Fraud Management Systems in Telecommunications: a practical approach

Luis Cortesão
PT Inovação, R. Eng. José Ferreira Pinto Basto 3810 -106 Aveiro, Portugal
Phone: +351-234403510, Fax: +351-234420722, e-mail: [email protected]
Filipe Martins
Telbit – Tecnologias de Informação, R. Banda da Amizade, 3810-059 Aveiro, Portugal
Phone: +351-234425095, Fax: +351-234425098, e-mail: [email protected]
António Rosa
TMN, Av. Álvaro Pais 2, 1649-041 Lisboa, Portugal
Phone: +351-7914918, Fax: +351-7914404, e-mail: [email protected]
Pedro Carvalho
PT Inovação, R. Eng. José Ferreira Pinto Basto 3810 -106 Aveiro, Portugal
Phone: +351-234403481, Fax: +351-234420722, e-mail: [email protected]

Abstract1— Telecommunications fraud is a problem that affects

II. FRAUD
all operators and is an important factor in their annual revenue
losses. Aside from financial impact, it also constrains new service Fraud in telecommunications can be very complex and
deployment and may contribute to adverse costumer perception transversal to the operator structure. The authors propose a
and, consequently, churn increase. This paper generically classification method used in the FMS case management that
presents the most relevant types of fraud in telecommunication allows a better characterization of the fraud phenomenon and
services and how the usage of a process adapted and technology enables a detailed reporting. The approach used is based in
up-to-date Fraud Management System is crucial in reducing the the 3M’s classification:
impact of fraud into the telecommunication operators business.
3 M’s Fraud Classification
I. INTRODUCTION
In today’s competitive market, shareholders have been
placing great pressure on telecommunication operators to
obtain larger profits, increase efficiency and simultaneously Motive Means Method
reduce costs. Unfortunately, for many operators that have
reached the mature phase of their business cycle, the Fig. 1. 3 M’s fraud classification
possibility of increasing profits by raising market share is
increasingly difficult. Higher profits can more easily be Motive: the fundamental objective of the fraud.
obtained by maximizing efficiency and introducing new 1. Non-revenue fraud, making use of a service with intent to
services in their already installed infrastructure, through an avoid the cost but without the intention of making
increase in traffic and other service revenue sources, money. It includes providing no-cost services to friends
reduction of costs and elimination of losses. With this in or private usage.
mind, one important factor that should always be identified as 2. Revenue fraud, which intends financial benefits as in Call
a source of revenue loss is fraud. Selling or Premium Rate Service (PRS) fraud (described
Several international organizations have estimated that below).
fraud may affect between 3% and 6% of an operator’s gross
revenue. Having an efficient fraud management system may Means: the nature or form of the fraud used to satisfy the
help reduce those values by contributing directly to the motive. Some examples:
detection and resulting reduction of bad debt and fraudulent 1. Call Selling: sale of high tariff calls – usually
service usage. international – bellow their market value with the intent
This paper starts by generically describing common fraud to evade the operator payment.
types and Fraud Management Systems most common 2. Premium Rate Services (PRS) Fraud: inflation of the
features. It then describes the “Centaur FMS” general revenue payable to a Service Provider by generating calls
architecture and specific detection tools and how they may be to a PRS line.
used in some specific fraud detection scenarios. It concludes 3. Surfing: use of other person’s service without consent
by referring some future perspectives in fraud detection. which can be achieved, for example, through SIM card
duplication (cloning), illegally obtaining calling card
authorisation details or PBX hacking.
 4. Ghosting: refers to obtaining free or cheap rate through by fraud analysts. Some of the relevant techniques used in this
technical means of deceiving the network. It can be stage are rule–based detection and profiling through Artificial
performed, for example, by manipulating switch or Intelligence (AI) techniques like neural networks or decision
database contents to ‘alter’ call records. trees.
5. Sensitive information disclosure - involves obtaining Fraud analysts investigate alerts by accessing all relevant
valuable information (e.g. VIP client details or access information (detailed client/account information, associated
codes) and selling it to external entities. This fraud is Call Detail Records, alert details, client alert history…)
usually performed internally. needed to conveniently assess the alert. Alert clarification
6. Content stealing: a more recent type of fraud, which may also benefit from graphic information describing client
deals with getting high value contents (videos, ring tones, consumption profile.
games) for free, by exploiting the non real-time pre-paid Detected fraud cases are then forward to a case manager to
billing pre-paid system (hot-billing) or by avoiding initiate subjacent bureaucratic processes subsequent to fraud
payment of the invoice (post-paid services). identification. All relevant information (e.g., CDR details,
detailed client information, related alerts…) is attached to the
Method: the generic fraud method. case and the specific case fraud is classified (involved
1. Subscription: fraudulent subscription obtained with false services and fraud motives, means and methods) along with
credentials that allow debt accumulation by systematic financial indicators quantifying performed fraud detection
payment avoidance. gains against fraud losses.
2. Technical: more advanced fraud that is based in Finally, the system must provide friendly and complete
exploiting loopholes found in the operator network reporting tools, thus allowing access to all relevant
elements or platforms. information to analyst, fraud process manager and system
3. Internal: inside information systems abuse management information.
4. Point of Sale: when the dealer manipulates sales figures Fraud tackling efficiency may also benefit from seamlessly
to increase the compensations paid by the operator integrating and cross-referencing multiple data sources (client
and billing information), which may enable focusing on most
suspicious alerts.
III. FRAUD MANAGEMENT SYSTEMS OVERVIEW Versatility and adaptability of fraudsters imply usage of
As previously stated, fraud analysts tasks clearly benefit different tools and technologies for each scenario. These tools
from using a Fraud Management Systems (FMS), whose main must handle huge data volumes (e.g., billions of call records)
architectural components are illustrated in Fig. 2. and allow the integration of any new relevant technology.
Additionally, the regular advent and new services and client
growth implies easily scalable tools.

