Abstract: A system may include one or more of a called device, a calling device, configured to call the called device, and a network module. The network module is configured to process incoming call information of a call placed to the called device and configured to route the call to a destination based on preferences of the called device.

Abstract: One example method of operation may include collecting call metric data over a predefined period of time for identified calls, querying the call metric data to identify whether one or more call filtering criteria parameters require changes, determining one or more call filtering criteria parameters require changes based on a deviation from one or more expected call metric data values included in the call metric data, modifying one or more of the call filtering criteria parameters, and updating an active call scam model stored on a call processing server based on the one or more call filtering parameters.

Abstract: One example method of operation may include receiving a call message associated with a call, determining a service provider network identifier based on a telephone number of a call origination device, identifying, from the call message, an identity header with a link to a public certificate repository storing a public certificate assigned to a service provider network hosting the call origination device, retrieving a service provider code assigned to the service provider network from the public certificate, and determining whether the service provider code matches the service provider network identifier as identified from a verification table.

Abstract: One example method of operation may include receiving a call message associated with a call, determining a service provider network identifier based on a telephone number of a call origination device, identifying, from the call message, an identity header with a link to a public certificate repository storing a public certificate assigned to a service provider network hosting the call origination device, retrieving a service provider code assigned to the service provider network from the public certificate, and determining whether the service provider code matches the service provider network identifier as identified from a verification table.

Abstract: One example method of operation may include identifying a call from a caller and destined for a callee, receiving a data message associated with the call, forwarding the data message to a call processing server, processing the data message to identify one or more call parameters, comparing the one or more call parameters to an active call scam model applied by the call processing server, determining a scam score for the call based on the comparing of the one or more call parameters to the active call scam model applied by the call processing server, and determining whether to notify the callee that the call is a scam based on the scam score.

Abstract: One example method of operation may include collecting call metric data over a predefined period of time for identified calls, querying the call metric data to identify whether one or more call filtering criteria parameters require changes, determining one or more call filtering criteria parameters require changes based on a deviation from one or more expected call metric data values included in the call metric data, modifying one or more of the call filtering criteria parameters, and updating an active call scam model stored on a call processing server based on the one or more call filtering parameters.

Abstract: One example method of operation may include identifying call data associated with a received call, identifying call parameters from the call data, and the call parameters include one or more call routing parameters associated with call routing of the call and one or more call session parameters associated with a call session of the call, assigning weights to one or more of the call routing parameters and the call session parameters, determining a scam score for the call based on a sum of the weights applied to the call routing parameters and the call session parameters, and blocking the call when the scam score is greater than or equal to a predetermined threshold scam score.

Abstract: One example method of operation may include receiving one or more data messages, identifying calls and corresponding call data from the one or more messages, identifying call parameters from the call data, applying a call activity filter criteria to the call parameters to identify a suspect sub-set of the call parameters which indicate an elevated likelihood of call scam, forwarding the call parameters and the suspect sub-set of call parameters to one or more call data tables, and assigning one or more scam designation threshold scores to the suspect sub-set of the call parameters in the one or more call data tables.

Abstract: One example method of operation may include identifying a call from a caller and destined for a callee, receiving a data message associated with the call, forwarding the data message to a call processing server, processing the data message to identify one or more call parameters, comparing the one or more call parameters to an active call scam model applied by the call processing server, determining a scam score for the call based on the comparing of the one or more call parameters to the active call scam model applied by the call processing server, and determining whether to notify the callee that the call is a scam based on the scam score.

Abstract: One example method of operation may include extracting a calling device telephone number from a received call message, querying a verification table for the calling device telephone number, identifying the calling device telephone number and a corresponding service provider network identifier from the verification table, querying a mapping table for the service provider network identifier, and identifying whether a match between the service provider network identifier and a service provider code exists as an entry in the mapping table.

Abstract: A system may include one or more of a called device, a calling device, configured to call the called device, and a network module. The network module is configured to process incoming call information of a call placed to the called device and configured to route the call to a destination based on preferences of the called device.

Abstract: One example method of operation may include receiving a call message associated with a call, determining a service provider network identifier based on a telephone number of a call origination device, identifying, from the call message, an identity header with a link to a public certificate repository storing a public certificate assigned to a service provider network hosting the call origination device, retrieving a service provider code assigned to the service provider network from the public certificate, and determining whether the service provider code matches the service provider network identifier as identified from a verification table.

Abstract: One example method of operation may include collecting call metric data over a predefined period of time for identified calls, querying the call metric data to identify whether one or more call filtering criteria parameters require changes, determining one or more call filtering criteria parameters require changes based on a deviation from one or more expected call metric data values included in the call metric data, modifying one or more of the call filtering criteria parameters, and updating an active call scam model stored on a call processing server based on the one or more call filtering parameters.

Abstract: One example method of operation may include receiving a call message associated with a call, determining a service provider network identifier based on a telephone number of a call origination device, identifying, from the call message, an identity header with a link to a public certificate repository storing a public certificate assigned to a service provider network hosting the call origination device, retrieving a service provider code assigned to the service provider network from the public certificate, and determining whether the service provider code matches the service provider network identifier as identified from a verification table.

Abstract: One example method of operation may include receiving a call message associated with a call, determining a service provider network identifier based on a telephone number of a call origination device, identifying, from the call message, an identity header with a link to a public certificate repository storing a public certificate assigned to a service provider network hosting the call origination device, retrieving a service provider code assigned to the service provider network from the public certificate, and determining whether the service provider code matches the service provider network identifier as identified from a verification table.

Abstract: One example method of operation may include extracting a calling device telephone number from a received call message, querying a verification table for the calling device telephone number, identifying the calling device telephone number and a corresponding service provider network identifier from the verification table, querying a mapping table for the service provider network identifier, and identifying whether a match between the service provider network identifier and a service provider code exists as an entry in the mapping table.

Abstract: One example method of operation may include identifying call data associated with a received call, identifying call parameters from the call data, and the call parameters include one or more call routing parameters associated with call routing of the call and one or more call session parameters associated with a call session of the call, assigning weights to one or more of the call routing parameters and the call session parameters, determining a scam score for the call based on a sum of the weights applied to the call routing parameters and the call session parameters, and blocking the call when the scam score is greater than or equal to a predetermined threshold scam score.

Abstract: One example method of operation may include receiving one or more data messages, identifying calls and corresponding call data from the one or more messages, identifying call parameters from the call data, applying a call activity filter criteria to the call parameters to identify a suspect sub-set of the call parameters which indicate an elevated likelihood of call scam, forwarding the call parameters and the suspect sub-set of call parameters to one or more call data tables, and assigning one or more scam designation threshold scores to the suspect sub-set of the call parameters in the one or more call data tables.

Abstract: One example method of operation may include extracting a calling device telephone number from a received call message, querying a verification table for the calling device telephone number, identifying the calling device telephone number and a corresponding service provider network identifier from the verification table, querying a mapping table for the service provider network identifier, and identifying whether a match between the service provider network identifier and a service provider code exists as an entry in the mapping table.

Abstract: One example method of operation may include identifying call data associated with a received call, identifying call parameters from the call data, and the call parameters include one or more call routing parameters associated with call routing of the call and one or more call session parameters associated with a call session of the call, assigning weights to one or more of the call routing parameters and the call session parameters, determining a scam score for the call based on a sum of the weights applied to the call routing parameters and the call session parameters, and blocking the call when the scam score is greater than or equal to a predetermined threshold scam score.