An LLM-based Chain-of-Response Counter-Scam System

1 Introduction

Online scams have become a serious global threat driven by transnational criminal networks, causing substantial financial losses of innocent people and increasing the burden on law enforcement [Interpol, 2024]. Scammers employ sophisticated social engineering scenarios across calls, messaging

romantic partners, financial institutions, or authorities, inflicting severe psychological harm on victims [FBI, 2025; Yosiandra and Sakariah, 2024]. In this context, LLM-based agents specialized in social engineering content show strong potential as next-generation scam response technologies by enabling real-time detection and delivering warnings to victims [Shen et al., 2025; Kumarage et al., 2025].

∗Co-corresponding author

However, the practical effectiveness of these technologies is often limited by critical delays in institutional response. As shown in Figure 1, when a citizen receives a new type of smishing involving a fake payment, delays in blacklisting allow scammers to complete their deception. Even with emergency reports, account freezing often lags behind the speed of illicit withdrawals. These systemic delays, stemming from inter-agency coordination and manual analysis, span detection, reporting, and intervention, enabling transnational criminal networks to outpace defenses. An integrated framework is urgently needed to enable rapid, coordinated multi-agency responses and close these gaps [Tundis and Mühlhäuser, 2019].

Despite the agentic potential of LLMs, most existing studies remain detection-centric and fail to address coordination delays across institutions and jurisdictions. Even with accurate detection, fragmented downstream responses can lead to failure, forcing citizens to navigate disconnected systems for actions such as account freezing and investigation and often missing the critical window for financial recovery [Westmore et al., 2022; Luong and Ngo, 2024]. This limitation is particularly severe as international criminal networks exploit weakly regulated jurisdictions and real-time payment systems to accelerate cross-border fund exfiltration [Mitchell, 2025].

We propose COUNTER-SCAM , an LLM-based multi-agent framework for end-to-end online scam response. It proactively blocks or detects scam-related content in real time across channels such as phone calls and text messages and, when prevention fails, rapidly reports relevant information to law enforcement agencies and security teams, integrating prevention, emergency response, and investigation. By enabling multiple stakeholders to jointly leverage the agentic capabilities of LLMs, the framework supports rapid inter-agency sharing and analysis to prevent scams and minimize harm.

COUNTER-SCAM is a unified framework designed to integrate the previously fragmented stages of scam response organically, including scam detection, blocking, emergency intervention, and post-incident handling. To achieve this, it is composed of Chain-of-Scam-Response Agents (CSRA), which explicitly model the full lifecycle of scam response through specialized agents; Chain-of-Scam-Response Tasks (CSRT), a suite of NLP tasks that guide LLMs toward rolealigned decision-making for each agent; and Chain-of-ScamResponse Dataset (CSRD), a carefully constructed dataset grounded in real-world scam response knowledge to ensure safe, reliable, and effective task execution. To the best of our knowledge, this work is the first to move beyond standalone scam detection and present an integrated agent-task-data framework that covers the entire online scam response.

CSRA was developed through interviews with experts in cybersecurity and criminal investigation, resulting in an agentbased framework for comprehensive phone and text based scam response. It organizes mitigation into three stages including pre scam, immediate post victimization, and repeated victimization, guided by a situational analysis agent that determines appropriate actions. Three specialized agents then support execution: a scam prevention agent for proactive blocking and real time detection, an emergency response agent for immediate interventions such as reporting and account freezing, and an investigation agent for large scale analysis of organized scam activities. By covering the full scam cycle and linking information across stages, CSRA reduces response gaps and enables coordinated mitigation. Through this, it aims to complement law enforcement capacities and strengthen collaboration against international scams.

For practical deployment, we adopted strict safety principles. To prevent misuse, we release only non-scam data, apply scam-specific NER-based de-identification, and actively involve domain experts. Under this framework, the construction of CSRT and CSRD proceeds by (1) defining additional eight tasks that capture the core capabilities of each agent based on prior work, and (2) collecting original scam cases and scam response knowledge, including legal and operational materials, from the Korean National Police to build expert-annotated training and evaluation datasets. As a result, we construct a large-scale corpus comprising 185,300 scam cases and 38,587 response knowledge entries, providing a strong foundation for comprehensive scam response agents.

