Author: Vijay Amirthraj

There is now a global outbreak of COVID-19 with the resultant lock-down, panic, and fear across the globe. We have been keenly following the media to keep ourselves updated about the situation. While, very reassuringly, more than 95% of the workforces have started working from home with possible secure connectivity, fraudsters have also been equally active, looking for opportunities to attack the subscribers all over the world. In the past month, there has been a sharp increase in the incidence of IRSF, Robocalls, SMS Scams, Social Engineering fraud, DDoS and cyber-attacks.

The operators and customers have been enormously strained during the past few weeks. We need to rise to the occasion to protect their interests. In my view, the following steps may be taken to deal with the telco fraud-related challenges:

• Subscriber awareness: A subscriber awareness programme need to be launched immediately to make consumers wary of various fraudulent schemes that are floated during the time of panic and fear. A case in point as reported by one of the Asian operators is that last week many subscribers who had installed the COVID-19 live update apps on their phones coughed up a whopping $ 0.16 Mn because they were unaware that apps would also take over the status of the phone including SMS read and write function.
• Prioritizing the fraud alerts monitoring: Remote working would have its challenges. The fraud management teams need to prioritize the alerts, especially which would have more impact on the subscribers and act on it and fix them on priority.
• Root-cause corrective actions: Solution devised to eliminate the causes of fraudulent activity will stem the probabilities of its recurrence. For example, in the network, the range of the high-risk destination numbers may be blocked for a short period if an IRSF fraud attack is detected.
• Communication and collaboration: We must be connected digitally to all the stakeholders so that they act tough on fraudulent activities on the network. SLA with stakeholders may be refined and suitably tweaked for faster action. This is one of the key elements when the whole team is working remotely to support daily operations.
• Regular updates on emerging/latest fraud patterns: Frequently visiting the fraud forums to be abreast of the emerging/ latest fraud patterns worked out by the fraudsters. Criminals are always on the lookout to ruin the processes and systems for nefarious ends. Many operators have reported an increase in the robocalls, SMS scam & cyberattack during this period.
• Making fraud management as part of the Business Continuity Plan (BCP): It is very important to incorporate fraud management as part of the BCP in a major way and ensure we have maximum coverage during this period.

In my reckoning, the fraud management teams ought to be more vigilant and agile than ever before to meet the new challenges of telecom fraud becoming rife during this global outbreak of COVID-19. Fraud managers are superheroes when it comes to building trust with the customers.

Stay safe and stay healthy!

To understand how you can detect and prevent scam and spam calls using advanced machine learning models

DOWNLOAD THE CASE STUDY

International Revenue Share Fraud (IRSF) is one of those fraud types that has been alive for two decades now, all because of the fraud being intricate in its pattern while the approach to it being still very reactive. Here, the motive of the fraudster is to receive the revenue share from the termination charge on international premium numbers. The fraudsters abuse the telecom operator’s infrastructure to artificially inflate traffic onto high-risk international destinations with the intention of non-payment. This fraud is common across geographies and has an estimated fraud loss of USD 5.04 Billion (The highest fraud loss contributor) as per the Communications Fraud Control Association (CFCA) Global Fraud Loss Survey, 2019.

Lack of adequate steps taken to protect the network has caused this fraud to grow by leaps and bounds. In this fraud, the attacker usually tries to exploit the vulnerabilities of the Telecom Service Provider’s assets and attacks by either calling to unallocated number ranges or land calls onto international premium rated services or illegitimately route calls to short stopped mobiles. Subscription fraud, PBX hacking, Arbitrage Margin, SIM Cloning, Device theft and abuse of promotional services are often the commonly used methods for executing the fraudulent practices. The fraud is also quite common with many fixed line providers.

In my experience of working with multiple operators, globally, I feel that the most common challenge faced by operators is in understanding the fraud pattern and method used by the attacker. The impact on the operator becomes brutal when fraudsters use unknown patterns of execution and sophisticated techniques to attack the network. IRSF attacks from roaming network, call conferencing, call forwarding, calling cards, negative margin abuse for products and services are among the more popular methods for a fraudster in launching attacks.

Also, the lack of regulatory precedence in governing the way of carrying out business with international carriers is not sufficiently strict, setting the perfect breeding ground for fraudsters to flourish.

Why has this fraud grown in leaps and bounds and how do I ensure control proactiveness?

Traditional and reactive fraud countering mechanisms as of date do not have a full-proof solution, and one of the biggest reasons is that there are not enough fraud controlling strategies, mechanisms, and systems in place. IRSF, unlike other fraud types, requires a continual and proactive measure for control. More than just the “run-of-the-mill” detection techniques, the fraud type requires a well-planned control and mitigation steering strategy and here are six simple strategies, to begin with:

• Fraudulent practices have become cleverer over time.

