Solutions / Route Integrity
Fraud Prevention
SIM box detection, IRSF screening, Wangiri callbacks, refiling alerts. Continuous monitoring, not calendar-driven compliance.
The fraud landscape
$41.82B lost in 2025. Still rising.
CFCA’s 2025 survey put global telecom fraud losses at $41.82 billion, up nearly $3B on 2023. The top five fraud types account for over half of it. We screen for all five, plus the long tail.
SIM box
GSM gateways terminating international calls as local. ASR drops, settlement revenue disappears. Detected by test-call pattern analysis and behavioural scoring.
IRSF
International Revenue Share Fraud. Hackers machine-generate calls to premium ranges; revenue is shared with the range owner. Block window measured in minutes.
Wangiri
One-ring scam. Fraudster calls once, hangs up, waits for the callback to a premium number. Detected by call-pattern signatures and number-range reputation.
Refiling
A-party number manipulation to ride a cheaper route. Detected by CLI consistency checks across the call chain.
How we work
Continuous screening, not quarterly audit.
Calendar-driven fraud audits catch what already happened. By the time the report lands, the loss is real. We screen in the signalling path, in real time, with named escalation.
01
Signalling-layer monitoring
SS7 firewall, SMS firewall, voice CDR analytics. Fraud signals are detected as they cross the network, not after the invoice lands.
02
Behavioural baselines per corridor
Each destination has its own traffic shape. We baseline ASR, ACD and CLI presentation per corridor; anomalies fire alerts within a 15-minute window.
03
Test-call campaigns
Test numbers rotate. Static TCG numbers get burned by fraudsters within days; we run rolling campaigns so the SIM box cannot learn them.
04
Human review of every block above threshold
Automatic blocking is fast and wrong about 30% of the time on legacy FMS rules. Our analysts review flagged traffic before it is hard-blocked.
05
Named NOC escalation
When something fires, you do not open a ticket. You call the analyst who built your baselines.
The honesty section
What fraud prevention is, and is not.
What it is
- Continuous monitoring in the signalling path
- Named analysts with corridor-specific baselines
- Rolling test-call campaigns against SIM box and bypass
- Real-time alerts on IRSF and Wangiri patterns
- Quarterly review of false-positive rate
What it is not
- A 100% block rate. Nobody delivers that honestly.
- A set-and-forget firewall. Rules decay.
- A replacement for commercial discipline on rate cards.
- An AI black box. Black boxes block good traffic.
- A quarterly PDF. By the time it lands, the money has gone.
Telecom fraud prevention is the continuous detection and escalation of revenue theft on your routes: SIM box farms, OTT bypass, CLI refiling, wangiri callbacks and A2P grey routes. It is not a product you install once. It is a discipline: baselines per corridor, machines proposing, engineers confirming, thresholds recalibrated quarterly.
The method: how detection actually works.
Three methods, combined because each fails alone:
| Method | Catches | Weakness |
|---|---|---|
| Test calls | Proves bypass on a corridor | Tiny sample, quickly gamed |
| CDR analytics | Systemic patterns, drift | Needs calibrated baselines |
| Signalling inspection | Re-origination points | Not visible on most transit |
On machine-flagged traffic, expect roughly a third to be false positives without expert review. That is why our AI principles make human accountability principle number three. The full framework: the wholesale fraud guide.
Where to start.
The fastest way to know if your routes are leaking:
Send 48 hours of CDRs. We run them through the observatory methodology. You get a corridor report in days, not a sales call.
Or explore the fraud protection hub to see all four vectors we watch.
Every term, defined.
Fraud jargon is designed to confuse buyers. Our 22-term glossary cuts through it: SIM box, wangiri, grey route, SMS pumping, CLI — every term with the practitioner’s watch-list, not the vendor’s pitch.
Next
Want to see what your traffic is actually doing right now?
Send us 48 hours of CDR exports. We will run them through the screeners and come back with what we found.