Fraud monitoring system

• US 20030185361A1
• Filed: 03/24/2003
• Published: 10/02/2003
• Est. Priority Date: 07/22/1997
• Status: Abandoned Application

• Current Assignee: British Telecommunications (BT Group Plc) (BT Group PLC)
• Original Assignee: British Telecommunications (BT Group Plc) (BT Group PLC)
• Inventors: Edwards, Alexander F.M.
• Application Number:
  US10/394,224
• Publication Number:
  US 20030185361A1
• Time in Patent Office: Days
• US Class Current: 379/114.14
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 3/36 Statistical metering, e.g. recording occasions when traffic exceeds capacity of trunks

Abstract

In order to detect fraudulent or potentially fraudulent usage of a telecommunications network, each call connected by way of one of the digital main switching units of the network (3a to 3c) has an associated billing record transferred to a fraud management system (4). The fraud management system compares the origin and destination of the call with a known usage pattern for the originator and, if other indications are that the call is of a fraudulent nature, and the call deviates from the known usage pattern an alarm can be forwarded to an operator. The user profile used to determine normal calling behaviour is updated over a period of time in respect of calls determined as not fraudulent. An initial user profile may be generated from historic billing records.

Claims

1. A method of automatically detecting fraudulent calls in a telecommunications network, the method comprising the steps of:

determining the origination of the calls;

determining whether the call is likely to be a fraudulent call using a predetermined pattern of previous or expected calls specific to the origination.

2. A method according to claim 1 including the step of receiving a call record containing information on the call, wherein the step of determining the origination of the call uses the call record.

3. A method according to claim 1 or claim 2 wherein the call is determined to be a fraudulent call if it lies significantly outside the predetermined pattern of calls.

4. A method according to any preceding claim including the step of adaptively modifying the predetermined pattern of calls to update the pattern to accommodate changes in calling behaviour of the origination.

5. A method according to claim 4 wherein the adaptive modification of the predetermined pattern of calls is a weighted averaging operation which is weighted to favour the most recent calls.

6. A method according to claim 4 or claim 5 wherein calls determined to be fraudulent are used for adaptively modifying the predetermined pattern of calls once they have been investigated and cleared.

7. A method according to any preceding claim wherein the origination is determined as at least one of the set comprising a user or group identification code, a node or group of nodes in the telecommunications network, and a geographical location.

8. A method according to any preceding claim including the step of determining the destination of the call, wherein said predetermined pattern of calls includes information on the call destination.

9. A method according to claim 8 wherein the call destination information in said predetermined pattern of calls comprises information identifying a node or group of nodes in the telecommunications network and/or a geographical location.

10. A method according to any preceding claim including the step of determining the time and/or day or date of the call, wherein the predetermined pattern of calls includes information on at least one of the set of the time of day of the calls, the day or date of the calls, and the frequency of calls made.

11. A method according to any preceding claim including the step of determining the duration of the call, wherein said predetermined pattern of calls includes information on the duration of calls.

12. A method according to claim 2 wherein the call record is received and used in the determination as the call is made.

13. A method according to any preceding claim including the steps of receiving an input code from the origination, validating the input code, and receiving pattern update data from the origination and updating said predetermined pattern of calls if the input code is valid.

14. A method according to any preceding claim wherein a pattern of calls from the origination for a current time period is compared with a pattern of calls for a previous time period in order to determine whether there is likely to be fraudulent activity.

15. Apparatus for automatically detecting fraudulent calls in a telecommunications network, the apparatus comprising:

determining means for determining the origination of the call;

storage means for storing data for a pattern of previous or expected calls specific to origination; and

fraud detecting means for determining whether the call is likely to be a fraudulent call using the determined origination of the call and the stored pattern of calls specific to the origination.

16. Apparatus according to claim 15 wherein said determining means includes means for receiving a call record containing information on the call, and the fraud detecting means is adapted to use the call record information in the determination.

17. Apparatus according to claim 15 or claim 16 wherein said fraud detecting means is operative to determine that a call is fraudulent if it lies significantly outside the predetermined pattern of calls.

18. Apparatus according to any one of claims 15 to 17 including adaptive means for adaptively modifying the predetermined pattern of calls to update the pattern to accommodate changes in calling behaviour of the origination.

19. Apparatus according to claim 18 wherein said adaptive means is operative to carry out a weighted averaging operation wherein the most recent calls are given the highest weighting in the adaption process.

20. Apparatus according to claim 18 or claim 19 wherein said adaptive means is operative to use calls determined to be fraudulent in the adaptive process once the calls have been investigated and cleared.

21. Apparatus according to any one of claims 15 to 20 wherein said determining means is operative to determine the origination as at least one of the set comprising a user or group identification code, a node or group of nodes in the telecommunications network, and a geographical location.

22. Apparatus according to any one of claims 15 to 21 including means for determining the destination of the call, wherein said storage means is adapted to store said predetermined pattern of calls which includes information on the call destination.

23. Apparatus according to claim 22 wherein said storage means is adapted to store the information on the call destination which comprises information identifying a node or group of nodes in the telecommunications network and/or a geographical location.

24. Apparatus according to any one of claims 15 to 23 including means for determining the time and/or day or date of the call, wherein said storage means is adapted to store said predetermined pattern of calls which includes information on at least one of the set of the time of day of the calls, the day or date of the calls, and the frequency of the calls.