Under real-world constraints where commercial models are restricted, we fine-tuned sLLMs on the CSRD. Our results show that scam-specific NER consistently outperformed commercial models by 0.24 F1, and the fine-tuned sLLMs exceeded GPT-4o and Gemini's average performance by 10%, showing improvements of up to 0.55 in deceptive message analysis compared to zero-shot baselines. Nonetheless, complex reasoning tasks such as legal analysis and long-context emergency report summarization remain challenging, highlighting the need for further training. These results demonstrate the potential and effectiveness of COUNTER-SCAM as an integrated scam response system and point toward directions for further enhancement. The main contributions are:

1. We propose COUNTER-SCAM , the first integrated agent-task-data framework covering the entire cycle of scams for an end-to-end response.
2. Involving 37 stakeholders, we developed CSRA (agents), CSRT (tasks), and CSRD (misuse-resistant data) for practical LLM-based scam response.
3. We demonstrate that fine-tuned sLLMs significantly outperform commercial large models on scam-responsespecific 9 tasks.
4. By releasing our framework and large datasets, 1 , we provide a foundation for scalable deployment and crossborder collaboration in scam mitigation.

2 RelatedWork

2.1 Evolution of Online Scams and Challenges

Online scams exploit human psychological vulnerabilities through social engineering, using SMS, calls, and social media to impersonate family, acquaintances, recruiters, or authorities and defraud victims [Kumarage et al., 2025; Ai et al., 2024]. Transnational criminal networks based in Southeast Asia, such as Cambodia and Vietnam, orchestrate these schemes, exploiting legal gaps and moneylaundering networks [Amnesty International, 2025]. Effective mitigation requires coordinated cross-border and crossinstitution responses, yet fragmented law enforcement and weak collaboration allow scams to persist [Shen et al., 2025; Loggen and Leukfeldt, 2022].

2.2 LLM-based ScamResponse

Language models have emerged as crucial tools in scam response, capable of accurately identifying scams and providing interpretable explanations [Kim et al., 2026; Koide et al., 2024; Lee and Han, 2024]. Recent advances in multimodal processing and real-time detection have extended their utility beyond mere plausibility checks, enabling more realistic and practical applications in real-world settings [Cao et al., 2025; Shen et al., 2025]. Building on this trend, LLMs are increasingly envisioned as agent-based automated tools that can assist human responders at critical intervention points, supporting faster and more effective scam mitigation [Xue et al., 2025; Afane et al., 2024].

3 Method

Our key insight is that, just as large-scale scam organizations operate through internal coordination and role specialization, effective scam response requires seamless collaboration among all stakeholders including government, victims, and industry. As illustrated in Figure 2, this integration can be realized through a multi-agent framework. Based on interviews with field experts, we derived design principles for such agents. The resulting CSRA defines clear roles and responsibilities for each agent, CSRT structures LLM-based NLP tasks to operationalize these roles, and CSRD provides a safe and reliable dataset for task execution and evaluation. We further validate the framework's practical feasibility through evaluations.

1 Github repository

3.1 Establishing Core Guidelines

A key requirement for an effective scam response ecosystem involving multiple stakeholders is the seamless integration of incident data with real-time information. In practice, however, the inherent risks and potential for misuse of scam data have led to restricted access, which in turn has hindered the development of integrated response systems. To address this gap, we propose core guidelines for designing datasets that ensure

• safety while enabling efficient collaboration among stakeholders, and empirically demonstrate their implementation.
• ① Data Misuse Prevention. We adopt a principle of not releasing real scam conversation data that could be exploited by fraudsters for scenario generation or victim information theft [Permana and Jamaludin, 2023]. Instead, we provide carefully curated benign data, enabling the development of detection models while minimizing false positives. Additionally, officially produced texts such as emergency report dialogues, legal summaries of criminal incidents, and communications between law enforcement and citizens are made available to support the generation of appropriate response actions.
• ② Active Involvement of Domain Experts. We actively engaged domain experts to develop the practical components necessary for implementing COUNTER-SCAM , spanning agent design, task definition, and dataset creation. A total of 37 experts from four fields including general police officers, criminal investigators, cyber fraud investigators and policy analysts participated in deriving agent designs, evaluating the

operational suitability of proposed tasks through preliminary interviews, and performing data labeling and quality assessments. The reliability of their annotations and evaluations was ensured through consistent adherence to classification guidelines, supplemented by inter-annotator agreement measurements and correlation analyses to validate the results.