IV. CENTAUR FMS OVERVIEW

Centaur is a newly developed FMS whose main focuses are
flexibility, adaptability and integration. It has a plug & play
architecture that allows its administrator to activate or
deactivate any of its features. This plug & play architecture is
crucial for the integration of newly developed detection and
analysis techniques that may be required for emerging fraud
scenarios.
Centaur has a context-based approach for the detection of
Fig. 2. FMS generic architecture. fraud. Contexts are entities that can be used as detection
targets, i.e.: MSISDN (Mobile Subscriber ISDN), accounts,
A FMS should be able to collect data from multiple formats network cell, handset, IMEI (International Mobile Equipment
and sources, and through a process of data preparation and Identity), IP address, etc.
mediation, conveniently process and adapt it to the system These contexts are also used in the definition of Lists used
internal data formats. Some of the relevant processes of this to store groups of elements with common features. Most usual
stage are data filtering, call assembly and call rating. With lists are, e.g., Hot Destinations, Blacklisted Handsets, Safe
some FMS tools, it is possible to perform data enhancement Accounts, Suspicious Cards or Suspicious Cells.
through cross-relation of different data sources, which may A List can be associated with Multipliers. Multipliers are
boost performance in some more complex detection used to increase or decrease thresholds for the elements of the
techniques. List in specific detection processes.
Subsequently, detection processes are applied in order to The most common detection processes tend to consider the
generate alerts on situations that deserve closer investigation behaviour of the chosen context over a specific time period.
This time period is called time-window and each detection
process can be associated with several time-windows. For
instance a Many Short Calls alert can be issued over an
hourly, daily or weekly time window.
One common and flexible detection process is rule-based
processes created by the analyst using a wizard. The analyst
can choose the context, the record characteristics he wants to
analyze, over which time window and when should an alert be
issued.
More advanced detection processes, that take advantage of
neural networks and decision trees are also available. These
processes can be used to create client profiles. When a client
profile deviation is detected an alert may be issued. Another
useful detection process uses known fraudster profiles to
encounter new “instances” under a different number.

