Category: Fraud Management

Speed holds a unique fascination for me. In fact, one of my favorite TV characters wields speed as his superpower. But, as customers, don’t we all love speed? Businesses, too. Think of factories aiming to make products in shorter cycles through just-in-time manufacturing, developers who use agile and DevOps for quicker software releases, and how every business is looking to adopt the cloud because it does things faster at a lower cost.

These days, we find banks advertising account opening processes within minutes, not months, as they used to be. What’s enabling this speed? If we were in a fictional world, the beloved superhero I mentioned earlier, “Barry Allen, the fastest man alive,” would pop into our minds. In the real world, the trigger is similar. It is a new ‘speed force’ named Flash Calling that empowers organizations to accelerate the pace of business.

The Power of Speed

Delivered via telecom networks, flash calls are the latest in verification methods – enabling authentication in a flash! It consists simply of a missed call made to your mobile number.

As a customer, you could receive a flash call to verify a transaction from your bank or a login attempt into your account. It is fast, secure, and does the job without having to manually key in verification information – as one would do with OTPs. It is also much more cost-effective because businesses that use flash calls only need to deliver a missed call, which has lower termination rates than paying for an OTP-carrying SMS.

Frictionless – just like our speedster – and wildly popular, too. There could very well be 5 billion flash calls made in 2022 alone, jumping to 128 billion by 2026.

Operationally, flash calling has an ecosystem of partners involving enterprises, flash call providers, telecom networks, and end customers. Authentication is done on the SIM card using a matrix involving four or six digits of the end customer’s mobile number.

The paradox – Speed can be dangerous

But no modern technology – or superpower– comes without its pitfalls. In ‘The Flash’ series, Barry’s intentions are always pure – to save the good guys and nab the criminals. He uses his superspeed, but this sometimes raises new threats. Fans of the show may recall the dangerous paradoxes he causes by traveling in time.

Flash calls, too, while hugely beneficial to the overall customer experience, create new risks for telcos.

Fraudsters can exploit the loopholes in the channels or bypass the existing anti-fraud measures established by telcos to monitor and prevent fraud.

Dealing with the paradox

Flash calling is potentially a lucrative revenue for telecom operators – provided they protect the channel from fraud. However, regulatory bodies are yet to catch up in assessing the risk landscape of flash calling. Some of the most pressing tasks would be to introduce standards, that could prove helpful in verifying calling parties and securing end-to-end call attestation. Regulators could also mandate legal ways for genuine telecom operators and network partners to intercept flash calls and ensure delivery on secure routes, thereby avoiding grey route exploitation by fraudsters. One caveat here is that the rules should comply with global geo-specific norms.

But until such a time comes, here’s what telcos can do to secure their investments and reap the benefits of flash calling.

• Upgrade security solutions with flash-calling safeguards. This could involve creating safelists of flash calling providers and implementing new fraud controls and protocols.
• Real-time Analytics. This could involve analyzing real-time network and signaling traffic and performing proactive monitoring through signatures and heuristics.
• Create transparency. Sending instant alerts to the relevant stakeholders upon identification of suspicious behavior can help telcos collaborate to combat the exploitation of flash calling services.
• Invest in flexible and scalable solutions. These will be essential to accommodate flash calling demand, which is expected to grow shortly.

Friends of Flash

On its own, flash calling is a new and exciting tool, albeit with a few risks. But rather than shy away from the potential revenue due to possible threats, CSPs should consider a proactive approach. Furthermore, just like ‘The Flash’ depends on his friends and state-of-the-art tech from STAR labs to use his speed for good, CSPs ought to consider investing in modern technologies and harnessing the power of the telecom ecosystem to maximize the value of flash calls.

As Iris West, another beloved character on the show, wisely says, “A little fear can be a healthy thing. It helps you determine which risks are worth taking.”

Subex Fraud Management Solution is built on HyperSense, an AI Orchestration platform that allows CSPs to confidently take charge of new trends through responsive fraud mitigation techniques. Reach us at info@subex.com to know more.

One stop solution to address all types of telecom frauds across Voice, Data and Digital Services

Request Demo

New trends in the telecom industry are causing a stir. For example, the worldwide economic value of 5G will reach US $13.2 trillion by 2035 thanks to improvements in mobile broadband, widespread machine-type communication, and ultra-reliable low latency networks.

A new immersive other digital universe called the metaverse is starting to take shape. It combines augmented, virtual, and mixed realities with the actual world. It may present telecoms with new chances to work with hyper-scalers for seamless service delivery. Developers are eager to exploit 5G’s low latency capabilities to allow edge computing, which could open up a variety of new business opportunities for telcos in the areas of driverless vehicles, virtual reality games, proactive asset maintenance, and smart grids.

The introduction of new technologies also expands the area of work for CSPs to include anything from assessing new partners, services, and products to keeping an eye on network security and eliminating emerging cyber risks.

Telcos are battling a growing fraud landscape in addition to trying to meet customer demand for digital products and services. Some of the scams that have increased during the past year include the following:

• Account Takeover
• Increase in cross-industry targeted social engineering schemes (Wangiri Fraud, SMS Phishing/Pharming, Social Engineering, Robocalls & Scam calls)
• An increase in identity fraud in the financial services sector utilizing credentials acquired from data breaches
• SIM-Swap frauds
• Subscription frauds

The aforementioned fraud methods contributed to massive fraud losses under IRSF Fraud, Device/Handset Fraud, Wangiri, Bypass fraud, PBX hacking, etc.

Fraud trends to watch out for in 2023 

2022 was quite a tempestuous year for the fraud management space globally. Some fraud trends to look out for in 2023 are:

Newer social engineering techniques: Fraudulent assaults that compromise victims’ personal or professional security will increase in the next year. Deepfake and phishing will be used in these sophisticated assaults. Deepfake attacks, which use AI to create fake films and pictures that are difficult to distinguish from real ones, will proliferate and compromise an individual’s or an organization’s security. Also, with recession lurking around the corner, the trajectory of such fraud will go up, and the act of fraud prevention is the immediate need of the hour.

