Based on the results achieved in the previous deliverable D2.1 where the fraud problem was discussed in details and an overview of the existing anti-fraud techniques was provided, the SCAMSTOP architecture is investigated and described in this document. The SCAMSTOP architecture has adopted a modular vision which allows the proposed solutions to be updated, upgraded and adjusted to the needs of the VoIP providers without any difficulty. One of these modules reflects the specification of a user signature where the behavior of this user is summarized through some statistical parameters that allow tracking the user “normal” behavior. Related issues such as signature initialization, definition, update and comparison were investigated. The integration of Intrusion Detection Systems with Fraud exploration is also one the main milestones of the SCAMSTOP architecture. The SCAMSTOP framework also took into account the user context when building the signature, for instance travels and holidays. This was done to have signatures close as much as possible to real live scenarios. Another aspect that was also considered is the correlation of the different fraud alerts that might be generated due to the use of various detection modules either in sequence or in parallel. As users „ data is mined at some extend, this deliverable also discussed the related privacy issues.