A-party number manipulation that lets a call ride a cheaper route. The B-number says international; the A-number says local. The rate card pays local. We detect the refile before the rate card does.
CLI refiling is the manipulation of a call's A-number (calling line identity) so that international traffic looks domestic. Intermediaries exploit origin-based termination rates, charging the called operator international rates the traffic never earns, or pocketing the spread between domestic and international settlement. Detection relies on numbering-plan cross-checks, per-hop A-number integrity and short-call pattern baselines.
Refiling, also called A-party refiling or CLI refiling, is the practice of changing the calling party number (A-number) so the call appears to originate from a cheaper trunk. International call becomes domestic on paper. International rate becomes domestic rate on the bill. The settlement gap is the fraud.
We compare the A-number that arrives at each hop against the A-number that left the previous hop. Refiling shows up as a mismatch in the chain.
A-numbers are checked against national numbering plans. An A-number from country X terminating on a Y dial plan is the refiling signature.
Sudden shifts in A-number distribution on a corridor, usually towards domestic ranges on what should be international traffic, flag a refile operation warming up.
The detection principle is simple: track the A-number end-to-end through the call chain. Where it changes, refiling has happened. Implementation is harder, you need visibility at every hop, not just at your own switch.
We capture the A-number as it leaves the origin switch. This is the reference against which all downstream hops are compared.
At every interconnect point we have visibility into, we verify the A-number against the origin-side reference. A mismatch is logged with the hop, the timestamp and the route.
We cross-check the A-number against the destination numbering plan. International numbers dressed as local are the most common refiling pattern.
We baseline A-number distribution per corridor. Drift towards domestic ranges on what should be international traffic flags a refile operation.
If you bill per minute based on the A-number presented, refiling is printing money. The only defences are: (1) end-to-end A-number integrity verification, or (2) accept that some percentage of your billed minutes are mispriced. We do (1).
Worked example
International call to country Y. Direct route rate: $0.18/min. Local termination rate: $0.022/min.
Fraudster refiling the A-number from Y ranges bills the call at $0.022/min on the rate card, terminates it locally, pockets $0.158/min.
10 million refilled minutes per month on a corridor = $1.58M/month settlement revenue lost. That is the math refiling is built around.
Field note
Refiling is one of the oldest interconnect fraud schemes, and still one of the most lucrative. The reason it persists: end-to-end A-number verification requires cooperation across multiple carriers. We bring that visibility to the corridors we operate.
Where we cannot see every hop, we work with partner carriers under NDA to close the gap.
CLI manipulation shows up in wholesale traffic in three distinct forms, and they are often conflated. CLI refiling rewrites the A-number of international traffic so it presents as domestic, arbitraging origin-based termination rates. CLI masking suppresses or degrades the calling identity so the called network cannot validate origin at all, which defeats numbering-plan checks and often rides along with refilled traffic. CLI spoofing presents a deliberately false A-number, typically to impersonate a trusted number for vishing and smishing, or to dress traffic in numbers that belong to a cheaper rating bucket.
The three techniques leave different fingerprints in the CDR stream, which is why our observatory scores them separately per corridor rather than lumping them into a generic CLI fraud bucket.
| Technique | What changes | Typical intent | Primary detection signals |
|---|---|---|---|
| CLI refiling | A-number rewritten to a domestic number | Arbitrage origin-based termination rates | Domestic CLI on international call patterns, ACD collapse, A-number clustering per corridor |
| CLI masking | Calling identity suppressed or unreliable | Defeat origin validation and numbering-plan checks | No-CLI ratio spikes, presentation-restricted share per corridor, correlation with short calls |
| CLI spoofing | False A-number presented, impersonation | Vishing and smishing trust fraud, rating evasion | Numbering-plan mismatches, improbable uniformity, complaint or honeypot hits |
Where regulation supports it, STIR/SHAKEN attestation gaps add a signalling-level confirmation layer: refilled or spoofed A-numbers consistently fail to carry an attestation consistent with their claimed origin. On interconnects without attestation, per-hop A-number verification and calibrated test calls remain the reliable controls.
Send us a sample of your call records. We will run the integrity check and report the gaps we find.
CLI refiling is the manipulation of the calling party number (A-number) so international traffic appears to originate domestically. It exploits origin-based rating: the intermediary refiled the number, but the called operator still settles the call at the wrong rate.
CLI spoofing fakes an A-number for identity fraud, for example impersonating a bank. CLI refiling systematically rewrites international A-numbers into domestic ones to reduce termination costs. The mechanics overlap; the intent and the financial impact are different.
CLI masking suppresses or degrades the calling identity so the called network cannot validate where the call really originated. It shows up as no-CLI ratio spikes per corridor and correlates with short-call patterns; it frequently accompanies refilled traffic.
Proven signals: A-number consistency checks hop by hop, cross-checking A-numbers against the destination numbering plan, abnormally short average call duration, uniform A-number clustering on high-volume corridors, and deviation from per-corridor behavioural baselines.
It depends on the corridor. In the worked example on this page, a route paying 0.18 USD per minute instead of the correct 0.022 USD on a single refiling pattern represents about 1.58 M USD per month of leakage on moderate volumes. Most carriers only find a fraction of it without systematic monitoring.
Not with blocking alone, because the refiling happens upstream of your network. What works: continuous CDR analytics with per-hop verification, calibrated test calls on suspect corridors, commercial pressure on non-compliant partners, and quarterly recalibration of detection thresholds.