If we brag of the fact that the fraud detection technologies have become quite sophisticated over time, we must not forget that the fraud practices too have gained an equal amount of intelligence. Fraudsters these days are quick to realize technology loopholes and system fault lines. It does not take much for fraudsters today to detect the fraud finding patterns and control logic of CSPs and identify the loophole in the system. In order to counter the fraudster’s attempt of IRSF, study of method and pattern become a critical process. Also use of SIP monitoring technique to identify devices/tool such as SIP vicious can help telcos to prevent IRSF. A mix of AI/ML techniques and models can be used to detect new IRSF fraud patterns with automation and build IRSF intelligence e.g.: trends in calling patterns.

• Demoralize your IRSF attacker

Letting your attacker attack you to dig his own grave sounds like an oxymoron? Actually not! It is, in fact, possible to have a honey-trap system in place where you lure the attacker to launch the attacks onto it without a fruitful outcome. The more the attacker’s attempts fail, the less hopeful they strive any further. Additionally, gathering intelligence from trusted suppliers who can provide information about prominent fraud groups and support surgical blocking of international number ranges has proved to be a successful strategy globally to counter IRSF.

• Think of the customer and protect their interests

IRSF not just drains away revenue resources but also can cause customer dissatisfaction, causing them to churn out of the network eventually. IRSF not only targets retail accounts but enterprise customer is a key risk group costing the telecom operator millions of dollars. Hence it is crucial that we don’t ignore whenever a customer complains of frequent cross-connections or call diversions for international calls.

• Have an “Anytime-Anywhere” vigilance strategy with automation to your advantage

The detection processes for IRSF may be complicated and resource-intensive at times. However, having the right strategies, the right processes with the right amount of automation applied to them can help the business in a significant way. I personally recommend a 24 x 7 detection strategy to be put in place to counter the IRSF attacks. From the cases that I have dealt with, it’s my observation that though IFRS attacks happen round the clock, however, the wee hours of the morning or off-business hours are critical target. Having a rotational manpower strategy can really work wonders at times. However, there could also be instances where having a 24*7 approach may not be possible owing to the lack of capital or high cost of human resources. In such instances, a mix of the automation of detection processes and human intensive operations during crucial hours will be of value.

• Never ignore negative margins

Negative margins can occur at any level. It could emerge while planning the pricing strategies of the products, services, use of calling cards in international destinations or interconnect agreements. Feeble margins on profits can often open a pandora’s box for fraudsters. Just the basic knowledge on negative margins is enough for fraudsters to break open mayhem. Trend reports on traffic patterns with priorities given to partnerships with frugal margins can save the day!

• Pursue strategic knowledge partnerships to establish fraudster intelligence

Sharing knowledge and having a supportive ecosystem for interaction with carrier partners and vendors in the value chain can be a practical step closer to proactiveness. Also, MoU’s established with industry forums and CoEs like GSMA, CFCA, RAG Blockchain for Wangiri, and others can help CSPs gain information such as PRS test numbers and services, high-risk range numbers, unallocated number series which can be used as vital sources of references to counter this fraud. Telecom operators can also build up the internal defense by establishing service controls e.g. restrictions on the use of international and roaming capabilities for certain customers. And restrict international call forwarding, multi-party calling, etc.

When I say a reactive approach for AI / ML based IRSF fraud detection, I mean that much of the effort and systems built towards countering the fraud are in silos and so are the human efforts that go into it. By a proactive system, I mean a system that is quite unified in its approach and can perform end to end operations associated with the fraud type. A proactive Fraud Management system shall flag the first call in roaming, track significant deviation in usage behavior, high volumes of international traffic to high-risk destinations, sequential dialing, etc. and couple it with the use of knowledge databases like Subex IRSF data intelligence that includes unallocated number ranges, high-risk ranges, known fraudulent numbers to support network-based blocking and/or integration for early identification of high-risk behaviors and automated blocking, where required.

One of the many ways of building a more proactive and unified system is to go the AI (Artificial Intelligence) way. A well thought out AI technology strategy can really help detect the fraud at a very early stage and help you choose the right controls for specific problems in question. It aims to reduce the time taken by the laborious human efforts that go into the detection stage while helping analysts and investigators concentrate on the need of the hour. Much as the famous English saying goes “Every cloud has a silver lining,” the impact of the IRSF can considerably be reduced by just broadening the organizational perspectives towards the fraud.

Subex has recently partnered from Biaas for IRSF data Intelligence, To know how you can benefit from this partnership

Download the flyer

“Lose a credit card and the loss may be in thousands… Lose a SIM Card, the loss is irreparable”

Last week, Twitter CEO Jack Dorsey became the latest high-profile account to be targeted by SIM swappers. Dorsey’s account sent several tweets, including some with racial slurs and others that defended Nazi Germany. Luckily for him, his account was secured soon after, and the consequences weren’t catastrophic. However, there have been many instances where SIM swappers have left victims in a really troubled state – especially the ones targeted for monetary gains.

