Data model
What one analyzed call contains, and the scam-type taxonomy that
organizes the corpus.
How data is produced
Each inbound scam call is transcribed, then an LLM extractor turns the transcript
into a structured record. The record groups intel into seven areas, plus provenance
the pipeline stamps on. These fields appear (as applicable) in transcript detail, the
Tier-1 table, exports, and agent answers.
Confidence & grounding. Each record carries an
auditor_confidence (0.0–1.0). "High confidence" means ≥ 0.7. Monetary
figures are grounded to what the scammer actually demanded — see
Money fields.
Record structure
Provenance & scoring
| Field | Description |
|---|
call_sid | Unique call identifier (used everywhere to link to a call). |
call_started_at / call_ended_at | Call window (UTC). |
auditor_confidence | Extraction confidence, 0.0–1.0. |
extractor_model | Model that produced the record. |
event_classification — what the scam was
| Field | Description |
|---|
scam_detected | Whether the call was a scam. |
impersonated_brand_or_entity | Brand/entity the scammer claimed to be. |
lure_category | Per-call lure label (see note below). |
fraud_pretext_narrative_summary | Short narrative of the pretext. |
attacker_environment — who / how
| Field | Description |
|---|
linguistic_profile | Accent / phrasing / call-center tells. |
background_noise_reported | Ambient signals (call-center chatter, etc.). |
opsec_failure_flag | Slip-ups the scammer made. |
attack_cadence_and_escalation | Pacing / pressure escalation. |
infra_ephemeral — throwaway infrastructure
| Field | Description |
|---|
scam_did_number | The number the scam called from / for callback. |
caller_id_display_string | Spoofed caller-ID text. |
fake_case_or_badge_number | Fake case/badge id used for authority. |
burner_voip_provider_suspected | Suspected VoIP provider. |
infra_sticky_digital — reused digital infrastructure
| Field | Description |
|---|
phishing_url_or_domain | Phishing URLs / domains named. |
remote_desktop_app_requested | RDP tool pushed (AnyDesk, TeamViewer…). |
remote_desktop_session_id | Session id if given. |
malicious_meeting_id | Meeting id if given. |
infra_sticky_financial — the highest-value intel
Where the money is meant to go. These fields drive the Tier-1 table and exports.
| Field | Description |
|---|
monetary_ask_amount_usd | Grounded dollar amount the victim was told to pay/send (null unless an explicit amount was stated). |
requested_payment_method | How they wanted payment (wire, gift card, crypto…). |
mule_bank_name | Destination bank. |
mule_bank_routing_number | Routing number. |
mule_bank_account_number | Account number. |
mule_account_holder_name | Name on the mule account. encrypted at rest |
crypto_wallet_address | Destination wallet. |
crypto_chain | Chain (BTC, ETH…). |
gift_card_brand | Gift-card brand requested. |
physical_mule_drop_address | Physical drop address. encrypted at rest |
healthcare_govt & natsec_le — vertical enrichment
| Field | Description |
|---|
impersonated_government_agency | Agency impersonated (IRS, SSA…). |
fraud_typology | Healthcare/government fraud typology. |
impersonated_physician_npi | Physician NPI if cited. |
dme_supplier_shell_company | Durable-medical-equipment shell. |
law_enforcement_sting_viability | HIGH / MEDIUM / LOW. |
state_sponsored_narrative_tag | Nation-state pretext tag, if any. |
Two display-only PII fields — mule_account_holder_name and
physical_mule_drop_address — are field-encrypted at rest and decrypted
only when served to authorized readers. All data is additionally encrypted at rest
at the storage layer.
Scam-type taxonomy
Calls are bucketed into scam-type categories. These bucket keys are what you use in
the scam-type leaderboard, campaign filters,
and entitlement scoping. Current baseline buckets:
| Bucket key | Label |
|---|
TAX_DEBT | Tax debt (gov) |
GOVT_IMPERSONATION | Government impersonation |
HEALTHCARE_BENEFITS | Healthcare / benefits |
AUTO_WARRANTY | Auto warranty |
INSURANCE_ACCIDENT | Insurance / accident |
UTILITY | Utility |
BANK_FRAUD | Bank fraud |
TECH_SUPPORT | Tech support |
PRIZE_SWEEPS | Prize / sweepstakes |
OTHER | Other / unclassified |
The taxonomy is
living — new categories can be minted automatically as novel
scam types emerge. Treat the list above as the current baseline, not a closed set;
read available buckets at runtime from
the scam-type leaderboard or
/api/kpis/taxonomy-coverage.
Note: event_classification.lure_category is a separate, per-call label
with its own value set (e.g. GOVT_IMPERSONATION, TECH_SUPPORT,
ROMANCE, CRYPTO_INVEST, BANK_FRAUD, …) — don't
confuse it with the scam-type buckets above.