One example method of operation may include receiving one or more data messages, identifying calls and corresponding call data from the one or more messages, identifying call parameters from the call data, applying a call activity filter criteria to the call parameters to identify a suspect sub-set of the call parameters which indicate an elevated likelihood of call scam, forwarding the call parameters and the suspect sub-set of call parameters to one or more call data tables, and assigning one or more scam designation threshold scores to the suspect sub-set of the call parameters in the one or more call data tables.