Executive Summary

Key figures

Source: Traister et al. (2026), arXiv:2608.24127 §4.1–4.5

“Unfortunately, the only way we can look up your credit report is by your social. That’s the only way.” The paper opens on that fragment of a call. The caller who said it believed he had reached a consumer who had asked for an insurance quote online. The name and date of birth on the request belonged to no one, and the voice hesitating over the number at the other end was a language model.

Phone fraud research has mostly stood in one of two places. Complaint databases preserve the fact that a scam happened and how much money was lost. Passive telephony honeypots preserve which number dialed how many times. The conversation itself is rarely captured, because a call nobody answers leaves no script behind.

This honeypot does not wait. It submits its own numbers into the online quote forms of the auto insurance, health insurance, Medicare, auto-warranty, home-security and debt-relief verticals. The lead that results is bought, bundled and resold by data aggregators, and part of that market reaches boiler rooms and outright fraud operations. Whatever calls in is answered by an agent stitched together from speech-to-text, a language model and text-to-speech. It replies within a median of 1.16 seconds, accepts every claim the caller makes, and stalls with questions. It never hangs up first.

Collection ran for 54 days, from 28 May to 21 July 2026, and then stopped. So this paper describes a closed corpus rather than a snapshot of a live feed. Real traffic came to 10,211 calls, 913 hours of audio, 330,956 transcribed turns and 5,780 distinct originating numbers. Of those, the 6,619 calls carrying two or more turns were analyzed as conversations.

The first question is a simple one. Do scammers keep office hours? Averaged over the collection window, weekdays drew 253 calls a day and weekend days drew 38. A 6.6-fold difference. Volume concentrates in daylight hours and falls close to zero overnight. Plotted on the US Eastern axis it climbs as the East Coast opens and tapers only as the West Coast closes. It moves like the output of an organization on a schedule rather than like noise running automatically around the clock.

The second question is whether those calls are each a different scam. The researchers collected 5,916 openings from calls with substantive conversation and clustered them with TF-IDF and k-means. The silhouette score picked thirty clusters. Those openings came from 3,652 distinct numbers, and the five largest clusters accounted for 50% of all openings. Ten covered 70%, fifteen covered 84%. The median cluster was dialed from 102 numbers, and the largest had 685 numbers reading the same script.

The catalog is easy to recognize. Insurance-quote callbacks, Medicare benefits and recorded-line Medicare robocalls, diabetic supplies, auto insurance, debt relief, tax and IRS relief, life and final-expense insurance, home warranties, window replacement. One vehicle-service-contract pitch read the seeded car back to the target. Two clusters holding 1,403 openings named no vertical at all, and were labeled mixed rather than given an invented name.

Reading down that list raises an objection. An insurance-quote callback does not sound like fraud. The authors answer twice. First, no consumer ever filled in that form. Second, most of this traffic is spam by their own definition rather than scam. Of the 6,374 calls that received a holistic verdict, 3,949 were spam, 949 scam, 380 legitimate and 1,096 unsure. The difficulty is that the same opening ends as an ordinary sales transfer in one call and as a Social Security number request in another. At the moment you pick up, the two are indistinguishable.

The researchers turned that claim into a benchmark. The task runs like this. Given only the first k lines a scammer speaks, predict whether this call will later reach a request for sensitive information. Scoring happens on a caller-disjoint split, because a single number places as many as 79 calls and a random split would let a model memorize one caller's phrasing. Of 6,374 calls, 1,115 reach a sensitive request, so the base rate is 17.5%.

A bag-of-words classifier, TF-IDF with logistic regression, reached 0.72 ROC-AUC from the opening line alone. By the third line it reached 0.78 and by the eighth 0.87. On average precision, the more honest metric when positives are rare, it climbs from 0.36 to 0.58. Five-fold cross-validation drew the same shape, 0.69 to 0.87.