The deployment of 5G technology will probably lead to an increase in the number of Internet of Things (IoT) devices connected to networks, opening up new chances for hackers to conduct more extensive and sophisticated assaults. Attackers will find it simpler to target particular types of traffic, such as IoT devices, thanks to network slicing, which enables the separation and control of various types of data on the same network. Additionally, consumers are more likely to experience security problems, including denial of service assaults, botnet attacks, and man-in-the-middle attacks, due to the unique design of 5G networks.

Rise of Synthetic ID: Synthetic identity fraud is the creation of an identity using both real and false information. The new identity that is created, also known as a synthetic identity, contains enough verifiable information to appear legitimate and may be used to open accounts, make fraudulent transactions, and con telecoms. The internet’s development has made it easier for large-scale synthetic identity fraud and blurred the distinction between traditional crime and cybercrime. By 2023, synthetic identity fraud is expected to reach $2.42 billion, and by 2024, $5 billion.

Scam Calls: The number of scam calls  is increasing daily as threat actors get more inventive in attracting their victims. Some people play on fear while others make false promises, while some appear amiable while threatening victims with grave repercussions. Scam calls are frequently a part of a broader plan. Scammers attempt to get sensitive personal data from their prey in order to carry out more telecom scams. Such fraud may cause customers to experience everything from identity theft to financial losses, while it can also harm telecoms’ reputations and cause revenue losses.

Robocalls: Although there are regulations in place to curb the menace of illegal robocalls, there seems to be no end to it in the near future. Scammers are quick to adapt to obstacles and are constantly seeking clever ways to bypass security protocols, thus continuing to affect telcos and their customers’ experience.

Device Fraud: Device sales are undeniably a revenue opportunity but come with significant risks. In recent years, we have seen a steep increase in the number of device fraud cases, with organized fraud- rings playing a significant role in these crimes, and this trend will continue to grow due to factors such as the advent of 5G, a shift in consumer behavior towards online channels, etc.

Flash Calls: Flash calls are quickly gaining popularity since they are thought to be more affordable than SMS but also quick and secure and contribute to a better customer experience overall. Juniper reports that Flash Call volume will increase by 25 times from 2022 to 2026. Although this is lucrative, fraudsters can exploit these gaps in the channels.

It is paramount for telcos to have a holistic fraud management strategy. One of the critical arsenals is to incorporate ML and AI algorithms in their fraud management systems that monitor networks for suspicious behavior. It has also never been more critical to proactively combat fraudulent behaviors using automated procedures that cancel, halt transactions, or suspend a subscription in real time. On the other hand, it is also vital for telcos to educate their customers on the new fraud tactics used by fraudsters in order to protect them from falling prey to fraud. Through advanced Fraud management systems that are readily deployable, 2023 could provide a more promising light on fraud identification and mitigation.

One-stop solution to address all types of telecom frauds across Voice, Data, and Digital Services

Request Demo!

The holiday season is upon us, and you are probably making plans to travel, shop, and spend time with your families. Planning a holiday has become easier than ever, with the digital world allowing everyone to make all bookings online. Everything is at your fingertips on your mobile phone, and all you need is connectivity, a website or web app, and your debit/credit card. However, did you know that this moment of bliss can turn to tragedy in seconds?

Online scams happen every second, and we as consumers need to keep ourselves on top of the different types of risks that are around us and their implications on our daily lives. Identity theft is one such risk that can result in massive financial loss. In reality, these fraudsters strike even more during the holiday season when you least expect it. For this reason, it is unsurprising that December is the month for National Identity Theft Prevention and Awareness.

Incidents of identity theft and related fraud rose nationwide in 2021, according to the FTC:

• Fraud complaints increased by 19% for the year to more than 5.8 million.
• Financial losses from fraud rose 77% from the previous year to more than $6.1 billion.
• The number of consumer identity theft complaints rose 3.3% to over 1.43 million.

With personal information readily available for fraudsters, here are some of the risks that you need to be aware of and some steps you can take to be vigilant in detecting these frauds and avoiding losses.

Card Skimming: This is a type of credit/debit card theft where a fraudster uses a small device to steal the card information in an otherwise legitimate transaction, like in a restaurant or while shopping. This fraud is usually carried out by a fraudulent employee who uses a fraudulent card scanner to steal the data. When someone swipes a credit or debit card through a skimmer, the device captures and stores all the details like the cardholder’s name, card number, and expiry date stored in the card’s magnetic strip. The fraudster then uses this stolen data to make fraudulent charges either online or with a counterfeit credit card.

Identity theft through Account takeovers:89% of digital fraud losses that occur are due to account takeovers where a fraudster gains access to your account and misuses that information for nefarious means. In some instances, fraudsters also use fake websites, fake emails, and fake mobile apps for users to trick unsuspecting users into granting them access to personal information.

SIM swap: In SIM swap fraud, a fraudster gets access to your mobile number to steal your financial transaction passwords. How do they do this? Once he/she has your number, the fraudster calls customer care to notify you that you have lost your phone. When prompted, the fraudster provides a validation (to prove that he/she is the customer) basis personal parameters like name, date of birth, and email address, all of which are readily available on social media, or a fraudster can obtain these through social engineering methods. The operator then blocks your sim card as mandated. The fraudster then buys a new sim card from your operator “on your behalf” and gets access to all your personal information. SIM swap fraud impacts not just the consumer financially but also the telecom operator and the bank equally. A noteworthy fact is that in many countries, due to non-adherence to consumer interests and protection, both the entities (the telco and the bank) are legally liable to compensate the victim for their financial losses.

Vishing/Phishing: Fraudsters send an email to trick you into clicking on a link that might give the fraudster access to your personal information. Also, in some cases, fraudsters pose as bank customer care personnel to get access to your OTP to carry out fraudulent activity.

