 2025, up 27% in a year. The document also cites the FBI IC3’s 2025 report, via HousingWire, for $7.75 billion lost by Americans aged 60 and older, with an average loss of $38,500 per victim.

Caller-ID filters assess the number before a call begins. Post-call analytics review the recording after it ends—potentially after the money has already gone. WiLine Workforce adds a different layer: AI-powered monitoring of the conversation while it is happening, when an operator can still intervene.

The phone system streams the live transcript into WiLine Workforce. An AI agent repeatedly reads the conversation so far, assigns a risk score from 0 to 100, and messages the operator with the risk, the reason, and the next step. In a scripted test call, the agent remained at zero through the greetings, marked the call Suspicious when the caller claimed unauthorized transfers, and reached a confirmed gift-card or payment-scam verdict by the end of the 92-second call.

Original live-call illustration from the WiLine Workforce use-case document.

Why the conversation matters more than the caller’s number

A spoofed number, a newly created number, or even a call from a real business line can still carry a scam. WiLine Workforce judges what is said rather than relying on the number alone. Its real-time monitoring is designed to surface warning signs before someone reads out codes or a transfer clears.

The use-case document contrasts this approach with three familiar defenses. Caller-ID and spam filters look at the phone number and act before the call. In that comparison, spoofed or new numbers can be missed, and number filtering does not explain the suspicious conversation, guide the operator, or adapt through business-specific agent instructions.

Post-call speech analytics examine the recording, often hours to days later. They may identify suspicious content, but too late to help during that conversation. The document describes their explanations as partial, integrations as variable, and business-specific customization as potentially requiring costly projects. They do not provide live guidance about what the operator should say next.

Staff training depends on an individual recognizing the warning signs. It can sometimes catch scams involving spoofed or new numbers, but intervention happens only if someone notices. Guidance is delivered through training rather than a live assistant, and adapting it requires further training cycles rather than simply editing an agent’s instructions.

WiLine Workforce evaluates the live conversation within seconds. It returns a verdict, risk score, named scam type, and supporting transcript evidence. It can send results to HTTP endpoints and connectors, suggest what to say next, and answer the operator’s questions. Teams can tune the agent to their business without writing code.

How the source document compares live conversation monitoring with other defenses.

How live audio becomes an actionable alert

Live call scam detection is built from standard WiLine Workforce components: Sockets, Agent Flows, AI Agents, and Actions. The phone system supplies the transcript, a socket manages the incoming data, an Agent Flow runs the scam-detection agent, and an action delivers the result to the operator and the configured alert channels.

The original live-call workflow. Agent runs took 1.9–4.7 seconds in the scripted test call.

The process repeats as the conversation develops:

1.    The call opens. A call_start frame supplies the caller, extension, channel, and source, identified as via: sip-to-ai.

2.    Completed sentences arrive. The SIP-to-AI bridge streams each finished sentence as a final frame containing its text, speaker, timing, and confidence. The ingestion pipeline retains the associated call metadata and filters out empty or technical frames.

3.    The socket triggers the flow. Frames are grouped by call. When enough new conversation has arrived, the socket starts the Agent Flow with the transcript so far, according to the configured run rules.

4.    The agent reassesses the whole call. It rereads the accumulated conversation, returns a verdict, a 0–100 risk score, and a scam type, and decides whether an alert is needed.

5.    An action delivers the alert. If the agent decides to alert, the action posts the report with variables such as {{report}} and {{call_id}} filled in.

6.    Monitoring continues until hang-up. New lines trigger further assessments using the longer transcript. When the call ends, it is closed and marked Reported.

In the test call described in the document, each agent run took 1.9–4.7 seconds to rescore the conversation as new lines arrived. That is the processing time for an assessment, not the total time needed to reach a confirmed scam verdict.

An assistant for the operator, not just a risk score

Real-time monitoring is useful only if the person handling the call receives the warning in time. WiLine Workforce therefore pairs detection with an operator assistant.

When the risk changes, the assistant sends a message with three parts: the risk level, the reason—quoting the relevant caller statement—and what to say or do next. While the call is classified as Legitimate, the operator is not interrupted.

Illustration based on the 6 October test call. Risk scores and timings are from that call; operator questions are examples.

The document’s operator-chat illustration shows how this works. At a risk score of 50, the assistant flags a possible scam because the caller claims to be from a security team and refers to “three unauthorized transfers.” The suggested next step is not to confirm account or card details. Instead, the operator is advised to ask for the caller’s name and callback number and say they will call back using the number on file.

The assistant also supports two-way chat. An operator can ask, “He says it’s urgent. Could this be a real bank?” In the illustration, the AI responds that a legitimate fraud team would not ask someone to pay, move money, or read out gift-card codes to fix a transfer. It advises the operator not to act on the incoming call and to verify using a number they already have.

When the risk reaches 100, the illustrated message identifies a gift-card or payment scam, recommends ending the call, and says the report has been sent to loss prevention. The operator can then ask for a report summary. The example summary describes a 92-second call in which someone posing as “Michael” from a security team claimed three unauthorized transfers and pushed for payment, with a final scam verdict and a risk score of 100.

Other questions might include “What did he say about the transfers?” or “Summarize this for my report.” The assistant answers using the live transcript and the organization’s own procedures. Messages can reach the operator through WiLine Workforce chat, Slack, or SMS. At high risk, the same flow can notify a supervisor or fraud desk.

The illustration is based on the 6 October test call. Its risk scores and timings come from that call, but the operator’s questions are examples—not a record of an actual operator exchange.

The operator remains in charge. The AI explains its assessment and suggests the next step; it does not end calls or block payments by itself.

