Real conversations between fraudsters and their targets are among the most informative artifacts for studying telephone scams, yet also the scarcest: passive honeypots overwhelmingly capture automated messages and hang-ups, large-scale studies characterize call metadata rather than dialogue, and manual scam-baiting does not scale. We present a dataset of real scam-call conversations collected by an active voice-agent honeypot. Dedicated numbers are seeded into the lead-generation channels fraud operations harvest; inbound callers are answered by a low-latency conversational agent that adopts a plausible target persona and sustains the interaction while every call is recorded, transcribed, and automatically labeled. Over an initial 53-day window we captured 10,015 inbound scam and spam calls (6,601 with two or more turns): roughly 895 hours of audio and 328,869 transcribed turns from 5,665 distinct originating numbers. Under a holistic classifier the substantive calls are predominantly predatory-but-legal lead generation ("spam", about three in five), while about one in seven is an outright "scam" (949 in this snapshot). Each call carries a turn-level transcript, three-channel audio, per-turn latency telemetry, and layers of automatic labels, including a holistic scam/spam/legitimate judgment corroborated by independent human review (75% agreement on the binary decision). We describe the collection system, the record structure, and technical validation of the corpus's realism and label quality, including that the agent is recognized as non-human in only about 5% of engaged calls. We also benchmark established scam-detection methods, where detectors trained on published synthetic dialogue collapse in precision on real traffic.
Figures & tables
Figure 1: Daily inbound call volume (bars, left axis) and cumulative total (line, right axis) over the 53-day window. Volume is weekly-cyclical—fraudulent lead generation operates during business hours, so intake craters on weekends—and trends upward as the seeded number propagates through resale lists.
Property
Value
Collection window
28 May – 20 Jul 2026 (53 days)
Total inbound calls
10,015
Substantive calls ( ≥ 2 turns)
6,601
Distinct originating numbers
5,665
Recorded audio
≈ 895 h (3-channel WAV)
Transcribed turns
328,869
Table 1: The corpus at a glance. Counts reflect real inbound traffic; development and self-test calls are excluded.
Figure 2: The three-stage collection pipeline. Seeding manufactures inbound volume by placing a honeypot number into lead-generation channels; engagement answers each call with a low-latency persona agent that sustains the conversation; capture and labeling records every call and assigns the label layers released with the corpus.
Figure 3: Distribution of call length over the 6,601 substantive calls. The mass at one-to-five minutes reflects lead-qualification pitches; the tail beyond twenty minutes reflects prolonged engagements.
Figure 4: Most-frequent behavioral signals assigned by the lenient classifier (calls may carry several). Blue: scam pretexts and tactics; orange: direct requests for personally identifiable or credential information.
Field
Type
Description
call_id
string
Pseudonymous call identifier.
caller_id
string
Pseudonymous originating-number identifier; groups calls placed from the same number.
persona
string
Honeypot persona that answered the call (11 distinct personas).
date
date
Date of the call; time-of-day is withheld.
duration_s
int
Call duration in seconds.
n_turns
int
Number of transcribed conversational turns.
Table 2: Schema of a released record. Every label layer described in the Collection System is retained, so the three notions of “scam”—lenient, strict, and holistic—remain separable by downstream users rather than being collapsed into a single flag.
Property
Value
Released calls
1,000 (500 scam / 500 spam)
Window
28 May – 19 Jul 2026
Transcribed turns
183,491
Turns per call (med/mean)
148 / 184
Duration (min/med/max)
4.8 min / 19.8 min / 4.0 h
Distinct callers
733
Table 3: The public release at a glance. Because the subset is selected for engagement length, these distributions differ by construction from the full corpus in Table 1 .
Figure 5: Holistic classification of the substantive corpus. The majority is predatory spam; about one in seven is an outright scam. Of the 949 scams, 552 reach an explicit credential request; the remainder defraud through payment demands, impersonation, or identity harvesting.
Figure 6: Conversational structure of engaged calls under the opening (left) and ending (right) taxonomies—a coarse behavioral fingerprint beyond the binary scam label.
Figure 7: Established methods benchmarked on the corpus. TF-IDF baselines ( Shen et al. 2024 ) reproduced on their synthetic data (grey, ROC-AUC/ F1 = 1.00), then applied unchanged to our real corpus (navy; caller-disjoint CV); a zero-shot LLM (orange) shown for comparison. Left: ROC-AUC; right: F1 at a 15% base rate.