Now that we have looked into some of the Identity frauds out there, let’s move to some tips to bolster online security and reduce the risk of identity fraud:

1. Ensure you have turned on two-factor authentication wherever possible. If that’s not available, use strong passwords or a password manager to secure accounts.
2. Do not share details like date of birth, residence address, and other personal information on social media to prevent account takeovers.
3. Secure your online and mobile devices by using a screen lock
4. Encrypting data stored on the devices
5. Avoid public Wi-Fi, especially if you intend to do a financial transaction or access your bank details, or use a virtual private network (VPN) and install best-in-class anti-malware software.
6. Sign up for transaction alerts from banks, credit card issuers, and other service providers to receive notifications and keep an eye out for suspicious activities.
7. Do not authenticate any transaction on a phone call, as no service provider would ever call you to ask for a password, OTP, and more.

Most businesses have some form of a fraud management system to detect and prevent fraudulent activities. These systems can monitor the transactions for anomalies such as high usage, payments, or purchases at an odd time of the day, fake identities, and take necessary actions to avert fraud losses to the consumers. Leveraging technologies such as AI/ML to outsmart fraudsters is paramount. Also, the consumer must pay attention to suspicious transactions this holiday season and secure personal information to avoid financial losses.

Wish you all a happy holiday season!

If you are interested to learn how AI /ML techniques can help you combat Identity Fraud

Schedule a demo!

Telecom is buzzing with new trends that promise to disrupt its current role as a network provider. To illustrate, 5G will turn out US $13.2 trillion in global economic value by 2035, brought on by enhanced mobile broadband, massive machine-type communication, and ultra-reliable low latency networks. The metaverse is emerging as an alternate immersive digital world that merges with the physical one through augmented, virtual, and mixed reality experiences. It could spell new opportunities for telcos to collaborate with hyper-scalers for seamless service delivery. Meanwhile, developers excitedly look to using 5G’s low latency features to enable edge computing, spawning numerous use cases for telcos around autonomous transport, virtual gaming, predictive asset maintenance, and smart grids.

The time is now for telcos to start preparing for a future where their roles shift from infrastructure and network providers to strategic ecosystem players that offer vital services and solutions.

Where opportunity lies, so does risk

The emergence of new technologies also throws open the CSPs’ scope of work into an infinite expanse ranging from monitoring network security and tearing down emergent cyber threats to evaluating new products, services, partners, etc. In the new world, risk professionals may have to refocus their sights on:

• Understanding implicit patterns within data to profile risk so as to protect company investments. High variability in data makes it difficult to arrive at the right decisions. Risk professionals must consider variability metrics such as deviation, ranges, and variances when dealing with multi-dimensional data and seasonality trends.
• Processing a wide variety of data, such as streaming data, data lakes, and protocol data, that are saved in unstructured and semi-structured formats.
• Checking data veracity, such as where it is collected from and the reliability of source datasets, means spending effort to check if data is useable for risk prediction models.
• Dealing with velocity or high-speed data to automate decisions within milliseconds, such as denylisting a blocked call or alerting on fake sales and campaigns.
• Exploding data volumes that need sophisticated tools to handle signaling data, behavioral profiling, partner tracking, transaction monitoring, and more
• Visualizing data using modern techniques so they can unlock value and glean useful insights quickly is a challenge considering the dynamic way data behaves.

Three must-have parameters in AI-led fraud management system

Considering the multi-faceted data that risk professionals must handle, they need sophisticated tools to deal with different risk types, including fraud, AML, data theft, and security breaches. Unfortunately, traditional techniques falter at handling the fluid behavior of today’s data, and this is where machine learning plays a key role.

ML models can mine insights, offer interpretability of results, and provide recommendations. For instance, in some cases, users may very well find that the power of AI is best delivered when accessible at the edge in what is known as edge AI. ML also powers use cases of predictive analytics, network security, and more. From a fraud perspective, it can boost the ability of risk professionals to detect fake caller profiles, illegal access, and incidents of different fraud types, including IRSF, CLI spoofing, etc., through behavioral monitoring of global CSP networks.

When evaluating the business case of investing in an AI-first approach to fraud management systems (FMS), telecom operators should adopt a long-term view of what AI delivers. Here are three aspects that AI-led Fraud Management System must cater to and three ways it reinforces your existing fraud management strategy:

• Self-serve – Risk professionals must make faster decisions to keep pace with the business. For this, they need agile and reskilled teams. AI-based fraud management systems give users agility. It leverages APIs to integrate with any source dataset and feed information into risk decision engines. When risk scores are hosted through APIs, it remains available for other teams to access as a microservice, heightening the reusability of AI in a self-serve manner. Moreover, AI frees resources from repetitive tasks through automation pipelines that work with predictable outputs. It also supports various analytics types, such as statistical, behavioral, predictive, and protocol analysis. Adopting AI itself drives a culture of re-skilling as risk management teams must improve their data literacy and create citizen data scientists who are proficient enough to work with AI models, generate output, and translate the results into business outcomes for faster decision-making on new products and service launches.
• Explainability and recommendations – AI-powered decision-making is crucial for reliable and effective fraud management. By providing the explainability of AI logic, AI-led FMS enables model accuracy, fairness, and transparency. It helps users trust model outcomes and leverage its recommendations with confidence. Moreover, an intuitive user interface with data workflows and a pipeline for risk identification, investigation, and actioning will further enrich the user experience.
• Technology – Cloud-native architecture enables scalability, security, and interoperability. New features, model enhancements, and upgrades can be easily deployed to keep the system resilient and relevant. Additionally, building the tech stack as a containerized model can support the niche requirements of CSPs at lower TCO.

A holistic risk assessment program outfitted with the right tools and processes is key to survival in this disruptive age. Subex’s AI-First fraud management, powered by HyperSense, leverages AI in every step of the fraud management process to enhance accuracy, coverage, and time-to-market and also to enable using AI in a sustained manner. It has over 350 fraud use cases supporting risk professionals in delivering next-gen digital services.

Check out Subex’s Fraud Management System to learn more.

Schedule a meeting

The metaverse will feel like a hybrid of today’s online social experiences, sometimes expanded into three dimensions or projected into the physical world. It will let you share immersive experiences with other people even when you can’t be together—and do things together you couldn’t do in the physical world.

The above is how Facebook, now Meta, defines the metaverse.

In simpler words, the Internet has evolved over the years, growing in sophistication, connections, and technologies. Its upcoming evolution could spawn a world where users can drive deeper relationships, meshed within the economic implications. This world is what we understand as the ‘metaverse.’