SIM swap is a type of phishing fraud that poses a serious threat to customer along with the telecom and the banking environments. The SIM SWAP fraudster in here obtains an individual’s banking details through vishing/smishing/phishing techniques or by purchasing these from organized crime networks. They then use this information, including personal details sourced via social media, to pose as the victim to the mobile network operator and fool them into cancelling and reactivating the victim’s mobile number to a SIM in their possession. As a result, all calls and texts to the victim’s number are routed to the fraudster’s phone, including one-time passwords for banking transactions. After receiving a one-time pin or password from a bank, the fraudster can then potentially access the customer’s bank account and transfer funds. The SIM SWAP fraud impacts not just the victim, financially but also the telecom operator and the bank, equally. As non-adherence to consumer interests and protection, in many countries, both the entities (the telco and the bank) are legally liable to compensate the victim for his/her financial losses. When the loss is in millions, the impact is very grave!

Have you ever taken a moment to pause and think from a fraudster’s perspective to counter the fraud? Well most blogs that you will find on the internet on SIM SWAP will tell you ways (in bulletin points) as how to protect your assets from the SIM SWAP fraud. However, I am quite sure that there will only be a handful of blogs that will tell you how a SIM SWAP fraudster thinks in-order to be able to protect your customers from such attacks.

Without much ado, let me take you through the 4 vicious stages involved in the SIM SWAP fraud attack which will help you understand your SIM SWAP fraudster better and stay ahead of them on any given day!

Stage 1 – “Cherry picking and stalking”

Fraudsters are always on the loom to pick on their fraudsters and the social media, has, in a great way helped them in getting away with their desired schemes. A SIM SWAP fraudster may look for a high-profile customer or a prosperous and wealthy business personnel who generally solicits with prospective clients over social media. The SIM SWAP fraudster here could impersonate one such client, send out a connection request and start to closely monitor the victim’s activities. The SIM SWAP fraudster can even hijack an account of the victim’s affiliate to initiate conversations/get more information about the victim. In events where the victim does not have enough digital footprints, SIM SWAP fraudsters have even taken the road of dumpster diving and shoulder surfing!

Stage 2 – “Impersonating the victim”

At this stage, the fraudster has got all the information he/she needed to pass through the authentication protocols required to get hold of the victim’s assets. Once he/she has managed to convince the bank and Telecom Operator of his/her false identity, he/she goes on to take-over the customer’s personal assets such as his/her sim card or his bank account.

Stage 3 – “Swindling at once”

Having gained total control over the victim’s assets, the SIM SWAP fraudster now tries to extract monetary benefits from the victim’s assets at a single go. Here the victim is totally cut-off from his/her mobile network even without knowing it. By the time the victim gets to know that there are transactions carried out on his/her account without their knowledge, the damage is done!

Stage 4 – “Covering it up”

After having caused enough damage to the victim, the SIM SWAP fraudster lets go of the victim’s assets and goes on to hunt for another victim. The SIM SWAP fraudster makes sure that he/she makes enough improvisations to his/her fraudulent schemes so as not to appear like a serial offender, thereby leaving the law keeping forces with very little clue of the fraudster’s whereabouts!

SIM SWAP fraud, unlike many other telecom/bank frauds requires a joint effort from the customer, the bank and the telco. However, catching hold of the SIM SWAP fraudster doesn’t require the brains of Sherlock Holmes! Vigilance and a little proactiveness on how a fraudster might possibly behave can help catch them at a very early stage. To counter the ill-effects of the fraud, top Telecom Service providers like AT&T, T-Mobile, Verizon and other are harping on customer authentication through the 2-Factor method even during telephonic conversations.

However, I personally believe that not much is being done to study transactional pattern anomalies to identify potential fraudsters in the network and its high time bank authorities joined hands with telcos in countering the fraud. E.g. the telcos can notify the banks of change in a customer’s IMEI/MAC address/addition or modification of accounts/transactional abnormalities and then the banks can monitor the customer’s transactions for that week, in priority! Masking methods can be used during exchange of information to protect consumer interests. Telcos and banks can be more proactive by creating a database for reference where any changes made to the consumer’s profiles can be stored and looked up for instances of abnormal transactions. As preventative measures, customers can be advised by both the telcos and the banks to take enough care while sharing very personal and integral information such as card details, social security number etc. on social media or the public internet.  The SIM Swap fraud is known to cause serious collateral damage and reputational loss, however, a little care taken at the right point in time can work wonders!

To know more about how you can stay vigilant about SIM Swap fraud, view this video.