③ Safe Data Construction via NER. For efficient and safe scam response, we designed the CASE ANALYSIS NER. This pipeline clearly distinguishes victim information, perpetrator details, and impersonated identities, minimizing exposure of sensitive data while preserving analytically meaningful signals for crime analysis. In particular, it is designed to extract impersonated identities (e.g., fake names) and criminal tools (e.g., malicious links and account numbers), enabling their use for crime prevention and tracking [Kim and Lim, 2022]. We constructed a dataset from 28,806 texts including phone scam conversations, smishing messages, and crime fact data, labeled with 10 crime-domain and 13 general-domain entity types using BIO tagging.

CASE ANALYSIS NER

Let D = {XTok, YNER}. For a scam-related text, each token sequence XTok ∈ X, where X ⊆ {DPhone,DSms,DCrime}, maps to a BIO-labeled entity sequence YNER identifying crime-specific (e.g., fake identities, tools) and general entities (e.g., dates).

3.2 LLM-BasedMulti-Agent(CSRA)

Goal 1 (End-to-End Scam Response). The objective of COUNTER-SCAM is to identify the phase of an online scam and deliver phase-appropriate response to the relevant stakeholders in a timely manner. Since online scams unfold as lifecycle-oriented crimes rather than single events, effective mitigation requires structured, phase-aware responses aligned with specific analytical goals and responsible actors. We define an agent A = ⟨R, G, I, O, S⟩ by its role R, objective G, input space I, output space O, and stakeholders S.

Agent 1 (Situation Analysis). The Situation Analysis Agent ASA is designed to assess scam situations across heterogeneous users, where RSA denotes situation assessment, GSA is to identify the user's current situation and analytical needs, and ISA consists of scam messages, emergency reports, victim summaries, and contextual metadata such as user type and message timing. Given an input i ∈ ISA, the agent produces an output o ∈ OSA through joint reasoning over input content and metadata as o = ASA(i), and invokes the downstream agent. Stakeholders are categorized into four groups:

• Citizens: targets of scam attacks
• Cybersecurity teams: analyze blacklists and develop detection models to proactively block scams
• Police officers: respond to scams through emergency actions and investigations
• Banks: handle financial losses resulting from scamrelated fund transfers

Agent 2 (Scam Prevention). The stakeholders SSP include citizens and cybersecurity teams. The role RSP aims to prevent scam-related harm via early detection. Given an input message i ∈ ISP, the agent generates an output o ∈ OSP by identifying scam, issuing warnings to citizens, or, for security teams, classifying social engineering techniques and extracting malicious indicators.

Agent 3 (EmergencyResponse). The stakeholders SER are citizens, police, and banks. The role RER supports urgent scam response and emergency intervention. Given an input i ∈ IER consisting of urgent victim reports and contextual metadata, the agent outputs o ∈ OER by generating an emergencyfocused summary for immediate protective action, forwarding it to relevant law enforcement agencies, and, for police officers, extracting action-critical entities and coordinating with financial institutions and telecom providers.

Agent 4 (Investigation). The stakeholders SI are citizens, police. The role RI supports post-incident investigation and legal reasoning. Given an input i ∈ II consisting of detailed victim accounts and contextual information, the agent outputs o ∈ OI by assessing criminal liability, generating a statute-grounded legal analysis, and extracting impersonated identities and instrumentalities to trace recurring crimes linked to the same criminal organization.

3.3 Agent-Specific Core Tasks(CSRT)

We define NLP tasks that underpin each agent's decisionmaking capabilities. Guided by a review of prior work on scam detection and crime-related NLP, we identified tasks critical for these capabilities and categorized the types of textual inputs that stakeholders may provide during the scam response process. The task inputs include criminal facts XCri, scam response-related queries XQue, conversations suspected of being scam-related XScam, scam messages XSms, general texts containing crime-related information XTok, victims' urgent statements XEm, and criminal hypotheses XHyp.

① Situation Analysis Agent. Just as police officers rely on foundational procedural knowledge to make situational judgments [Holgersson and Gottschalk, 2008], the Situation Analysis Agent must accurately assess the state of scam victimization and select the appropriate response pathway among prevention, emergency, and investigation.

OFFENSE DETECTION D = {XCri, YCri}. For a description of suspected criminal activity, each input XCri ∈ X, where X ⊆ {DCrime}, maps to a label YCri corresponding to one of 111 offense categories.