The actual term ‘metaverse’ was coined by Neal Stephenson in his science fiction book Snow Crash, published in 1992, to reference a 3D world where humans could interact using avatars. Facebook is one company building a metaverse, as are other giants such as Decentraland and The Sandbox.

While still an ephemeral concept, the metaverse is talked about excitedly in some circles with its potential to leverage 5G, VR, AR, and AI in a much more profound manner. Some reports estimate that the metaverse market will surpass US $1.5 trillion by 2030. This is apart from the US $100 billion market opportunity of metaverse-friendly gadgets and wearables. Many are making investments to understand this space and prepare for the possible opportunities it unlocks. The use cases for gamers are already exploding, and this will most likely be the first frontier for the metaverse.

What can one do in the metaverse?

Borne from the evolved applications of AR and VR, the metaverse represents a kind of converged virtual 3D world that integrates aspects of the physical world and other digital interactions. Users have avatars that can execute actions – real and imagined.

Since the pandemic, much of user experiences and lives have shifted online, giving impetus to the concept of a metaverse. Here are some possible things you can do in a metaverse:

• Create compelling 3D spaces to showcase new products, allowing customers to experience them through AR/VR devices. Nike has already invested in Nikeland, its virtual shopfront that sells digital sports merchandise and sports fashion for avatars of users in the metaverse.
• Build interesting avatars of users based on their different personas and metaverse interactions.
• Plan trade shows, concerts, and art festivals where businesses and customers can interact and even execute deals. For instance, Warner Music Group is partnering with The Sandbox to develop a hybrid musical theme park and concert hall to organize immersive music experiences hosted by top celebrities like Ed Sheeran, Bruno Mars, Cardi B, and more.
• Create next-gen remote workplaces where employees can punch in, attend meetings and training, and collaborate and converse with other meta-employees. For example, a Danish architecture company has designed a virtual office on the Decentraland metaverse for employees at Vice Media Group. Employees can work out of this new ‘headquarters’, meet meta-mentors, and collaborate with their colleagues across the globe.
• Develop meta-enabled schools that align with recognized syllabi and curricula whereby students and teachers can extend the concept of online learning beyond eLearning apps by providing immersive remote education. A Florida-based school called The Optima Classical Academy is building a metaverse school where over 1000 students can choose their courses, attend live VR-based tutorial sessions using issued Oculus headsets, and experience subjects like world history and astronomy like never before.
• Buy/rent homes, stores, and property, build a community of neighbors, and transact and work in the metaverse. For example, a crypto investor bought virtual estate worth US $2.4 million in cryptocurrency in Decentraland, the most expensive purchase recorded by the metaverse platform.

What makes the metaverse unique is that, unlike most virtual reality worlds that are static, the metaverse keeps changing. Each interaction creates data that can be leveraged by businesses and organizations to evolve the metaverse and fine-tune each experience. The applications of AR and VR in the metaverse are unlimited, and many organizations are exploring how they can create new revenue streams or enhance customer experiences through the metaverse. Considering that Facebook already has 2.8 million users globally, imagine the depth of opportunities possible if all of these users could engage in the metaverse and interact in real-time, virtually.

The role of 5G in the metaverse

Building these complicated spaces in the metaverse will require unprecedented download and upload speeds and robust infrastructure, most of which may center on telecom networks. We can expect to see AR/VR applications maturing to include the sense of touch, smell, sound, and more. 5G is the only network technology that can support the massive digital files needed to create such an experience and the speeds at which information and transactions flow through the metaverse.

Thus, as metaverse-enabled technologies evolve, mobile operators have a critical role to play through their investments in 5G, multi-access edge computing, and network slicing. Many are already investing in high-bandwidth and low-latency networks for countless real-time use cases across gaming, surveillance, defense, etc. Looking ahead, they ought to consider building viable business models that allow them to go beyond merely provisioning infrastructure to provide holistic products that can be consumed by metaverse users, such as fraud management and digital identity solutions (for businesses) and wearables and digital avatars (for users).

A prelude to the risks in the metaverse

However, risks lurk behind the shadows. Termed as a potential “scammer’s paradise,” the metaverse is nascent and heavily unregulated. As a result, fraud, piracy, crime, and governance issues loom large. For instance, cryptocurrency may very well be the most popular form of currency for users to transact in the metaverse, despite cryptocurrency crime reached an all-time high of US $14 billion in 2021. Thus, securing the metaverse needs to be a top priority for telecom providers if they are to build customer trust.

Interested to know more about metaverse

Request a meeting

We live in a digital world where everything is available with a few clicks. Whether you want to buy something online, make payments, or log into a popular online service, an OTP (One Time Password) requested via SMS is all you need to complete the transaction. But this process is being replaced in a flash! A huge disruption is being witnessed where flash call verification is swiftly becoming the preferred choice for businesses and service providers as an alternative two-factor authentication process (2FA).

Juniper Research defines flash calling as ‘an authentication process that leverages mobile voice networks to authenticate users or actions.’

Essentially it allows authentication of a user by the last few digits of their phone number. Sometimes flash calling may require some kind of user interaction, such as adding a password/passcode onto a platform.

Flash calling on the rise

Flash calls are fast gaining popularity as it is considered cost-effective compared to SMSes, are swift and secure, and helps deliver an overall better customer experience.

According to Juniper Research, the number of flash calls used for authentication will grow from 60 million in 2021 to an estimated 5 billion in 2022. This is slated to grow exponentially at a CAGR of 128% to a staggering 128 billion calls by 2026! With the rising number of smartphone users, this translates into 20 calls per capita and offers a great opportunity for businesses to add a new revenue stream.

The study further reveals that the total number of flash calls by 2026 will be led by North America, followed by the Indian subcontinent, with the rest of Asia Pacific, Africa, and the Middle East as the subsequent larger markets.

How it will impact CSPs

Reports suggest that authentication-based messaging is expected to generate $39 billion in revenue for mobile operators, which would account for about 5% of total billed revenue for 2022. However, as brands look to migrate their authentication traffic to voice, flash calls have the potential to substantially disturb SMS revenue, resulting in significant losses for CSPs.

