Recently, generative AI has made social engineering attacks more fluent, adaptive, and scalable, increasing the need for LLM-based defenders to protect users during ongoing interactions. Researchers have asked whether such defenders can identify the structural source of risk or merely react to surface cues. They formalized trust-chain localization: identifying whether an interaction fails at actor authority, asset control, verification sufficiency, or transaction path. They constructed a controlled 300-case online-housing corpus spanning 20 scenario families, legitimate cases, four structural failure modes, and three surface conditions. Five defender models were evaluated on the same corpus in stateful turn-by-turn and one-shot static settings, yielding 1,500 model-case evaluations per protocol and 3,000 in total. No model produced explicit unsafe compliance, yet defensive effectiveness varied sharply: intervention rates ranged from 0% to 96.3%. Protective action and correct structural localization were frequently decoupled, with models sometimes intervening while identifying the wrong trust component or recognizing a structural failure without taking protective action. Asset-control failures were a major localization bottleneck, surface sensitivity varied across models, and live-static differences were model-dependent. These findings show that safe-looking behavior alone is insufficient; live scam resistance must separately measure intervention, timing, structural localization, and false-positive behavior. Blogger's Review: This article proposes a new method for evaluating defensive LLMs, by constructing a controlled corpus and evaluating multiple defender models, revealing the limitations and challenges of current defensive LLMs, with significant research and practical application value.