OPERATIONAL QA D = {XQue, YAns}. For procedural questions related to scam response, each input XQue ∈ X, where X ⊆ {KPM}, maps to an answer YAns derived from police procedural manuals.

The agent can first determine whether a conduct constitutes a criminal offense and identify its basic offense category through OFFENSE DETECTION, and then use OPERATIONAL QA to decide the appropriate next steps.

② Scam Prevention Agent. To prevent imminent scams, the Scam Prevention Agent must detect content in real time, warn citizens, and filter malicious links and phone numbers extracted from previously identified scam cases of the same scenario to block their redistribution.

SCAM SCENARIO DETECTION D = {XScam, YScam}. For a given conversation, XScam ∈ X, where X ⊆ {DPhone,KBenign}, maps to a label YScam indicating whether the input is fraudulent or benign.

SCAM MESSAGE CLASSIFICATION D = {XSms, YSms}. For SMS messages, XSms ∈ DSms represents bait messages by scammers to deceive victims, and maps to a label YSms indicating one of seven scam tactics.

The agent can identify conversations in real time and issue warnings to consenting citizens, while classifying scam tactics in reported or large-scale analyzed texts and, through CASE ANALYSIS NER, extracting malicious indicators to be blocked and providing them to cybersecurity teams.

③Emergency Response Agent. When a victim has transferred funds due to a scam, immediate action such as prompt reporting and emergency account freezing by financial institutions is essential to mitigate losses.

EMERGENCY CALL SUMMARIZATION

D = {XEm, YEm}. For an emergency report, input XEm ∈ DE.R. consists of transcripts of emergency calls, and maps to a summary YEm that appropriately reflects the situation.

The agent supports urgent responses by police and financial institutions through rapid summarization of reports following the occurrence of scam victimization. The summarized report facilitates dispatch, and, together with account extracted via CASE ANALYSIS NER, enables prompt account freezing.

④ Investigation Agent. Just as a crime investigator collects evidence and pursues offenders [Roberts, 2012; Stainton et al., 2025], the Investigator Agent extracts criminal methods from texts, including impersonation details and instruments like accounts and phone numbers, to trace repeat offenders and support prosecution under relevant legal statutes.

The agent supports investigations of large-scale scam cases to prevent further harm. It ensures lawful investigation by assessing criminality (CRIMINAL HYPOTHESIS EVALUATION), mapping applicable laws (STATUTE MAPPING), and identifying statutory elements (ELEMENT ANALYSIS), thereby supporting clear investigative reports. Information extracted by CASE ANALYSIS NER further enables case clustering and follow-up investigation.

CRIMINAL HYPOTHESIS EVALUATION

D = {XHyp, YHyp}. Each input XHyp ∈ X, derived from KCI,KCR and reformulated as a hypothesis requiring legal assessment, maps to an output YHyp consisting of a binary judgment (true or false) and a corresponding rationale.

STATUTE MAPPING D = {XCri, YLaw}. Given a crime description XCri, , each input XCri ∈ X, where X ⊆ {DCrime}, the task maps it to one or more applicable criminal law articles, where YLaw is selected from 160 statutorily defined provisions.

ELEMENT ANALYSIS D = {XCri, YCom}. Given a crime description XCri, each input XCri ∈ X, where X ⊆ DCrime, is mapped to one or more legal elements constituting the offense, where YCom is selected from 129 statutorily defined components extracted from law articles.

3.4 Dataset Construction

We built benchmark datasets for all tasks through data processing and expert annotation. Data were collected from two sources, Original Scam Cases for detection and Response Knowledge for situational and legal reasoning.

Original Scam Cases. As summarized in Table 1, the Original Scam Case data comprise four subsets: DPhone,DSms,DE.R., and DCrime. DPhone includes 14,030 real voice phishing conversations collected from the Korean National Police Agency, substantially larger and more realistic than prior datasets [Boussougou et al., 2024; Ma et al., 2025]. DSms consists of 24,947 victim-reported scam SMS messages, representing a significantly larger real-world smishing corpus than existing benchmarks [Timko and Rahman, 2024; Tanbhir et al., 2024]. DE.R. is built from 2,361 anonymized call transcripts between victims and police officers absent from public dispatch datasets [Clinic, ; Data, ]. Finally, DCrime contains descriptions of criminal victimization derived from legal benchmarks and supplemented with synthetic cases [Hwang et al., 2022; Law&Company, 2022].