Another foreseeable challenge is the increased competition from Over the Top (OTT) messaging apps. Operators have traditionally been slow to implement new services, making them less agile. On the other hand, OTT players are quick to identify market trends and pivot to cater to the changing demands of consumers. Various OTT players, such as WhatsApp and Imo are already looking to integrate flash calling within their apps, giving them a headstart to grab a large portion of the flash calling pie. All this means that there is a greater need for the telcos to monetize flash calls.

At the same time, flash calling by OTT players is not without challenges. There have been reports of users losing access to their accounts after they shared six-digit verification received on the platform with someone claiming to be from the company.

Monitoring and monetizing flash calls

As of now, most service providers don’t use the technology required to effectively identify and monitor flash calling traffic and, thus, are not in a position to monetize it. This problem is likely to become intense as the volume of flash calling authentication calls is likely to touch 130 billion by 2026, growing from just 60 million in 2021, according to Juniper Research.

Juniper Research believes that mirroring the business models of the established A2P SMS market, which relies almost exclusively on being charged on a per-traffic basis, will be key in increasing adoption amongst brands and enterprises and helping CSPs monetize from the flash calling disruption.

The telcos then must implement solutions that allow them to detect and validate this traffic to grow their revenue. Additionally, CSPs need to adopt cutting-edge technologies to create an environment that can fully monetize flash calls. It is crucial they leverage new-age solutions that can help them regain their power, as well as protect A2P revenue streams.  The need of the hour is that CSPs look for solutions such as fraud management systems, which monitor signaling traffic in real-time and also encompass complex ML algorithms and pattern mining tools to detect any suspicious behavior in the traffic and monetize it effectively.

One stop solution to address all types of telecom frauds across Voice, Data and Digital Services

Request Demo

McKinsey estimates that the cloud will generate over a trillion dollars in value by 2030 and one of the top 10 industries set to benefit from this is telecommunications.

If you wonder where McKinsey’s “trillion-dollar prize” comes in, it is from trends like rejuvenation within IT systems that promise cost optimization and digitalization, as well as trends like innovation that help transform products, services, and the whole enterprise. A top hyperscaler estimates that only 3-4% of enterprise IT workloads currently reside on the cloud, highlighting the hidden opportunity of the cloud.

Getting to know the cloud

In IT parlance, ‘cloud’ often refers to the public cloud, the playground of titans like Amazon Web Services, Microsoft Azure, and Google Cloud Platform. In the public cloud model, telecom operators host their systems and migrate data to the public cloud infrastructure. But public clouds do report a higher incidence of security breaches and attacks; a challenge addressed through private cloud. Another novel option is the hybrid cloud, a combination of public and private clouds. These can store sensitive data and run critical workloads at maximum security while offering the scalability and cost advantages of the public cloud.

The good news is that the cloud is evolving into newer models that can be tailored to different telecom needs. As per one of the reports by Analsys Mason mentions that 5G and open networks will create “multiple cloud domains such as mobile core cloud, vRAN cloud, and network and enterprise edge clouds.” Edge cloud is where the public cloud stack runs on-premises at the Edge data center (as in the case of AWS Wavelength) without having to shift all the data to a centralized cloud server.

Cloud for telecom fraud management

Fraud management solutions include data ingestion, detection, monitoring, analyzing data, and protecting from future events. First-hand, we see transaction volumes rise from 100 million to 100+ billion per day over the past ten years. From call detailed records to internal systems, data sources are growing, creating many new ingestion mechanisms. This ‘source data explosion’ puts a heavy demand on systems to capture hot data and uncover patterns. Neither is the rule-based processes of yesteryears agile enough to handle big data.

Here are four ways by which the cloud can help telecom operators get the best from their fraud management solutions:

1. Telecom frauds are varied and fluid, morphing with technology. Sometimes, CSPs need modern fraud management tools that require next-gen resources. For instance, subscription fraud may require deep learning algorithms and cognitive neural nets, which cannot be run on CPUs but need GPUs. Similarly, detecting International Revenue Share Fraud (IRSF) could be more effective with classifier-based algorithms like decision-trees. Cloud’s on-demand provisioning helps fraud management teams quickly scale resources to detect and thwart attacks during critical events or to retrain models for accurate prediction.
2. Cloud helps CSPs achieve sizeable Capex savings by changing how their fraud systems operate through scalable computing based on traffic, launches, etc. For instance, telecom transactions tend to happen during business hours or weekends, peaking fraud compute requirements during these hours. Traditionally, CSPs would design their systems to handle such peak loads, leading to idle resources for the remainder of the time. Cloud eliminates the need for costly investment through its pay-as-you-go models.
3. Tracking ROI is challenging because of the changing nature of fraud, which mandates constant upgrades and agility. SaaS fraud models cut Capex-heavy hardware and licensing costs and provide clear ROI views. Cloud also offers other IT benefits like migrating from monolithic architecture to granular microservices-based architecture that can be deployed on containers. It gives CSPs the freedom to rapidly deploy on-demand requirements and get instances up and running quickly at the click of a button.
4. Adopters of cloud often remark how iterative, rapid, and agile innovation becomes. Cloud-native practices support continuous delivery, taking innovation out of the lab and into the real world through fast and frequent feedback loops. It facilitates DevOps to shorten system development lifecycles with high software quality. It also accelerates the delivery upgrades and latest functionalities to fraud management systems, allowing CSPs to improve monitoring.

Challenges to prepare for when using the cloud for fraud management

Securing infrastructure is a concern across all cloud environments. Some data hygiene practices to focus on are using advanced data encryption and data management tools, conducting periodic vulnerability assessments, and enabling continuous monitoring of events like security violations. The attractive hybrid cloud model supports cloud-native practices like microservices, Kubernetes, object stores, and containerization. Interoperability is key to ensuring that the cloud delivers expected value.

On another note, the ‘cost of cloud’ could very well be a double-edged sword. Indeed, on-demand provisioning allows better cost control. But without proper monitoring (like retiring instances at the end of a project), enterprises will continue to pay for unused resources. This is also true when managing the infrastructure, as there may be some cloud-native versions that are more cost-effective.

