What to do with a verdict

The filter tells you. Your switch acts. This page is the playbook.

Two checks, two moments

The voice firewall works in the call. The first verdict arrives after the caller has spoken a sentence or two. It cannot stop the phone from ringing.

Use two checks together:

Before ring: Spam score + HLR returns the spam score and reputation of the calling number. Known spam numbers never ring.

In the call: the voice firewall scores what the caller says. New numbers and spoofed numbers are caught here, and each scam verdict with report=true feeds the first check for everyone.

One action per level

Level	Score	Action	How
`clean`	below 0.3	Nothing.	No event is sent.
`suspicious`	0.3 to 0.59	Tag the CDR.	Write `session_id`, `score`, and `category` to the call record. Do not touch the call.
`likely_scam`	0.6 to 0.84	Warn the called party.	Play a tone or a short prompt on the callee leg. Start recording if your policy allows it.
`scam`	0.85 and above	Warn or drop.	Play a short message and hang up, or transfer the call to the honeypot.

Rules:

Act on level, not on score.

Act on the latest event. A later verdict replaces an earlier one.

Never drop on likely_scam alone. Drop on scam, and only after the observation period below.

Tag every action with session_id. When a subscriber asks why a call was cut, Get one session has the transcript, the verdict, and the evidence.

Where to put the logic

You have three places to act. Pick one.

Place	Good for	Note
The socket client	Media servers and bridges that read the socket	Lowest latency. Read `verdict` events as they arrive.
Your webhook backend	FreeSWITCH forks, SBCs, Twilio, Telnyx	Set `webhook` on the socket URL. Act from the webhook and send a hangup or transfer to the switch over its own API.
After the call	CDR tagging, analyst review, blocking	Read `session.ended` or Get one session. No live action.

The first 30 days

Start in observe mode. Enforce later. The verdict is a probability, and your traffic is not the traffic the thresholds were tuned on.

Week 1: connect the switch with report=false. Tag CDRs with the level. Do not warn and do not drop. Pull List your recent sessions with limit=200 daily and read the scam and likely_scam transcripts.

Week 2: turn on the warning for likely_scam and scam. Keep drops off. Count complaints from called parties.

Week 3: turn on drop or honeypot transfer for scam on consumer lines. Keep enterprise trunks on warn.

Week 4: set report=true. From now on a scam caller is filed and blocked across CallerAPI, before ring, for you and for every other customer. See Block a caller.

If the scam transcripts you read in week 1 are not scams, stop and contact us before you go to week 3.

Two checks, two moments#

One action per level#

Where to put the logic#

The first 30 days#

Two checks, two moments

One action per level

Where to put the logic

The first 30 days