Understanding voice fraud in telecommunications

By TFI Staff

14 September 2024

CAPE TOWN, SOUTH AFRICA - Telecommunications is vital in today's interconnected world, enabling people to communicate across continents in real-time. However, this vast network is not without its vulnerabilities. Voice fraud—including practices such as International Revenue Share Fraud (IRSF), False Answer Supervision (FAS), mail boxing, SIM farms, and Inbound International Traffic Refilling (ITR)—poses significant threats to both telecom operators and consumers. This article explores these types of fraud, the roles and responsibilities of telecom operators, and the potential for internal collusion within organisations. It also examines how wholesale operators may enable fraud through illegal routing strategies.

Introduction

The telecoms industry relies on complex interconnect agreements between operators, often detailed in A to Z pricing lists, which establish the cost per minute for routing calls to global destinations. Operators advertise these routes, promising to deliver voice traffic to the designated endpoints. However, when fraud occurs, the responsibility is often shifted downstream, typically to transit operators or third-party carriers. This article aims to unpack the logic behind this blame shift, scrutinise the responsibilities of originating operators, and explore the mechanisms of common voice fraud schemes.

The mechanics of interconnect agreements

Interconnect agreements are fundamental to the global telecommunications framework. They allow operators to extend their reach by leveraging the networks of other carriers. These agreements are built on trust, with each operator relying on others to accurately route and bill for traffic.

Operators promote their routes through A to Z pricing, promising to deliver calls to the listed destinations at the specified rates. This system operates on the assumption that all parties act in good faith, ensuring calls are genuinely terminated at their intended destinations.

Voice fraud explained

International revenue share fraud (IRSF):

• Mechanism: IRSF involves fraudsters artificially increasing traffic to international numbers with which they have revenue-sharing arrangements, often in high-cost destinations or on numbers specifically set up for this purpose.

• Impact: The originating operator faces substantial costs for calls that generate revenue for the fraudster through payouts from the terminating operator.

False answer supervision (FAS):

• Mechanism: FAS fraud bills calls as connected even when they are not, by manipulating signalling data to indicate a successful call setup.

• Impact: Operators are charged for non-existent calls, resulting in financial losses and distorted traffic data.

Mail boxing and SIM farms:

• Mechanism: Mail boxing involves leaving lengthy voicemails on international numbers, while SIM farms use multiple SIM cards to generate or terminate calls in bulk.

• Impact: These methods lead to inflated call volumes and charges, exploiting flat-rate or unlimited plans and causing network congestion.

Inbound international traffic refilling (ITR):

• Mechanism: ITR fraud reroutes international calls through alternative paths to avoid higher termination charges, often bypassing legitimate network routes.

• Impact: Legitimate operators lose revenue, and call quality may deteriorate due to the use of substandard routing methods.

The role of wholesale operators in fraudulent practices

Wholesale operators, facing a decline in traditional voice traffic due to the rise of IoT services, have resorted to various strategies to artificially boost traffic. One approach involves selecting the cheapest available routes, which often fall below the official rates of the destination country.

These operators may engage in bypass fraud, where calls are deliberately routed through cheaper, unauthorised paths to avoid higher termination charges. This practice not only deprives legitimate operators of revenue but also degrades call quality and causes network instability.

Bypass fraud requires the cooperation of at least two parties: the originating operator and a complicit intermediary. It is considered a form of money laundering, as it involves manipulating call routes and payments to obscure fraudulent activity.

Analysing the blame shift

Originating operators often shift blame to downstream providers when fraud occurs, arguing that since fraudulent activity appears further along the chain, it is beyond their control. However, operators who advertise and charge for specific routes have a duty to ensure the integrity of those routes. This includes due diligence in evaluating partners and monitoring traffic for anomalies.

Examining traffic patterns for fraud detection

Fraud detection involves monitoring for unusual call patterns, such as:

• High concurrency to single numbers: Fraudulent calls often show high concurrency rates, which are not typical in standard mobile networks.

• Billed time vs. real time: Discrepancies between total billed duration and actual elapsed time can indicate fraud.