Finally, telecom fraud management systems deal with a lot of PII data, making compliance complex. When leveraging the cloud, fraud, and IT, teams must adhere to local data security laws, enforce robust protections standards, and be careful with access privileges.

Key takeaways/strategies

New technologies rarely have a one-size-fits-all model. Here are some recommendations to guide your fraud management transformation on the cloud:

• Experiment, fail fast, and iterate – Rather than a big-bang approach, try an iterative one that clarifies the end goals but also has a mindset of testing often, failing fast, and iterating quickly.
• Emphasize local governance – Security standards are constantly changing. Keep abreast of these to drive new efficiencies and cost-effective compliance.
• Prioritize security and strategy – Define access privileges cautiously to minimize vulnerability. There should be no compromise on data security.
• Follow cloud-native best practices – This promotes operational agility and maximizes ROI from cloud investments.

One stop solution to address all types of telecom frauds across Voice, Data and Digital Services

Request Demo

The CFCA’s biennial survey is quintessential for every communication service provider as this report captures the latest fraud trends and the evolving threats.

The 2021 CFCA Fraud Loss report is interesting on many counts

1. It shows the dynamic nature of fraud and how escalating fraud losses continue to plague the telecom industry.
2. It introduces IoT and 5G as entry points to fraud.
3. It also touches on a critical telecom security topic that isn’t discussed much – signaling traffic and signaling security.

What’s common between the pandemic and 5G?

Covid-19 scams have been flooding telecom networks, defrauding unsuspecting, vulnerable, and fearful citizens of precious dollars under false promises of treatment, cures, vaccines, stimulus packages, and more.  

International revenue sharing fraud remains the topmost fraud method in 2019 and 2021, costing operators a whopping US $6.69 billion (1) 

This trend is likely to continue with the advent of 5G. 

The common link – both are changing the fraud landscape and driving up fraud losses.

Now add low-cost IoT devices into this potpourri!

To meet the growing demands for having connected devices and address specific communication-based needs and yet offer a very economical, low-cost ownership approach means that these devices are feature-focused with very little to no security built on them. The rate of adoption of such devices has been accelerated with the connectivity advantage provided by 5G.

The biggest elephant in the room to speak are fraudsters, who have got busier than usual. In 2021, there has been a 28% increase in fraud, amounting to US $11.6 billion in fraud losses (1).

To compound it, fraud methods have also changed. There has been a shift from subscription fraud, payment fraud, and PBX hacking, which were trending in 2019, to caller ID spoofing, Wangiri, and SMS phishing (1, 2) in 2021.

How to complement existing fraud management systems and address the emerging fraud risks?

Back in the days when the scope of telephony was limited to public switched telephone networks (PSTNs), the most common signaling architecture was Signaling System 7 (SS7). It was built on the architecture of trust, which in the current world of schemes is prone to breaches.

With a plethora of tools and techniques freely available over the internet, SS7 networks are susceptible to attacks. Lack of security controls, protocol vulnerabilities, lack of awareness, and lack of monitoring tools has exacerbated this issue.

These days, IP networks are in vogue as they facilitate an alternate, economical solution to SS7. Several protocols facilitate Voice over IP (VoIP) such as TCP, MGCP, SCCP, and H.323 (4). Of these, Session Initiation Protocol, or SIP, is the most common. (Read this article to learn more about SIP and its security challenges.). The SIP protocol is vulnerable to attacks as well.

The majority of the telecom operators are utilizing a reactive approach to process call detailed records (CDRs) for identifying SS7 and SIP-related hacks and technical frauds such as Wangiri, Ip-PBX hack, CLI Spoofing, Robocalls among others.

The investigation is limited to post-event analytics that kicks in only after the fraud has occurred. Despite this, CDR-based fraud management systems are prevalent in 88% of telecoms. 70% still use rules-based reporting to detect fraud and 38% have no real-time threat detection capabilities at all (1)!

Rule-based anti-fraud systems work on the principle of limits. Sophisticated Fraudsters at times tend to fly below the radar or use other methods (like mimicking human behavior) to avoid detection. This way, successfully infiltrating the network and continue defrauding the network for an extended period until detected.

What becomes clear now is that new types of fraud and attack predictability aren’t covered optimally in traditional fraud management systems. Compounding this is the overall lack of automation and limited AI/ML capabilities to predict unknown unknowns. Currently, 13% of CSPs have integrated AI/ML into their FMS, and this number needs to increase to effectively combat fraud. Moreover, automation is limited, and 30% of telecoms still use manual processes for fraud management (1).

Let’s examine why this is an efficiency problem. The highest percentage of telecoms, 20%, update their existing fraud control only whenever needed. The situation is bleaker when instituting new controls: 35% report that they do so only on a need basis (1). This kind of ad-hoc fraud coverage leaves much room for error, leaving CSPs, their networks, and their revenues exposed.

Real-time signaling security: A practical fix

The way forward is to look at a signaling solution that monitors packet flow within the Signaling protocol stack (SS7, SIP, etc.), starting at the network layer and going all the way up to the application layer (referenced using the OSI model*, although for IoT we understand the network stack looks slightly different) to utilize metadata and payload (if required) for detecting fraud and security breaches.

Monitoring specific signatures and patterns within network packets will help proactively identify the technical frauds (Wangiri, CLI Spoofing, RoboCalls, IP-PBX hacking, among others) faster.

By tracking the attack origination and correlating these with high-risk behavior, telecoms can sniff out threats faster and with more certainty. These steps secure the network from those looking to exploit vulnerabilities in IP layers.

(Read this article for five use cases of real-time signaling security.)

Protect telco revenue with real-time signaling security

The proactive signaling security complements the traditional fraud management system and comes with many benefits. It minimizes fraud run-time, improves fraud detection accuracy, and enhances the user experience. It also protects CSP revenue, which can be repurposed for other investments such as improving service and experience quality, upgrading the networks, and confidently taking up new projects.

