Simbox and Fraud Detection

Solution Overview

Do you even know if you have a problem with Simbox or Bypass Fraud on your network? IPT Networks is able to perform specific non intrusive analysis on your network and advise you of the scale of the Simbox or Bypass Fraud your network is currently experiencing. This information is a fantastic way of identifying and quantifying the financial scale of the loss your network is experiencing pertaining specifically from Simbox or Bypass Fraud.

There are a few things to bear in mind when embarking on a Simbox or Bypass Fraud identification and elimination project. Firstly the people operating Simbox Fraud within your network are motivated and nimble in adapting to the Simbox detection processes, it is imperative that the test numbers being used for Simbox detection are changed regularly, multiple strategies are employed simultaneously, Offending SIMS are blocked quickly and efficiently, and the number of staff involved in the project are kept to the absolute minimum. The perpetrators of Simbox Fraud can employ very simple or very complex methods to perpetrate Simbox Fraud, once we eliminate the majority of the Simbox fraud on your network we would then step up our operation to both manage and maintain the level of vigilance to keep Simbox Fraud from re-entering your network and also identify and eliminate some of the more sophisticated and elusive Simbox fraud operators on your network.

In short the greater level of integration IPT Networks has with you the more efficient and effective we can be in eliminating Simbox Fraud from your network. Once we have been working with you for a little while IPT Networks will be able to provide you with some very detailed analytics identifying where your fraud traffic is originating from and also identify and eliminate any cross network Simbox Fraud.

IPT Networks has several methods of detecting Simbox traffic and identifying offending sims. The solution we offer is tailored to fit our customers resources and desire to eliminate the Simbox Fraud. In short the more methods and strategies we deploy the greater level of Simbox detection we can deliver.

In simple terms there are multiple ways of identifying SIM’s that are located within a Simbox we refer to these as “Offending SIMS”. Each detection method or strategy brings something different to the detection environment.

• The First Method is by inserting network probes into your countries mobile networks environment, that are loaded with your networks SIMS, IPT Networks generate calls to these probes, identifying Offending SIMs that are being used to terminate the calls to the SIMS mounted within our probes. - Main Advantage – Little or no chance of internal Staff collusion as the probes are independent of the operators network.
• The Second Method is by having a SIP interconnect with yourselves, and have a large number of virtual MSISDN’s allocated to the SIP interconnect, any call traffic arriving on these MSISDN’s is routed back to IPT Networks for termination and analysis. Main Advantage – A large number of MSISDN’s reduces the chance of White/Black listing coupled with humanising of the test calls.
• The Third Method is via CDR reconciliation whereby we would require access to certain CDR records to perform analysis on test calls made to specific numbers within your network – Main Advantage - IPT Networks can make calls to any number on your network without being concerned about Simbox operators blocking test numbers (White to Black listing).

Working with IPT Networks you can choose how many test calls are originated to the Networks Probes, MSISDN’s etc so that the solution fits with your budget, call charges are largely in line or slightly below the MTR. The call duration of Test calls is directly within your control, however IPT Networks would work with you to advise on the duration and randomness of call durations – as part of humanising the test calls.

Call Flows

The Simbox Bypass Fraud detection solution relies upon call traffic being originated from networks outside of your own, IPT Networks has a significant advantage in this area against other competitors, whereby we have over 250k test calls being terminated across our testing platforms every day, which enables us to generate and originate traffic from all continents around the world. Quickly identifying the countries that originate the calls that utilise Simbox hosters within your country and originating a greater percentage of test traffic from those countires.

Because IPT Networks generates all the test traffic itself, you can have absolute surety that there will be no “False Positives”, whereby unwitting legitimate customers have misdialled a testing probe, MSISDN etc and inadvertently been identified as an Offending SIM. Every test call is passed through the IPT Networks testing system guaranteeing a factually evidence based way of identifying Offending SIM’s.

Technical Requirements

IPT Networks would require the following technical resources within your network to implement the solution.

1. Simple standard SIP interconnection from your network to IPT Networks for the routing of test calls back to IPT Networks – we would suggest a minimum of 60 ports initially and growing if required.
2. A large Range of MSISDN's mapped to the aforementioned SIP interconnect – It would be advisable to have this range being non contiguous and circa 500-1000 numbers, not related to your MSRN ranges and able to be refreshed on a regular (weekly or monthly) basis.
3. 2Mb Internet connection with WIFI for hosting the Network Probes.
4. 6 current model Android mobile phones to act as Network Probes, able to connect to the DMZ WIFI mentioned above.
5. VPN Secure access to your CDR database in real time for querying against test call data.
6. If required by yourselves - Access to your HLR/VLR database (or interface) for verifying network ownership of Offending SIM’s.
7. If required by yourselves - Access to your SIM Management platform to automate the blocking of Offending SIM’s.

If you have any network specific security policies for how IPT Networks interfaces with and processes the CDR lookups we can tailor our process to perform the lookups and ensure it is compliant with your policies.

We would appreciate being advised of the frequency and method you would like to be notified regarding Offending SIm’s, for example – a) real time via FTP with a supporting CSV, b) daily via email in Excel Format, c) automated SIM Blocking in Real Time with daily reports.

We also have a wide array of reports we can furnish you with regarding the perforce of the IPT Networks platform.

Enhanced Services

There are other enhanced services we can include in the strategy,

1. PT Networks identify the Offending SIMS for blocking or deactivation by yourselves – this report can come to you in a variety of formats – CSV, Excel, delivered via different mediums FTP, email etc. We can enhance the service by interface directly with your system(s) to automatically block Offending SIMS. Various levels of automation can be offered by IPT Networks to speed up the process of Blocking Offending SIMS’s – which is crucial to long term elimination of Simbox fraud within your network. Delays in the suspension or termination of Offending SIM’s can leave Simbox operators with a strategy based around swift replacement of low costs sims which still generates them sufficient revenues to make their operations financially viable. By the swift automated blocking of Offending SIM’s you can eliminate Offending SIM’s as early as their first offending call, making replacing that SIM a significant financial loss to the Simbox Operator.
2. HLR/VLR Lookups on Offending SIMS to identify the network operator / owner of the Offending SIMS to eliminate cross network Simbox fraud etc. If there are several Mobile Operators in your country of operation and it is not unusual for the perpetrators of SIMBOX fraud to load their SIMBOX’s with other Mobile operators SIM's in an attempt to continue terminating traffic upon your network – even if it represents a slightly less attractive financial model. IPT Networks can provide a cross network operator solution to eliminate this across all operators in your region.