• Spoofed or non-existent originating numbers: Fraudsters frequently mask call origins, complicating detection.

• Machine-generated traffic patterns: Regular intervals and durations in calls may suggest automated fraud attempts.

The transition from premium rate numbers to mobile numbers

Fraudsters have shifted from targeting premium rate numbers to high-cost mobile destinations. These numbers, unlike premium numbers, do not provide revenue sharing, raising questions about how fraudsters profit. They exploit arrangements with rogue transit operators who manipulate call routes and share the proceeds with the fraudsters.

The role of rogue transit operators

Rogue transit operators facilitate fraud by manipulating call routing, falsifying call data records, and colluding with fraudsters for mutual gain.

Internal collusion: A possibility?

Fraud may involve internal collusion within the originating operator's organisation. Indicators include lax vetting of new partners, unusual payment approvals, and inadequate monitoring systems.

Responsibilities of telecom operators

Operators must conduct thorough due diligence, rigorously monitor traffic, maintain transparency, and educate staff about fraud mechanisms. By understanding fraud and taking proactive measures, the telecom industry can mitigate risks and protect the integrity of global communications.

Conclusion

Operators must recognise their role in preventing fraud by monitoring networks, ensuring ethical partnerships, and maintaining transparent practices. Understanding fraud mechanisms and taking proactive steps can help mitigate risks, protect consumers, and uphold the integrity of global communication networks.

Comment - Originating International Gateway Operators must be held both legally and criminally liable for the delivery of fraudulent voice minutes, irrespective of their transit partners actions. Disputes must be based on a clear assessment of negligence — whether through the selection of unreliable transit partners, the implementation of inadequate monitoring systems, or the failure to take immediate corrective action to address routing issues. Additionally, international partners should be viewed as complicit in criminal activity or deemed negligent in their capacity to provide international wholesale services if they fail to meet these responsibilities.

______________________

Operation ITR - Zero Tollerance

Press Release:

ITR bypass targeted for international grey and illegal routes

6th Sep 2024

Cape Town, South Africa – Foreign operators using routes provided by local South African operators and foreign based transit operators at rates below the minimum of R1.40 per minute are being implicated in a network of international grey and illegal routing. These operators are reportedly as complicit as South African domestic operators that facilitate these illegal routes by ensuring that the P-Asserted-Identity (PAI) headers are "scrubbed" and manipulated to disguise the traffic as domestic voice traffic.

According to reports, foreign operators route traffic based in most cases on the "cheapest" route offered for delivery to South African. These “bad actor” domestic operators then manipulate the PAI headers so that the receiving South African carrier recognises the inbound traffic as domestic, circumventing international rate set by South African Operators. This chain of criminality begins with foreign operators accepting a cheaper and discounted rates than what is officially offered by receiving carriers and concludes with domestic carriers illegally altering the PAI headers.

TFI, acting on behalf of its South African ICASA-licensed clients, has announced a "zero tolerance" policy towards foreign operators who are complicit in this illegal activity. The policy includes launching "Operation ITR," aimed at identifying foreign operators responsible for sending traffic to rogue transit and domestic operators.

Operation ITR involves a two-phase investigation. Phase 1 focuses on holding foreign operators criminally liable for offering routes into South Africa below the minimum rate of R1.40 per minute (US$0.0784 per minute). Phase 2 targets domestic bad actors, identifying those who facilitate the scheme and gathering evidence to present to South African law enforcement, the South African Revenue Service, the South Africa Reserve Bank, and the Independent Communications Authority of South Africa (ICASA). Both phases are being conducted concurrently, based on evidence provided by cooperative foreign operators and domestic carriers.

TFI stated that these measures will help curb illegal routing practices and protect the integrity of South Africa's telecommunications infrastructure. The message which TFI, on behalf of its Clients, is sending to all Parties actively involved in this criminal ITR Bypass Scheme is that the “Theft of legitimate revenues due to domestic South African operators, will not go unpunished”.

On the flip side, South African Operators must ensure that outbound South African traffic to international destinations, need to be treated in the same fashion as inbound ITR.