What happened in the 92-second test call

On 6 October 2026, a scripted scam call reached a WiLine demo line. The caller, presenting himself as “Michael” from a security team, claimed three unauthorized transfers and pushed for payment.

Risk progression during the 92-second scripted demo. One point per agent run; plotted run times are approximate to within two seconds.

The agent’s first three runs saw only greetings. Run 1 read three transcript lines, Run 2 read five, and Run 3 read nine. All three returned a Legitimate verdict with a risk score of 0. There was no false alarm during the small talk in this test.

At approximately 11:33:59, the caller referred to “three unauthorized transfers.” The next assessment, Run 4, read 12 lines and changed the verdict to Suspicious, with a risk score of 50. That warning came before any payment request. Runs 5 and 6 remained Suspicious at 50; their line counts are not specified in the document.

When the caller pushed for payment, the risk rose from 50 to 100. Run 7 read 19 lines, returned a Scam verdict, and identified the final scam type as gift_card_or_payment_scam. The alert action sent the full report. The call ran from approximately 11:33:10 to 11:34:32—92 seconds from the opening greeting to the final confirmed scam verdict.

Original run-by-run results. This scripted demo validates the pipeline; real-traffic accuracy is measured separately per customer.

The test demonstrates the intended sequence: remain quiet during an ordinary opening, warn when the fraud story begins, and deliver a specific verdict and report once the payment-scam behavior is apparent. The chart in the source document plots one point per agent run, with run times read from the call view to within about two seconds.

This was a scripted test on a demo line, used to validate the pipeline end to end. It is not a measurement of detection accuracy across real calls. Accuracy on real traffic is measured separately for each customer.

Alerts that fit the tools your team already uses

Detection does not have to remain inside a separate dashboard. An action can post the report, call ID, and transcript to an HTTP endpoint for a CRM, ticketing system, Slack, an SMS gateway, or a fraud desk.

Reusable alert actions support {{report}}, {{call_id}}, and {{call_label}} variables and include a built-in test button. Agent Flows can extend the pipeline with CRM lookups, ticket creation, and supervisor hand-off.

Teams can also inspect how a decision developed. The call view includes the transcript, a risk-over-the-call chart, every run’s verdict, and the raw frames. Line monitoring shows connections, frames, runs, and per-call state. Each assessment is explained through its verdict, numerical risk score, named scam type, and the transcript lines that triggered it.

Customization happens through the agent’s instructions. Teams can add the scams they encounter, adjust thresholds, or route high-risk calls to a supervisor without writing code. Model selection through WiLine’s own AI gateway lets them choose according to cost, accuracy, and data-residency requirements.

Scam detection runs on the same WiLine Workforce platform that powers WiLine’s chatbots, agents, knowledge bases, and automations. It is an extension of that platform rather than a separate operating environment.

Safeguards built into the platform

The live-call pipeline uses the platform’s existing safeguards. Every project is isolated per account, and its call data is scoped to that project. API keys and tokens used in actions are encrypted at rest, while secrets are redacted from stored run logs.

Outbound alerts can reach only the host configured for each action. Hard step limits and per-run budgets keep execution bounded, and a flow cannot run unattended until it has been explicitly approved.

Inbound webhooks support bearer authentication, shared-secret authentication, or HMAC signatures with replay protection. These controls sit alongside the secure socket ingestion used to receive the live call data.

Where live call scam detection can help

The use case applies anywhere a phone conversation can lead to money moving, sensitive information being shared, or someone being pressured into a fraudulent payment.

Use cases and alert recipients from the original WiLine Workforce document.

For telecom and Voice over Internet Protocol (VoIP) providers, the focus is impersonation and tech-support scams across subscriber lines. Alerts can reach the subscriber by SMS or the carrier’s network operations center (NOC).

For retailers and gift-card sellers, the risk includes callers pretending to represent a corporate office or security team and pushing staff to purchase gift cards. Alerts can go to the store manager or loss-prevention team.

For banks and credit unions, the targeted scenarios include fake fraud-department calls, account takeover, and push-payment fraud. Results can reach fraud operations or appear on the agent’s screen.

For healthcare organizations, insurers, and utilities, the document highlights fake billing demands and “account suspended” calls. Compliance and customer-service teams can receive the alerts.

For senior-living communities and caregivers, relevant scenarios include grandparent scams, distress scams, and government impersonation. Alerts can be routed to family members or care staff.

Help while there is still time to act

Caller-ID filtering, post-call analysis, and staff training each address a different part of the problem. WiLine Workforce focuses on the live conversation—the point at which a scammer’s story becomes a request for information, codes, or money.

By reassessing the transcript every few seconds, explaining changes in risk, and giving the operator a practical next step, it is designed to help teams respond while the caller is still on the line. The 6 October test illustrates that approach: no interruption during the greetings, an early warning when unauthorized transfers were claimed, and a specific scam verdict when the caller pushed for payment. The AI supplies the evidence and guidance; the person handling the call makes the decision.

Sources

This article is adapted from Live Call Scam Detection, the supplied WiLine Workforce use-case document. The statistics and test results above are retained from that document, which cites:

·      FTC testimony to the Joint Economic Committee, 25 March 2026: $15.9 billion in reported U.S. fraud losses in 2025. The document also reports a 27% year-over-year increase.

·      FBI IC3 2025 report, via HousingWire, 13 April 2026: $7.75 billion lost by people aged 60 and older, with an average loss of $38,500 per victim.

·      WiLine Workforce scam-detection test line, call of 6 October 2026: the 92-second scripted demo call, risk-score progression, agent-run timings, and final scam classification.