Guardian

Inspiration

Americans reported a record $15.9B lost to fraud in 2025, and phone calls carry the highest median loss of any contact method at $1,835, worse, six-figure losses made up 70% of dollars lost by adults 60+ despite being only 6% of their reports (FTC data). Carrier scam-ID labels only catch numbers already flagged. They go silent the instant a call is unlabeled, or the customer dials out themselves to a number that looks legitimate. That gray zone, not the obvious robocall, but the call that sounds like your bank until it asks for a one-time code, is where the real damage happens, and where no carrier product currently looks.

What it does

Guardian watches a call in three phases:

Before: Caller Screen checks the number against scam data and anomaly signals before it even rings.

During: Two triggers matter — a bank verification code arriving while the customer is on a call with an unverified number, or the caller asking for something against the customer’s interest (gift cards, the code, a “safe account,” remote access, or a claim that contradicts the bank/carrier’s real policy). Risk climbs through an alert ladder — silent on-screen nudge → a short voice whisper only the customer hears → a full alert with three buttons (call the bank back on its real number, loop in a trusted contact, or continue). It never hangs up the call for the customer — that decision always stays theirs.

After: An Aftercare Planner places a real callback to the verified number, gives recovery guidance, and compiles an evidence packet — without ever storing the raw audio or transcript (by design, not just policy).

How we built it

A LangGraph pipeline of agent nodes runs on NVIDIA Nemotron (Brev-hosted, with hosted NIM as fallback) through one shared, validated LLM client with a fast tier for in-call decisions and a deep tier for after-call planning. A deterministic decision layer merges every signal with the LLM’s read. The LLM can raise the risk score, but it is architecturally incapable of lowering it below the deterministic floor. We proved the two non-negotiable safety invariants (never block an emergency call; risk only moves up during a call) in Lean, not just unit tests. FastAPI + WebSockets stream session state live to a console/phone-view/landing-page front end. For the demo calls themselves, ElevenLabs conversational agents place and receive calls over a SIP trunk, one agent plays the scammer, a second places the verified callback with hard guardrails against ever asking for personal info and because we placed those calls ourselves, we poll ElevenLabs’ own conversation transcript rather than needing to tap raw call audio. Photon is the messaging sidecar that delivers the on-phone alert and its three reply buttons over iMessage/RCS.

Challenges we ran into

We initially planned to tap raw call audio for live transcription. Mid-hackathon we hit a hard platform limit: you cannot inject into, join, or transfer a phone call your own code didn’t place. That forced a pivot to routing the demo calls through our own ElevenLabs SIP agents and reading their transcript stream instead of building a separate audio pipeline. Tuning a fast-tier LLM to catch a real scam opener without over-firing on a benign call that merely sounds similar, a first-turn story with no actual ask yet is a known near-miss we chose to leave as-is rather than over-correct against our own red team.

Accomplishments that we're proud of

Safety properties that are formally proved in Lean, not just tested. A risk-merge rule, LLM can raise, never lower, enforced in code, so a hallucinating model can make the system more cautious, never less. An end-to-end live demo: a real phone call, real Nemotron reasoning, a real alert, in real time. Zero raw audio or transcript text ever written to disk or the database, privacy by construction.

What we learned

Telecom call infrastructure gives you far less access than expected — you can observe or place a call, but not reach into one you didn’t start. Our design bet (a graded alert with action buttons, never an automatic hang-up) lines up with real research: risk-gated warnings with action buttons cut fraud by roughly 94%, while plain text warnings lost effect with repeat exposure, good validation to find after we’d already committed to the design.

What's next for Guardian

Build the outbound-dial check so the same protection covers calls the customer places, not only calls they receive. Move off the ElevenLabs/Photon demo rig and into real carrier network signaling (T-Mobile’s network core / T-Life), where real call metadata replaces a simulated SIP call.