Telecom Fraud: High Volume, Thin Margins, Fast Losses

Telecom fraud has a property that makes it distinct: losses accumulate at machine speed against thin per-unit margins. A revenue share scheme running overnight generates traffic that is entirely legitimate at the network level and enormously expensive by morning.

That shapes the defence. Detection has to be continuous, and reconciliation matters more than sophisticated modelling.

The main categories behave differently

Interconnect bypass — routing international calls over the internet and reinjecting them locally to avoid termination fees — presents as unusual concentrations of calls from a small number of local numbers with no matching human pattern. It is detected largely through traffic analysis and test calling.

Subscription fraud obtains service with no intention to pay, often using stolen or synthetic identities. The signal is at onboarding rather than in usage, which makes it an identity problem more than a network one.

Wangiri generates missed calls from premium numbers to prompt expensive callbacks. It is detectable by pattern — many very short calls from one range — and the countermeasure is largely blocking rather than modelling.

Account takeover on a subscriber account enables SIM swap, which is a route into everything else the victim owns. This is where the harm extends well beyond the operator's own revenue.

Reconciliation catches more than models

The most productive control in telecom is not a classifier. It is continuous reconciliation between what the network delivered, what was rated, and what was billed or settled.

Revenue leakage typically presents as a small persistent gap rather than an obvious failure. Counts that do not match between network elements and mediation. Rated events that never reached an invoice. Roaming records where your total and the partner's disagree slightly and consistently.

Finding those requires comparable records at each hop and alerting on divergence rather than on absolute thresholds. Doing it monthly means a month of accumulation and no way to identify when it started; doing it continuously turns the same problem into a small daily correction.

SIM swap deserves specific attention

SIM swap is a telecom control failure with consequences almost entirely borne by other industries — banks, exchanges, anyone using SMS for verification. That asymmetry means operators frequently under-invest relative to the harm caused.

The controls are known and mostly procedural: stronger verification for swap requests, a delay before the new SIM becomes active, notification to the existing device and to the registered contact, and limiting what a single support agent can complete alone. Publishing a swap-recency signal that banks can query is one of the more effective interventions available, and it requires operator cooperation rather than technology.

Signalling security is still weak in places

Legacy signalling protocols were designed for a small set of mutually trusting operators and carry weak authentication. That legacy persists in interconnect, and it enables location tracking and message interception where filtering is inadequate.

Newer generations improve the position, but a network is only as strong as the oldest interconnect it maintains, and roaming agreements keep old paths alive. Auditing what your interconnect partners can actually do — as opposed to what the agreement says — is worth the exercise.

Detection has to be near real time

Because losses accumulate quickly, a system that identifies fraud in a daily batch has already lost the day. Practical systems score in the stream and act within minutes.

That constrains the architecture the same way it does in payments: features precomputed and retrievable, models small enough to score fast, and idempotent event handling because records arrive duplicated and out of order at volume.

Automated response needs care. Blocking a range automatically is powerful and occasionally blocks legitimate traffic, so graduated responses — throttle, flag for review, require verification — are usually safer than a binary cut.

Fraud moves to whichever product is weakest

Telecom fraud is opportunistic and reallocates quickly. Tighten controls on postpaid subscriptions and it moves to prepaid top-ups. Close a wangiri route and it reappears through a different number range. Restrict one interconnect partner and traffic shifts to another.

The consequence is that per-product defences produce a moving problem rather than a solved one. Monitoring needs a view across products so that a decline in one category alongside a rise in another is recognised as displacement rather than celebrated as success.

It also means control changes should be planned with the likely displacement in mind, so the next route is watched before the traffic arrives.

Wholesale and roaming partners need continuous scrutiny

A significant share of telecom fraud arrives through partners rather than subscribers. A compromised or complicit wholesale carrier can inject large volumes of fraudulent traffic, and roaming partners can present usage that is disputed weeks later when settlement arrives.

Near real-time roaming data exchange exists precisely to shorten that window, and operators who rely on end-of-period files carry substantially more exposure. On the wholesale side, monitoring traffic profile changes per partner — sudden volume shifts, unusual destination mixes, new number ranges — catches most of what matters before settlement.

Number range management is an underrated control

A large share of telecom fraud depends on access to number ranges — premium numbers for revenue share, ranges that look domestic for bypass, ranges cycled quickly to stay ahead of blocklists. How rigorously ranges are allocated, monitored and reclaimed is therefore a fraud control rather than an administrative task.

Practical measures: monitor newly activated ranges for traffic patterns inconsistent with their stated purpose, reclaim allocations that go unused, and treat a sudden concentration of terminating traffic to a recently allocated range as a signal rather than as commercial success.

This sits with commercial and regulatory teams more often than with security, which is exactly why it is frequently nobody's responsibility.

Where to start

Continuous reconciliation at every hop, because it finds leakage that no model is looking for. Identity verification at onboarding, since subscription fraud is decided there. Specific SIM swap controls with a delay and notification. Then stream-based detection for the usage patterns that remain.

The order matters: a detection model on top of unreconciled data will produce alerts about a picture that is already inaccurate.