Telecom Fraud Prevention: How Numbering Intelligence can help Defend Against IRSF
Telecoms fraud involves the abuse of telecommunications products and services with the intent to steal money from subscribers or communications service providers (CSPs). One particularly prevalent and insidious form of telecoms fraud is IRSF, or International Revenue Share Fraud. This type of fraud occurs when fraudsters exploit phone networks to generate fraudulent traffic and profit at the expense of telecom operators. Typically seen in international voice communications, this fraud takes advantage of the revenue-sharing model between operators within the telecom ecosystem. Fraudsters prompt an inflation of traffic to high-cost destinations, where, by definition, the revenue to be shared is higher than for lower-cost destinations. A fuller description is in the Cellusys Masterclass Paper Combatting International Voice Fraud.
How IRSF works in international voice:
The figure above illustrates IRSF. At the top, a normal call routing scenario shows all involved parties sharing revenue through cost-plus termination fees. However, in an IRSF case, one of the routing parties short-stops the call and collects the entire termination charge. This is depicted at the bottom, where a fraudulent Transit C carrier offers an attractive rate to win traffic from Transit B, only to short-stop any call attempts it receives.
The following three mechanisms are the key components of IRSF:
IRSF is a form of telecoms fraud involving the abuse of international voice networks to generate revenue.
- Fraudsters target premium-rate numbers and revenue-sharing arrangements to make money from fraudulent calls.
- Telecom operators suffer both from increased traffic and financial losses due to the fraudulent schemes.
- Detection and prevention require sophisticated systems like the Cellusys Voice Firewall, which provides visibility and control of voice traffic across all protocols.
- Numbering Intelligence, a specialised add-on, is another valuable tool in the fight against International Voice Fraud.
For those in the telecommunications industry, combating IRSF requires effective fraud management systems, continuous vigilance, and collaboration with ecosystem partners.
- Setup of Fraudulent Numbers: Fraudsters often set up phone numbers or premium-rate numbers in countries where they can receive a higher revenue share. These numbers are generally toll-free, premium-rate, or sometimes even VoIP (Voice over IP) numbers that are designed to receive calls from international networks.
2. Generating Call Traffic: Fraudsters generate a high volume of calls to these numbers, often using techniques like call forwarding or SIM-box setups (see below). The calls may appear as legitimate international traffic, but they are routed in a way that maximises the fraudsters’ share of the revenue generated.
3. Revenue Sharing Mechanism: Telecom operators around the world share the revenue from international calls, and they pay a portion of the revenue to the owners of the premium-rate numbers. This is done via business techniques called settlement and clearing and happens regularly (i.e. monthly). Of course, fraudsters profit by being the owners of these numbers, and they receive the revenue generated by the international traffic that is settled out to them.
Impact of IRSF on the International Telco Ecosystem
- Rising Costs for Operators: Operators receiving such fraudulent traffic usually end up with inflated costs because they are paying more to terminate these calls to the fraudsters’ numbers than they would for legitimate international traffic.
- Corresponding Cost Impact on Subscribers: The fraud can result in higher rates being passed on to subscribers in the affected regions. Furthermore, in some cases depending on routing (and / or spoofing, see an upcoming blog from Cellusys), subscribers may unknowingly be charged for international calls that they didn’t initiate, if their CSPs are being duped into passing the traffic.
Common Attack Vectors Used to prompt IRSF:
- SIM Boxes: A SIM Box is a device capable of managing large numbers of SIM cards, often obtained illegally and sometimes using virtual or disposable numbers. Calls that should be routed through expensive international circuits are instead redirected through the SIM Box, where they are processed at a lower cost.
- Wangiri: Wangiri involves tricking a victim into returning a call to a high-cost number. The fraudster generates calls from the high-cost number and terminates the call as soon as the recipient’s phone rings. This creates a missed call, prompting the victim to return the call and generate revenue for the fraudster. Fraudsters may compromise PBX systems or use other methods to divert legitimate calls to these premium-rate numbers. By taking control of international call routes, they can ensure they receive a portion of the revenue.
- CLI Spoofing : Calling Line Identification (CLI) spoofing involves disguising a caller’s true identity in order to promote false confidence in the incoming number. The number can appear to be from a trusted source, such as a bank. As mentioned before this is the subject of the next Cellusys blog so stay tuned to this channel.
Aiding the Detection and Prevention of IRSF – Numbering Intelligence
As detailed in the recent Cellusys Masterclass Paper, Combatting International Voice Fraud, there are a number of techniques and steps to detecting and preventing IRSF. Clearly, a robust and well managed Voice Firewall, such as that offered by Cellusys is a prerequisite, but there are additional specialised elements which can aid your firewall in understanding the incoming numbers: we call this “numbering intelligence”.
Numbering Intelligence ensures that your numbers are :
· Live and Active on a CSP somewhere in the world
· Mobile or Fixed
· Of the correct E.164 length and numbering plan
· International Premium Rate Numbers (IPRN)
· Mobile Station Routing Numbers (MSRN)
· VoIP numbers
· Not part of previously identified suspicious ranges
Furthermore, a robust numbering intelligence provider can reveal the Mobile Country Code (MCC) and Mobile Network Code (MNC) of a mobile number. This is important as it indicates to which current global network the number in question belongs to. This promotes confidence or on the other hand reveals that the number belongs to a previously red-flagged or suspicious number range.
Finally, and this information is perhaps even more important in the SMS world to ensure texts are routed correctly, some numbering intelligence providers reveal the porting history of a mobile number. If a number has been ported a significant number of times within a short period, this may not inspire confidence, and the number should be flagged or at least monitored.
Tags: AI, steering of roaming, UsabilityCategorised in: Blog