References

1. CFCA Fraud Loss Survey Report 2021
2. CFCA Fraud Loss Survey Report 2019
3. https://www.techtarget.com/searchnetworking/definition/Signaling-System-7#:~:text=Signaling%20System%207%20(SS7)%20is,network%20are%20called%20signaling%20points.
4. https://www.unitedworldtelecom.com/the-definitive-guide-to-voip-protocols-standards-and-services/#:~:text=The%20most%20common%20VoIP%20protocols,like%20MGCP%2C%20SCCP%2C%20etc

One stop solution to address all types of telecom frauds across Voice, Data and Digital Services

Request demo

2007 was a remarkable year in many ways for me as a graduate student and a tech-enthusiast.

It was the year when J.K Rowling wrote her final book, ‘Harry Potter and the Deathly Hallows’, which I read and re-read with much enthusiasm, and the year that marked the beginning of ‘iPhone mania’.

It was also the year when the largest mobile network operator in Kenya, Safaricom (part of the Vodafone Group), launched M-PESA – an innovative payment service for the unbanked.

This heralded a new era for mobile customers, allowing them to leverage telecom providers beyond the traditional use of voice and SMS. They could use network provider infrastructure for financial transactions, money transfers, and other services without having to hold bank accounts.

Fast forward to 2021

Now, it is a sea change. Mobile money has grown to become a significant contributor to the overall revenue for most Asian and African operators. By the end of 2018, there were over 866 million registered accounts in over 90 countries processing over US $1.3 billion a day. 2019 marked a major milestone for the mobile money industry with over 1 billion registered accounts across 290 mobile money deployments in 95 countries, processing over US $1.9 billion a day. This was the year when the industry first witnessed 57% of digital transactions values that exceeded the cash-in/out values and the US $22 billion in circulation.

When the world was hit with Covid-19 in early 2020, it quickly became clear that mobile technology was vital to keep the world connected. More importantly, it became evident that mobile money could play a critical role in providing safe, no-contact way for payments for life essentials, including food, electricity, daily grocery supplies, money transfers to friends and family, etc.

The year 2020 saw an increase of 17% year-on-year in the number of monthly active accounts, 5.2 million unique agent outlets, and US $500 million digitized transactions per day by agents globally. Despite the difficulties during the pandemic, there was a significant increase in the adoption of digital technology. No-contact and restricted movements made digital payments a necessity. This saw an increase of 12.7% in the number of registered mobile money accounts.

Risks of Using Mobile Money 

Being relatively new to the market, mobile money has several loopholes by way of operations, regulations, and user knowledge. Also, being a fast, cheap, and easy way to transact makes it increasingly susceptible to attacks like money laundering and fraud.

On October 3, 2020, MTN Uganda was forced to suspend mobile money transactions on its network after discovering that hackers had breached the payment system through one of their partners, a finance aggregator. The hack, executed using 2000 mobile SIM cards, resulted in the theft of nearly US $3.2 million dollars. 

This example is one among many frauds that permeate the mobile money network. Mobile money attacks arise from different sources – from within the network, through agents, customers, employees. It can also be part of wider schemes to steal financial data. Some of the common mobile money attacks are shown in the figure below.

Types of Mobile Money Attacks

• Fraudulent top-up using compromised or stolen credit-cards
• Identity or subscription fraud
• Dealer or agent fraud
• Commissions fraud
• Internal fraud (employee collusion)
• Social engineering fraud
• SIM swaps
• Roaming fraud
• Foreign exchange (exploiting currency differences during deposit and withdrawal)

Source: GSMA Mobile Financial Services – Fraud Risk Analysis

Without the right controls, mobile money presents increasing business, financial, operational, and compliance risks. On the business side, it can also lead to identity theft and impersonation. Financially, it breeds laundering by exchanging counterfeit notes for digital money or spoofing transactions to withdraw cash. On the operations side, it may cause a lack of electronic float and abuse of customer details. Finally, from a compliance perspective, it presents risks arising from inadequate KYC and screening of PEP and sanctions lists.

According to an Interpol report, transaction fees for mobile money networks are lower than traditional banks, making it lucrative for criminals to section big transactions into many smaller ones to avoid detection. In fact, one of the most dangerous and costly risks is money laundering. In money laundering, the objective of the launderer is to conceal their identity, source, and destination of the money for organized crime, financial fraud, arms dealing, terrorist financing, etc. Funds are simply transited through various accounts and financial systems. The rapid speed of transactions and minimal face-to-face interactions make mobile money a viable channel for money laundering.

The cost of money laundering is heavy for telecom operators. According to research from Fenergo, regulators across the globe issued more than US $10 billion in anti-money laundering fines to financial institutions in 2020. Nearly 198 fines were issued to global financial institutions in 2020 for non-compliance with AML, KYC, data privacy regulations. Global data privacy fines amounted to US $88.6 million, while AML and MIFID (Markets in Financial Instruments Directive) breaches in US, Europe, and China by 203 individuals led to fines of US $88.8 million. Controlling money laundering involves detecting suspicious transactions and reporting them to the correct authorities. This, in turn, requires strong monitoring controls.

Fraud Monitoring Controls 

With years of experience in fraud management, Subex has seen the types of fraud becoming more ingenious and innovative in methods. In the same vein, it requires dedicated commitment and effective monitoring controls such as:

• Customer and agent/dealer dedupe controls
• Transactional controls at all levels (customer, dealer, device, etc.)
• Internal fraud controls
• Advanced machine learning techniques to automatically segment customers based on predictive models and identify complex fraud techniques like smurfing or layering

A stitch in time

Robust processes and appropriate solutions are needed to deploy numerous fraud controls in real-time. It calls for powerful machine learning techniques, AI-driven AML monitoring, and real-time visualization tools to combat the existing and future threats in the mobile money landscape. Other capabilities like risk categorization, AML watchlists, and activity monitoring can protect mobile money networks from criminal activities and fraud attacks, thereby securing them for safe financial transactions and revenue growth.

Download this point of view to know how CSPs are minimizing losses and enhancing user satisfaction.