Scam Response Knowledge. Effective scam response requires not only domain-specific knowledge of scams but also alignment with general law-enforcement protocols and legal frameworks. Accordingly, our knowledge base is designed to cover comprehensive crime-response knowledge and is organized into five components: KPM,KBenign,KCI,KCL, and KCR. KPM captures 5,660 police procedural knowledge, constructed from internal manuals spanning 380 crime types and 57 response domains. KBenign is introduced to reduce false positives in scam detection by augmenting dialogue data that reflect legitimate police-initiated calls to citizens, based on real investigator examples. KCI, KCL, and KCR provide criminal investigation, criminal law, and judicial precedent knowledge, respectively, leveraging the publicly available LAPIS knowledge base [Kim et al., 2024].

Expert-Annotated Task Dataset. For OPERATIONAL QA, questions and answers were generated from KPM and reviewed by police experts, resulting in 2,624 high-quality QA pairs. Unlike prior legal QA benchmarks [Zhong et al., 2020; Goebel et al., 2024], our benchmark captures real-world, manual-grounded police procedures. For OFFENSE DETECTION and STATUTE MAPPING, offense labels assigned to all 143,893 DCrime instances were consolidated using the standard charge classification table [Agency, 2023], mapping them to 111 unified offense categories and corresponding legal labels. For SCAM SCENARIO DETECTION, we constructed balanced benign counterparts to DPhone by collecting nonfraud dialogues from financial consultations [Agency, 2025] and the Korean Dialogue Corpus [of Korean Language, 2024], and incorporating simulated official calls fromKBenign. For SCAM MESSAGE CLASSIFICATION, three crime analysts annotated all messages with one of seven fraud tactic categories. For EMERGENCY CALL SUMMARIZATION, experts summarized dual-perspective summaries (caller and officer) from anonymized DE.R. transcripts. For ELEMENT ANALYSIS, we analyzed 160 legal provisions and extracted 129 common crime elements, covering both conduct and result.

3.5 Evaluation under Real-World Constraints

We evaluated whether COUNTER-SCAM can operate under real-world constraints such as closed-network environments, limited computation, and the unavailability of commercial LLM APIs. We compared commercial LLMs, including chatgpt-4o-latest and gemini-2.0-flash, as performance upper bounds against deployable open-source sLLMs across our tasks and datasets, including a 1B-scale model to test extreme resource limits. Multilingual sLLMs such as Llama-3.1-8BInstruct, SOLAR-10.7B-Instruct, and Llama-3.2-1B-Instruct were evaluated for deployment on police intranet servers or on-device police phones, alongside a Korean-tuned model, EEVE-Korean-Instruct-10.8B, for Korean crime-response settings. Commercial models were evaluated in zero-shot settings, while sLLMs were tested under zero-shot inference, domain-specific fine-tuning, and RAG, with fine-tuning performed for five epochs using QLoRA and the Paged AdamW optimizer on two A100 80GB GPUs.

4 Experiment Results

Metrics. For OPERATIONAL QA, to reflect deployment constraints where commercial models cannot access police manuals, we applied RAG-based QA prompts only to open-source models. For classification tasks, we used rule-based postprocessing to correct format errors and align outputs with predefined labels [Xia et al., 2024], and evaluated performance using Accuracy and F1 score. For open-ended tasks such as summarization and QA, we adopted an LLM-as-a-Judge framework [Chiang and Lee, 2023], using expert-annotated gold references and instructing the judge model to evaluate outputs strictly against those references [Zheng et al., 2023]. Prior studies comparing expert and automatic evaluations on police manuals have demonstrated the validity of this approach [Lee et al., 2026], and in our study, correlations with human evaluations exceeded 0.8, confirming strong agreement with experts.

4.1 Crime-domain NER Is Effective, Yet Human Validation Is Still Essential For Safety

As shown in Table 2, fine-tuned sLLMs for CASE ANALYSIS NER consistently outperformed commercial models, achieving substantially higher F1 scores when both B- and I-tokens were correctly identified. While commercial models averaged an F1 of 0.35 across all entity tokens, fine-tuned sLLMs reached 0.59, with the best-performing models showing a large gap (GPT-4o 0.42 vs. Llama8B 0.79). In the crime domain, newly defined entities such as fake position, accused

Entity Gemini GPT4 EEVE Llama8B Llama1B SOLAR

General Domain

name, account, and crime tools were recognized far more accurately by fine-tuned sLLMs, indicating that even small models can effectively support safe, partially automated crime data processing. Commercial models also struggled with precise span detection for general entities, reflecting limited adaptability to crime-specific texts. However, fine-tuned sLLMs still showed weaknesses in extracting highly variable malicious elements such as bad links (maximum F1 0.54), suggesting the continued need for human review.