Fig. 3. GSM Card Reader

V. FRAUD MANAGEMENT WITH CENTAUR FMS
To detect cloning, Centaur FMS uses several different
A. Call Selling Operation techniques, namely call collision, call velocity and customer
profile deviation.
In simple terms, Call Sell Operation (CSO) is the sale of
A call collision alert is issued whenever two or more calls
high tariff calls (usually international) below their market
overlap for more than a specified amount of time. A call
value. Usually, the fraudster uses counterfeit documents to
velocity alert is issued whenever two or more calls are made
apply for services in order to escape the payment and
from different locations but the average time to travel
subsequent identification.
between those locations is higher than the time elapsed
Centaur FMS considers several inputs - e.g. existing Call
between those calls. A customer profile deviation alert is
Data Records (CDR), customer details, high risk destinations
issued whenever a substantial call pattern deviation occurs.
list, etc - to detect this type of fraud.
When these alerts occur, Centaur correlates them and
For each defined time window, Centaur groups CDRs by
presents a consistent scenario indicating a possible cloning
client/account and, whenever the defined thresholds are
case to the fraud analyst.
breached, an alert is launched. The most common thresholds
If a positive case is detected, the analyst initiates several
considered are cumulative amount, cumulative duration,
actions: notify the user that he needs a new SIM; block the
number of calls, number of distinct country destinations,
cloned SIM in the Home Location Register (HLR); notify
number of international calls, and client/account age.
billing system for bill scrubbing (only if the user is
The investigation stage of this kind of fraud is relatively
completely innocent) and register the fraudulent profile for
expedite as the most common criteria are client antiquity, how
future detection.
much was spent and how much was already paid.
When in doubt, the analyst can automatically schedule and C. GSM Gateway Fraud
send a letter to the possible fraudster, asking him to pay in
GSM Gateway Fraud occurs when call resellers use GSM
advance a specific amount. If the client fails to comply it is
Gateway devices to transform interconnect (off-net) calls to
considered to be a fraud case that has been detected before
"mobile-to-mobile" on-net calls (Fig.4). This way, traffic
full damage could be done.
delivered to GSM operators by unlicensed carriers is billed as
B. Cloning on-net rather than interconnect traffic. GSM operators only
receive the value of on-network calls and do not receive the
GSM mobile phones acquire their personality from a smart
interconnect fee for call termination, which may produce
card known as the Subscriber Identity Module (SIM). All the
substantial revenue loss. Besides the financial losses, there is
access rights (including identification for billing) are based on
an important QoS degradation due to the use of the GSM
the SIM, rather than the mobile phone itself.
Gateways (e.g. radio spectrum congestion, jitter, CLI
GSM cloning refers to a process in which an attacker
override, increased call drops, etc)
obtains sufficient information to clone the SIM of a GSM
mobile phone. The aim of GSM cloning is to produce
multiple copies of a SIM and defraud a network operator.
Independent tests have questioned the strength of GSM's
security mechanisms aimed at preventing cloning, particularly
if the attacker has physical access to the SIM.
As shown in Fig.3, it is quite easy to build a GSM Card
Reader, and subsequently, clone it.
 Most of these unsuccessful attempts don’t really affect the
company, but continuous fraudulent recharge attempts
increase the system load and overall operational costs.
If a fraudulent recharge really occurs, Centaur can detect it
by analyzing the customer recharge attempt history and
profile. When a successful recharge occurs after a long period
of several different codes customer tries, the fraud analyst is
notified and can take actions to prevent further losses.