Learn more

“While there is no silver bullet in the endless fight against scammers, STIR/SHAKEN will turbo-charge many of the tools we use in our fight against robocalls: from consumer apps and network-level blocking, to enforcement investigations and shutting down the gateways used by international robocall campaigns.” Jessica Rosenworcel, acting Chairwoman, FCC (1)

Call spoofing is a menace to phone users across the globe. The intention behind these calls varies from simply maximizing the chances that the receiver will pick up the call to being part of a grander fraud scheme to steal identities, financial details, and more.

Fraudulent robocalls will cost customers US $40 billion in 2022, up from US $31 billion in 2021, according to a study by Juniper Research (2).

The alarm is officially raised. In March 2020, the US-based Federal Communications Commission (FCC) directed the telecommunications industry to actively and innovatively seek ways to combat robocalling.

One of the prominent standards to start with is STIR/SHAKEN. Short for “Secure Telephone Identity Revisited” (STIR) and “Signature-based Handling of Asserted information using toKENs” (SHAKEN), the framework provides mechanisms that avert caller ID spoofing. By verifying caller IDs, the framework helps receivers identify that a robocall is, in fact, a robocall versus a legitimate call (3). The deadline for communication service providers to fully implement STIR/SHAKEN was June 2021.

How can standards help? 

The STIR/SHAKEN framework uses digital certificates based on common public-key cryptography techniques to ensure that the calling number of a telephone call is secure.

Those providers that fail to implement STIR/SHAKEN and register themselves in the robocall mitigation database won’t be able to provide domestic voice traffic services (4).

The protocols themselves reinforce the telco network’s ability to prevent caller ID spoofing. STIR is the actual technology that fights illegal spoofing using digital certificates that cross-check the accuracy and validity of a calling number. SHAKEN guides telcos on how to properly implement STIR technology within their networks.

The STIR/SHAKEN workflow 

• The originating telephone service provider receives a SIP INVITE.
• The call source and the calling number are checked by the originating telephone service provider to determine how to attest to the validity of the calling number.
  • Full Attestation (A) — The service provider has authenticated the calling party, and they are authorized to use the calling number.
  • Partial Attestation (B) — The service provider has authenticated the call origination but cannot verify that the call source is authorized to use the calling number.
  • Gateway Attestation (C) — The service provider has authenticated from where it received the call but cannot authenticate the call source.
• The originating service provider creates a ‘SIP identity header.’ This notes details like the dialer’s number, the number being dialed, timestamp, attestation type, origination identifier, etc.
• These two information buckets or digital certificates – the SIP Invite and the SIP Identity header – are sent to the destination service provider that passes it to the verification service.
• The digital certificates are verified against the public certificate repository through a complex process, after which successful verification deems that the dialing number is not spoofed or illegal.
• The call is approved for the destination service provider, and the call completes its journey, reaching the final party.

Shaking up a stir across the globe 

STIR is a globally accepted standard that can be implemented in any country. On the other hand, SHAKEN is specific for the United States (6).

America has been enthusiastic about its adoption of STIR/SHAKEN. Verizon, an American telco and one of the largest in the world, implemented the FCC’s industry mandate by March 2019. It has fully upgraded its wireless network to STIR/SHAKEN (5). This move has allowed Verizon to protect more than 78 million customers from over 13 billion spoofed calls!

By 2021, many other top US mobile carriers followed suit in adopting STIR/SHAKEN, such as AT&T, T-Mobile, and US Cellular (1).

At the heels of the US, other countries are evaluating the STIR/SHAKEN standards and their effectiveness in combating illegal call spoofing according to their unique needs.

Take the case of Ofcom, UK’s communications regulator, which plans to fully retire copper lines and adopt VoIP from the PSTN by January 2025 as a step towards implementing STIR/SHAKEN. But since the UK does not have a national telephone number database of assigned numbers, NICC, a UK-based tech forum, has suggested a three-phased approach for transition. Other examples are Canada and France.

Teething troubles with STIR/SHAKEN

While STIR/SHAKEN can be lauded for its advantages, it also has shortcomings.

This is why even though the deadline for implementing STIR/SHAKEN is behind us, completely getting rid of spoofed calls remains an uphill task.

Here’s why:

• No compulsion for smaller providers – Small providers having less than 100,000 subscribers are exempt from the FCC mandate; they qualify for a two-year extension. Certain other extensions have also been made for non-IP portions of provider networks, making them the preferred route for scammers now (6).
• Copper landline wires – Landline phone networks have also not been able to deploy STIR/SHAKEN as copper landlines are unable to support this technology (1).
• Not applicable on SMS – STIR/SHAKEN applies to only phone calls and not SMS services. Scammers can still bombard millions of unwitting users with illegally spoofed messages over SMS (9).
• A costly avenue – Implementing STIR/SHAKEN is a costly affair.

More to be done! 

Telecom may be far from achieving spoof-free, networks but implementing STIR/SHAKEN standards are a step in the right direction.

Scammers are quick to adapt to obstacles and are constantly seeking clever ways to bypass stronger security protocols. Nations and legitimate providers must work together to create interoperable standards that weed out the menace of illegal and malicious robocalling.

Regulators like the FCC must study the effectiveness of STIR/SHAKEN standards, addresses concerns periodically, and find the right tech partners to make implementation seamless and cost-friendly.

References

1. https://arstechnica.com/tech-policy/2021/07/us-hits-anti-robocall-milestone-but-annoying-calls-wont-stop-any-time-soon/
2. https://www.juniperresearch.com/press/robocall-fraud-to-cost-consumers-$40bn
3. https://www.consumeraffairs.com/news/major-phone-carriers-confirm-theyve-met-the-fccs-mandate-on-robocall-protection-070121.html
4. https://www.natlawreview.com/article/fcc-reminders-re-stirshaken-and-robocall-mitigation-database
5. https://www.verizon.com/about/news/over-78-million-verizon-customers-protected-over-13-billion-unwanted-calls
6. https://www.dwt.com/insights/2020/10/fcc-stir-shaken-robocall-mitigation-plan-deadline
7. https://www.latimes.com/business/lazarus/la-fi-lazarus-robocalls-fcc-task-force-20170901-story.html

Combating Robocalls with Multi-Tiered Detection and Prevention Approach

Download the point of view