What makes the result useful is the ladder rather than the score. The team lined models up in order of increasing capacity and scored them on the identical split, and no rung beat the bottom one. Instead of the positive result they expected, a negative one came back, and the authors wrote that they consider it the more valuable of the two. The middle rung, frozen sentence embeddings, tracked the bag-of-words baseline a little below it. The upper rung, Qwen2.5 at 0.5B and 1.5B fine-tuned with low-rank adaptation, was marginally ahead over the first three lines, with average precision of 0.46 against 0.43. That flipped as more of the opening became visible, and by the eighth line it ended at 0.82 ROC-AUC against the bag-of-words 0.87. Model capacity buys essentially nothing on this task, in the authors' own words.

For defense, which model won matters more than the score. A linear classifier over word n-grams fits in a few megabytes, scores a call in microseconds and needs no accelerator. It runs inside the handset and inside the carrier's switch. So content-based early detection can cheaply cover the exact ground where metadata blacklists lose to constant number churn.

The authors put on record that this result overturns their own earlier reading. On a smaller snapshot with a looser label, the language model had looked ahead. The advantage did not survive a corpus a third larger and a labeling scheme closer to human judgment. They did not tune the fine-tuned models extensively, so the honest claim is not that a language model cannot win here, but that it does not win for free. On the lighter task of identifying the scam type from the same openings, accuracy was 60% from the first spoken line and 72% by the third. The majority baseline is 49.7%.

Calls with at least one request came to 2,654. Inside them, the most frequent item was not a payment credential. A home address appears in 1,722 calls and a date of birth in 1,518, far ahead of Social Security numbers at 526. Credit cards came to 387, Medicare identifiers 278, and bank routing details 224. Direct money transfers were asked for in 123 calls and gift cards in 10. An address and a date of birth are the raw material of identity theft, and the qualification material that lets the next call aim more precisely.

The pressure applied also runs against the stereotype. Overt threats and deadlines were rare. Far more common were persistence, which means returning again and again to a request the target deflects, and the assumption of authority. The researchers counted these two related tactics separately. One is posing as a specific named institution: an insurer or company, a government agency such as the IRS or the Social Security Administration, or a bank. The other names no institution at all and merely asserts an official capacity, a verification officer or a compliance department, to manufacture an official impression.

The call quoted at the top is the type case. When the agent hesitates and says it does not usually give out a Social Security number over the phone, the caller does not raise his voice. He answers that there is no other way to look it up. Turning a request into an administrative necessity rather than a threat is the dominant style in this corpus.

If everything so far is observation, the last question is an experiment. Does it matter who picks up? From 1 to 20 July the honeypot ran ten identities at once, from 22-year-old Emma to 62-year-old Declan, differing in name, voice, sex, accent, home city and date of birth. All ten share one area code, one speech-to-text engine, one language model, one text-to-speech vendor and, above all, an identical behavioral protocol. The only thing that differs is the identity block.

Every time the seeding pipeline submitted a form, one of the ten was drawn uniformly at random. Which identity a fraud operation reaches is fixed at the moment the lead is manufactured, weeks before the call. The caller can neither know it nor influence it until the lead is read. This is the correspondence-audit design economists use to measure hiring discrimination, run with leads instead of applications and criminal operations instead of employers. Assignment worked as intended. Seeded forms per identity ranged from 4,546 to 4,745.

The window produced 1,823 calls from 1,096 distinct numbers. Mean scammer turns per call rose with the identity's stated age. Rank correlation was +0.83, and the p-value of 0.005 comes from enumerating all 3,628,800 reassignments of the ten age labels. The 26-year-old identity drew 33 turns and the 62-year-old drew 71. Words spoken and the share of calls running past ten minutes moved the same way. A call-level negative-binomial model put the rate ratio at 1.152 per decade of apparent age.