VI. PERSPECTIVES
Fraud and legitimate behaviour are constantly changing and
FMS systems should incorporate technologies capable of
Fig. 4 .GSM Gateway fraud. evolving or quickly apprehend those changes.
Although fraud cases differ greatly from each other, the
GSM Gateway Fraud requires a very small investment. Any accumulated experience in their detection and investigation is
private or corporate subscribers can do it with inexpensive essential to prevent future occurrences.
and easy-to-use devices. The very low set-up costs permit it With difficult to formalize models, as is the case of fraud,
to be deployed almost anywhere, from small village the usage of casuistic techniques like Case Based Reasoning
communities to large corporate accounts. (CBR) may prove a valuable approach in finding the correct
Centaur FMS detects GSM Interconnect Fraud by output (fraud or non-fraud) and appropriate subsequent
correlating several different data: call ratios, constant activity intervention methods. CBR is particularly adequate to create
indicator and very high usage of low profile accounts. and manage a knowledge base that stores corporate
Whenever some or all of these alerts occur, the fraud experience in fraud management. Implementing this
analyst has the possibility to create a new case and, if technique will clearly benefit the capacity of an FMS, as CBR
appropriate, instruct the authorities to investigate the ability to model exceptions is particularly adapted to the
suspected client/account. If the case is classified as fraud, the detection of new emerging types of fraud.
call pattern from the fraudster is be used to train other Usage of agent technology may also enable some
Centaur FMS detection mechanism based on neural networks breakthroughs in fraud detection as it permits the design of
and decision trees, which may expedite future GSM solutions made of multiple agents embodying different fraud
interconnect fraud detection. detection tasks (e.g., pattern analysts, correlation searchers
monitors of behaviour changes …) that cooperate with human
analysts. This technology is quite powerful as specific agent
D. Voucher Fraud functionalities may be adapted to better tackle fraud
In prepaid SIM cards where there is no contract between the behaviour perceived changes. Additionally, newly developed
operator and the client, the prepaid subscriber has to purchase detection technologies are seamlessly incorporated in the
airtime credit prior to use. One way of crediting prepaid SIMs FMS by simply adding adequately developed agents.
is through airtime vouchers. These vouchers are pieces of
paper with a code that is covered and must be scratched with VII. CONCLUSION
a coin to be revealed. Once exposed, the code is punched into The impact of fraud in operator revenue justifies the
the keypad of the cell phone crediting up the prepaid SIM introduction and consolidation of fraud detection processes
card with the vouchers amount. performed by highly experienced fraud analysts.
These experts should be permanently aware of current fraud
types and methods, and how to implement the appropriate
detection techniques.
As presented, the usage of a flexible FMS enhances fraud
detection processes and enables the articulation of multiple
Fig. 5. GSM Recharge voucher detection techniques. It also allows analysts easy information
cross-referencing in the investigation stage and expedite
In operators that use this kind of recharge method, the most subsequent procedures with a process adapted case manager.
common prepaid frauds are forgery or re-usage of recharge Client dynamic behaviour obliges to constantly monitor
vouchers. In the first case, a fraudster tries to guess voucher changes in fraud and particularly assess new fraud
codes by submitting random codes. On the second case, valid opportunities when introducing new services.
but already used codes are resubmitted. It is crucial to permanently adapt current FMS detection
techniques (e.g. adapt rules and thresholds or train neural
networks and decision trees with new fraud behaviours) and
introduce new ones more capable of stopping emerging fraud
types, enabling an increased efficiency in the detection
processes.

REFERENCES
[1] Bill Seymour, “How Neural Network Technology Can
Tackle the Growing Telecom Fraud Problem”,
Information Security Bulletin, CHI Publishing Ltd, April
2000
[2] E. G. Berbés, I. C. Múgica and F. J. G. Mazario,
“Gestión del fraude en telecomunicaciones”,
Comunicaciones de Telefónica I+D, Numero 33, Marzo
2004.
[3] Michael Cahill, Fei Chen, Diane Lambert, José Pinheiro
and Don X. Sun, “Detecting Fraud in the Real World”,
Handbook of Massive Datasets, Kluewer, 2002.
[4] Helder Biscaia, Spiros Alexiou, Fernando Pavón and
Rolf Hulthén, “Do intelligent techniques aid fraud
detection?”, Eurescom Project Reports, March 2002.
[5] Tom Fawcett and Foster Provost, “Combining Data
Mining and Machine Learning for Effective User
Profiling”, Second International Conference on
Knowledge Discovery and Data Mining, August 1996.