TrustLine

Inspiration

Newcomers to Canada are the favourite targets of phone scammers. Callers pretend to be IRCC, the CRA, the CBSA or a bank, threaten deportation or arrest, and demand payment in gift cards or crypto, often in a language the listener is still learning. And people get scammed during the call, when nobody is there to say "hang up, that's not how the government works."

Neither iOS nor Android lets an app listen to a phone call. But anyone can add a friend to a three-way call. So we made TrustLine a phone number, not an app.

What it does

During a suspicious call, tap Add Call, dial TrustLine (+1 604-373-6537) and tap Merge Calls. TrustLine joins silently, transcribes the call in real time and flags scam tactics: gift card or crypto payment, deportation or arrest threats, one-time code requests, remote access, upfront fees for jobs, LMIAs and work permits, and more.
On the first high-risk moment, it warns you out loud on the call, in your language: English, Punjabi, Mandarin, Tagalog or Farsi.
When the caller claims to be an institution, TrustLine names that institution's real contact channel from a verified directory, so you can hang up and check for yourself.
After the call, you get a text with a link to a call summary: the transcript, the exact words that triggered each warning, the amount the caller asked for, verified contacts, recovery steps and one-tap reporting to the Canadian Anti-Fraud Centre.
The website has a live call view, a message check for suspicious texts and emails, an "Already paid?" recovery guide, and a partner portal where settlement agencies and credit unions see redacted reports, money at risk and scam trends by tactic and language, then publish advisories to every partner and send them to their members.

It supports UN SDG 8 (8.10: trust in financial services; 8.8: protecting migrant workers from job and LMIA fee scams) and SDG 17 (17.17: partnerships between civil society, credit unions and government).

How we built it

Twilio Programmable Voice receives the merged call and streams its audio over Media Streams to our Node.js call server (hosted on Railway).
ElevenLabs Scribe v2 Realtime transcribes Twilio's 8 kHz audio directly, with no transcoding.
Detection has two layers: an instant rules layer (about 0.01 ms per transcript) and Google Gemini returning schema-constrained JSON, validated again with Zod. Rules can raise risk immediately; the LLM can only lower it, and never when the rules found gift cards, crypto, one-time codes or remote access.
ElevenLabs Text to Speech speaks the warning back into the call in the listener's language.
The React + TypeScript (Vite) web app on Vercel follows calls live over Server-Sent Events. Supabase Realtime shares incidents and advisories across devices, and reports are redacted on the device before they are sent.
On a labelled set of scam and legitimate calls, rules plus Gemini reached 100% precision and 100% recall with no false positives on the legitimate calls, at a median scoring latency of about 1.1 seconds. The cases were written alongside the rules, so these numbers are optimistic.

Challenges we ran into

Getting into the call at all. Phones don't let apps read call audio, which pushed us to the merged-call design.
Real-time audio plumbing. The speech-to-text SDK resolved its connection before the socket was actually open, which crashed our server on the first real call. We fixed it by waiting for the socket to open and making dropped connections non-fatal.
Speed vs. accuracy. A warning that comes after you've read out the gift card code is useless, so the instant rules layer warns first and the LLM refines it.
Hosting a phone line. Twilio needs a stable public address and a server that holds a WebSocket open for the whole call, so the call server lives on Railway while the site is on Vercel.

Accomplishments that we're proud of

A real phone call to a real number: you merge TrustLine in and it warns you out loud, mid-call, in your language.
Evidence-backed warnings that quote the caller's exact words instead of just saying "suspicious".
Privacy by design: redaction on the device, consent before anything is shared, and no transcript excerpts in partner exports.
WCAG 2.2 AA accessibility, including right-to-left layout for Farsi.

What we learned

The best place to stop a scam is inside the call, and the best interface for someone under pressure is a voice in their own language, not a screen. We also learned a lot about streaming audio, prompt design for structured output, and how much the reliability of a live system depends on its plumbing.

What's next for TrustLine

Real reporting integrations with the Canadian Anti-Fraud Centre and partner organizations (today, reports stay in our demo database).
Pilots with settlement agencies and credit unions.
More languages, and a paid LLM tier so no call data is used for model training.
Partner sign-in to replace the demo access.