4.2 A Scam-specific Labeled Dataset Is Essential For Reliable Detection

Accurate detection and fine-grained classification of scams are essential, as they determine downstream actions such as warnings and blocking. Although commercial LLMs achieve high performance in SCAM SCENARIO DETECTION (0.97 and 0.87), Table 4 indicates that non-negligible false negatives persist. Notably, Gemini misclassified 351 non-scam messages as scams, which can undermine system reliability. In contrast, the fine-tuned sLLMmisclassified only 4 out of 1,426 instances, demonstrating substantially greater stability. The SCAM MESSAGE CLASSIFICATION task further reveals consistent misclassification patterns across commercial models. Both GPT-4o and Gemini frequently confused specific scam types, with errors concentrated in Overseas payment fraud and Voice spam. Such errors limit the system's ability to provide clear grounds for scam intervention by security teams.

4.3 While Fine-tuning Is Highly Effective In The Scam Response Task, More Fine-grained Training Is Still Required

Effect of Fine-tuning sLLMs. We compared the zero-shot performance of sLLMs with their fine-tuned counterparts on 150 small samples for each task. On average across all sLLMs, fine-tuning improved performance by 0.26, and the ability to follow task-specific instructions also increased by 0.28, demonstrating a clear benefit of fine-tuning. In particular, the SCAM MESSAGE CLASSIFICATION showed an average improvement of 0.55 compared to zero-shot, confirming that fine-tuning is an effective approach.

Fine-tuned sLLMs vs Commercial Models. Table 3 shows performance across all tasks. Fine-tuned sLLMs outperformed commercial LLMs in 6 out of 9 tasks, highlighting their strong adaptability to the scam response. In particular, fine-tuned EEVE 10.8B and SOLAR 10.7B achieved an average score of 0.85 and 0.87, exceeding commercial LLMs by 10%.

RiskWithout ScamResponse Knowledge. Without useful manual knowledge enhanced by KPM, scam response systems may hallucinate legal facts or provide operationally misleading answers, even when factually correct. We present concrete examples in the supplementary material. For instance, when asked how to delete harmful content, a commercial model merely provides a single deletion link, whereas the manualbased sLLM explains the actual procedure used in practice, including that reporting speed does not differ between individual and institutional submissions. This shows that commercial models can sometimes hinder efficient response.

Limitations from a Practical Usability Perspective. Despite improvements, some tasks still fall short of practical performance levels. OPERATIONAL QA achieved only scores in the 0.8 range even with manual-based RAG, indicating the need for additional evaluation metrics such as logical completeness. EMERGENCY CALL SUMMARIZATION also underperformed compared to commercial models despite fine-tuning, suggesting that smaller models lack the ability to effectively process long-context text. Finally, although tasks like ELEMENT ANALYSIS and CRIMINAL HYPOTHESIS EVALUATION showed significant gains, they still do not reach mature levels of accuracy, highlighting the need for more refined training methods for complex reasoning tasks.

5 Conclusion

We propose COUNTER-SCAM , the first multi-agent framework to integrate fragmented online scam response processes. By establishing a comprehensive agent-task-data model, we extend the scope of LLMs beyond simple detection to include blocking, emergency intervention, and post-incident investigation. Leveraging a large-scale dataset of over 185,300 scam cases and 38,587 legal knowledge entries, we demonstrated that fine-tuned sLLMs outperform commercial models in scam-specific NER and all tasks, proving their practical utility. While challenges remain in complex reasoning tasks such as legal analysis, this work confirms the potential of AI agents as practical partners in scam mitigation. Through open-source deployment, we aim to provide a foundation for cross-border collaboration against global scams.

Acknowledgments

This work was supported by the Institute of Information & Communications Technology Planning & Evaluation (IITP) grant funded by the Korea government (MSIT) (No. 2022-000653, Development of a Voice Phishing Information Collection, Processing, and Big Data-Based Investigation Support System).