A blunt cut makes the gap easier to see. The five identities aged 29 or under drew 39 turns per call and the three aged 42 or over drew 58, a factor of 1.5. The total time absorbed came out similar despite the unequal number of lines. The three older lines took 127 hours across 645 calls, and the five younger ones took 123 hours across 836. Per line, the older-sounding ones absorbed about 70% more of the fraud industry's time.

What was asked for did not move. Across all ten identities, 26.3% of calls reached a request for sensitive information, and that share was unrelated to age. Rank correlation was −0.02 and the odds ratio 0.99 per decade, with a confidence interval running from 0.90 to 1.08. The five identities aged 29 or under sat at 25.7% and the three aged 42 or over at 26.8%, one percentage point apart, with the interval ruling out anything larger than about five points. Of the nine individual request types, including Social Security numbers and dates of birth, none varied significantly with age. Narrowing to the situations where a request is plausible at all changes nothing. Among calls that got past twenty scammer turns the rate rises to 43%, and its correlation with age is +0.03.

Where the effect lives matters as well. The median call did not move with age, at a rank correlation of +0.35 and a p-value of 0.31. What changed is the probability that a call becomes a very long one. Among the youngest four identities, 9% of calls ran past a hundred scammer turns and 4% past a hundred and fifty. Among the oldest three the figures were 17% and 10%. The ordinary call did not stretch. Fraud operations simply grew more willing to stay on the line when a call seemed to be going well. The classifier that scores how calls end points the same way. The share of calls the caller appeared to believe had succeeded rose with identity age at +0.71, a result the authors marked as marginally significant at p = 0.027.

There is one misreading the authors went out of their way to block: the conclusion that scammers go easy on younger-sounding targets. Among eleven persona-level outcomes they examined, one exploratory result runs the other way. The share of a line's calls classified as outright fraud rather than legal lead generation fell as apparent age rose. The 22-year-old identity sat at 42% and the three oldest between 18% and 23%, at a rank correlation of −0.69 and p = 0.035. Younger identities drew more student-loan, tax-relief and debt pitches, which the rubric codes as identity harvesting, while older ones drew Medicare and insurance sales, which it codes as spam. The authors also record a competing explanation they cannot exclude. Shorter calls give the labeler less sales-pitch context to see, so part of the difference may be an artifact of call length rather than a fact about the market. Either way, the younger identities were not spared. They were asked for the same things at the same rate, in calls that were merely shorter.

The authors also mark the places where the result could wobble. All four female identities are under thirty, so age and sex are entangled. Adjusting for sex halves the effect without erasing it, and the six male identities alone still leave a rate ratio of 1.083. Female identities were accused of being a machine twice as often, which looks like a voice-realism problem and was unrelated to identity age. One identity, the 33-year-old Amir line, stands out with a 40% request rate. It alone makes the ten-identity contingency test significant, and with that line removed the test is no longer significant. The authors attribute this to their own agent. Amir's written biography makes it unusually eager to cooperate with anything official, so it hands callers more openings. The honeypot is a participant in these conversations, not a camera.

The robustness checks held up. Dropping each identity in turn leaves the correlation at +0.77 or above. Excluding the four days of a speech-to-text outage gives +0.79, weekdays only gives +0.84, and one call per distinct originating number gives +0.86. With pretext-vertical fixed effects the rate ratio is still 1.137 per decade, which shows the effect operates within a vertical rather than across verticals. The limits are stated too. Ten treatment arms leave the design underpowered for subtler effects, the sample skews toward the English-language US lead market, and the labels are machine-generated rather than fully hand-checked. Those labels agreed with human reviewers on 75% of binary judgments. The 74-year-old line that ran before the experiment is excluded because its lead pool had a different character, and the authors ask readers not to extrapolate the age gradient beyond 62.

The paper reads the elevated harm to older adults differently. Scammers are not asking older people for different things. They are asking for the same things for far longer. With exposure held exactly constant by construction, the only difference left was time. This is a preprint that has not yet been peer reviewed, and the corpus itself is documented in a companion data descriptor. The original is at arXiv:2608.24127.