Social-engineering detection for voice calls. Scores the caller turn by turn and warns the employee while the call is still live.
Detector: checking…
Two detectors, one scale. Claude reads the transcript and reports which signals it sees, quoting the caller's words for each; the pattern engine does the same offline. The findings are merged, and only then does the score get computed — each signal adds its fixed weight once, capped at 100. Neither detector ever emits a number. That split is deliberate: the model brings the judgement, and the arithmetic stays deterministic, so the same findings always produce the same score and you can answer “why was this call flagged” with a rubric instead of a shrug.
verification_evasion carries the heaviest weight for a structural reason. A legitimate caller can always accept “let me call you back on the main line.” An attacker cannot — the callback ends the attack. It is the one signal that cannot be paraphrased away, because it is about what the caller refuses, not what they say.
| Signal | What it catches | Weight |
|---|
Bands: 0–29 low · 30–59 suspicious · 60–79 high · 80–100 critical. The employee warning fires at 60, the security alert at 80.
Put the call on speakerphone next to this device and press Listen. The page transcribes what it hears and re-scores after every utterance — the same rules engine, the same thresholds, running on a real call instead of a script.
Nothing captured yet.
Have them call you and read these lines with a pause between each. The score should walk 25 → 40 → 85 → 100 and trip the alert on the third line.
Two honest caveats for the pitch. The page hears one microphone, so it does not separate the caller from you — everything spoken in the room is scored, and speaker separation is on the gap list. And transcription here runs through the browser's own speech service, not a telephony tap; a deployed system would sit on the call leg itself. Texas is a one-party-consent state, so recording a call you are on is lawful here — that is not true everywhere, and it is worth counsel before this touches anyone's real calls.
One line per turn. Prefix caller lines with
Caller: — only caller turns are scored.
Analyze runs the model over the transcript and merges what it finds with the rules engine. Rules only is the offline floor — instant, auditable, and beatable by paraphrase, which is the point of running both.
The transcript loaded here is the flagship attack, reworded so it trips no pattern at all. Press Rules only — it scores 0. Then press Analyze call. That gap is the whole argument for putting a model in front.
Every attack in the library, rewritten to evade. Four rewordings each, getting harder: synonyms, then no trigger nouns at all, then the ask split across turns, then the same attack with all the urgency stripped out. Against that, a set of ordinary business calls — including near-misses that should look alarming and aren't.
An attack counts as caught at 60, where the employee warning fires. An ordinary call counts as clean below 30. Those are the same thresholds the live product uses, so these are operational numbers, not flattering ones.
| Case | Evasion | Rules | Both | Result |
|---|
Read this honestly. The rules number is what a keyword filter gets you against someone who has thought about it for five minutes, and it is the number a competitor quoting “pattern-based detection” is really quoting. The set is also small and written by the same person who wrote the detector, which flatters it — a real evaluation needs adversarial calls written by someone trying to beat it, and recordings of genuine ones.