25. Apparatus according to any one of claims 15 to 24 including means for determining the duration of the call, wherein said storage means is adapted to store said information on said predetermined pattern of calls which includes information on the duration of calls.

26. Apparatus according to claim 16 wherein said means for receiving the call record is operative to receive the call record as the call is made and said fraud detecting means is operative to determine whether the call is likely to be a fraudulent call as the call is made.

27. Apparatus according to any one of claims 15 to 26 including means for receiving an input code from the origination, means for validating the input code, and means for receiving pattern update data from the origination and for updating said predetermined pattern of calls if the input code is valid.

28. A method according to any one of claims 15 to 27 including current storage means for storing a pattern of calls from the origination for a current time period, wherein said storage means stores a pattern of calls for a previous time period, and said fraud detection means is adapted to compare the pattern for the current time period with the pattern for the previous time period in order to determine whether there is likely to be fraudulent activity.

29. A method of controlling calls over a telecommunications network, the method comprising the steps of:

determining the origination of a call, and

determining whether the call is to be allowed or disallowed using a predetermined pattern of calls specific to the origination.

30. A method according to claim 29 including the step of receiving a call record containing information on the call, wherein the step of determining whether the call is to be allowed or disallowed uses the call record in the determination.

31. A method according to claim 29 or claim 30 wherein the call is determined to be disallowed if it lies significantly outside the predetermined pattern of calls.

32. A method according to any one of claims 29 to 31 including the step of adaptively modifying the predetermined pattern of calls to update the pattern to accommodate changes in calling behaviour of the origination.

33. A method according to claim 32 wherein the adaptive modification of the predetermined pattern of calls is a weighted averaging operation which is weighted to favour the most recent calls.

34. A method according to any one of claims 29 to 33 wherein the origination is determined as at least one of the set comprising a user or group identification code, a node or group of nodes in the telecommunications network, and a geographical location.

35. A method according to any one of claims 29 to 34 including the step of determining the destination of the call, wherein said predetermined pattern of calls includes information on the call destination.

36. A method according to claim 35 wherein the call destination information in said predetermined pattern of calls comprises information identifying a node or group of nodes in the telecommunications network and/or a geographical location.

37. A method according to any one of claims 29 to 36 including the step of determining the time and/or day or date of the call, wherein the predetermined pattern of calls includes information on at least one of the set of the time of day of the calls, the day or date of the calls, and the frequency of calls made.

38. A method according to any one of claims 29 to 37 including the steps of receiving an input code from the origination, validating the input code, and receiving pattern update data from the origination and updating said predetermined pattern of calls if the input code is valid.

39. Apparatus for controlling calls over a telecommunications network, the apparatus comprising:

determining means for determining the origination of a call;

storage means for storing data for a pattern of calls specific to origination;

allowance determining means for determining whether the call is to be allowed or disallowed using the determined origination of the call and the stored pattern of calls specific to the origination; and

control means for controlling the call in accordance with the determination.

40. Apparatus according to claim 39 wherein said determining means includes means for receiving a call record containing information on the call, and the allowance determining means is adapted to use the call record information in the determination.

41. Apparatus according to claim 39 or claim 40 wherein said allowance determining means is adapted to determine that a call is to be disallowed if it lies significantly outside the stored pattern of calls specific to the origination.

42. Apparatus according to any one of claims 39 to 41 including adaptive means for adaptively modifying the stored pattern of calls specific to the origination to update the pattern to accommodate changes in calling behaviour of the origination.

43. Apparatus according to claim 42 wherein said adaptive means is operative to carry out a weighted averaging operation wherein the most recent calls are given the highest weighting in the adaption process.

44. Apparatus according to any one of claims 39 to 43 wherein said determining means is operative to determine the origination as at least one of the set comprising a user or group identification code, a node or group of nodes in the telecommunications network, and a geographical location.

45. Apparatus according to any one of claims 39 to 44 including means for determining the destination of the call, wherein said storage means is adapted to store said pattern of calls which includes information on the call destination.

46. Apparatus according to claim 45 wherein said storage means is adapted to store the information on the call destination which comprises information identifying a node or group of nodes in the telecommunications network and/or a geographical location.

47. Apparatus according to any one of claims 39 to 46 including means for determining the time and/or day or date of the call, wherein said storage means is adapted to store said pattern of calls which includes information on at least one of the set of the time of day of the calls, the day or date of the calls, and the frequency of the calls.

48. Apparatus according to any one of claims 39 to 47 including means for receiving an input code from the origination, means for validating the input code, and means for receiving pattern update data from the origination and for updating said pattern of calls if the input code is valid.

49. A method of controlling access to a telecommunications network, the method comprising the steps of:

determining the origination of calls over the telecommunications network over a current period of time;

comparing a pattern of calls from an origination for the current period of time with an allowed pattern of calls; and

controlling access to the telecommunications network for originations based on the result of the comparison.

50. Apparatus for controlling access to a telecommunications network, the apparatus comprising:

first storage means for storing patterns of allowed calls for originations;

determining means for determining the origination of calls over the telecommunications network over a current period of time;

second storage means for storing patterns of calls from originations over the current period of time;

comparing means for comparing the stored patterns of calls from originations over the current period of time with the stored patterns of allowed calls; and

control means for controlling access to the telecommunications network for the originations based on the result of the comparison.