Telephone fraud is pervasive and costly, but its inner workings are rarely observed at scale. We analyze a complete corpus of 10,211 inbound scam and spam calls -- 913 hours of audio and 330,956 transcribed turns from 5,780 distinct numbers -- collected over 54 days by an AI voice-agent honeypot that answered callers and kept them talking, and introduced in a companion data descriptor. We separate outright scams, which solicit sensitive information, from the larger stream of predatory but legal lead generation ("spam") that feeds them. Scam operations keep office hours (6.6x more calls per weekday than weekend day); thousands of disposable numbers run a small catalog of recycled scripts (thirty opening clusters, half the traffic in the top five); and callers solicit identity anchors -- a home address and a date of birth -- far more often than payment credentials, pressing through persistence and manufactured authority rather than overt threats. Our central experiment asks: does it matter who picks up? Every seeded lead carried one of ten fictitious identities drawn uniformly at random, so the identity a fraud operation reaches is fixed before the caller exists. Across 1,823 randomized calls, scammers spent about 15% more conversational turns per decade of the target's apparent age (rate ratio 1.15, 95% CI 1.08-1.23; randomization p = 0.005) -- yet what they asked for did not change (26.3% of calls reached a request for sensitive information; odds ratio 0.99 per decade, 95% CI 0.90-1.08). A second experiment casts early detection as a benchmark: from a scammer's opening lines alone, on a caller-disjoint split, escalation is predictable at 0.72 ROC-AUC from the first line and 0.87 by the eighth, and a plain bag-of-words classifier matches a fine-tuned on-device language model. Telephone fraud emerges as a templated industry that varies how hard it works a target, but not what it wants.
Conversational scams, such as romance and investment scams, are emerging as a major form of online fraud. Unlike one-shot scam lures such as fake lottery or unpaid toll messages, they unfold through multi-turn conversations in which scammers gradually manipulate victims using evolving psychological techniques. However, existing research mainly focuses on static scam detection or synthetic scams, leaving open whether language models can understand how real-world scams progress over time. We introduce PreScam, a benchmark for modeling scam progression from early conversations. Built from user-submitted scam reports, PreScam filters and structures 177,989 raw reports into 11,573 conversational scam instances spanning 20 scam categories. Each instance is hierarchically structured according to the scam lifecycle defined by the proposed scam kill chain, and further annotated at the turn level with scammer psychological actions and victim responses. We benchmark models on two tasks: real-time termination prediction, which estimates whether a conversation is approaching the termination stage, and scammer action prediction, which forecasts the scammer's subsequent actions. Results show a clear gap between surface-level fluency and progression modeling: supervised encoders substantially outperform zero-shot LLMs on real-time termination prediction, while next-action prediction remains only moderately successful even for strong LLMs. Taken together, these results show that current models can capture some scam-related cues, yet still struggle to track how risk escalates and how manipulation unfolds across turns.
Weixiang Sun, Shang Ma, Yiyang Li +5
University of Notre Dame · Arizona State University
Following the rapid progress of generative Artificial Intelligence, there is a growing threat posed by conversational scams. These scams often span over multiple weeks or months, gradually build trust and request for money or sensitive information. Existing scam-detection systems mainly focus on isolated messages, which renders them inadequate against this evolving threat. This paper extends single-message phishing detection and presents an explainable agentic system for detecting sophisticated conversational scams. It also introduces ConScamBench-278, an initial public multi-category benchmark for conversational scam detection spanning eight scam types, released to support reproducible evaluation and future expansion. On isolated messages the single-message detector attains 100% phishing recall, while the conversation-level detector identifies all conversational scams in the public LoveFraud02 corpus (83/83) and reaches 97.8% accuracy (95% CI [95.4, 99.0]) on ConScamBench-278. Two user studies (N = 100 and N = 45) further motivate the system: participants report frequently experiencing uncertainty when judging suspicious conversations. In an uncontrolled pre/post comparison, users self-reported trust, self-confidence, and perceived need for AI-based scam detection all increased (p < 0.001, Wilcoxon signed-rank). The system also receives a System Usability Scale score of 74.7 (95% CI [72.5, 76.9]), above the established usability benchmark.
Ahmed Omar Salim Adnan, Yogananda Manjunath, Shivanjali Khare
University of New Haven · M.S. in Data Science · Department of Electrical & Computer Engineering and Computer Science