Telecommunications fraud detection scheme

• US 5,504,810 A
• Filed: 09/22/1993
• Issued: 04/02/1996
• Est. Priority Date: 09/22/1993
• Status: Expired due to Term

• Current Assignee: AT&T IPM Corp. (AT&T, Inc.)
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: McNair, Bruce E.
• Primary Examiner(s): Hofsass, Jeffery A.
• Assistant Examiner(s): Wolinsky, Scott
• Application Number:
  US08/125,467
• Time in Patent Office: 923 Days
• Field of Search: 379/6, 379/14, 379/28, 379/29, 379/189, 379/351, 379/4, 379/188, 379/21, 379/22, 379/5, 379/90, 379/393, 379/32, 379/197, 379/119, 379/116, 379/235, 379/246, 379/112
• US Class Current: 379/189
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 3/002 Applications of echo suppressors or cancellers in telephonic connections in two-way loud-speaking telephone systems H04M9/08, echo suppressors or cancellers per se H04B3/20
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04M 3/36 Statistical metering, e.g. recording occasions when traffic exceeds capacity of trunks
• CPC Class Codes: H04M 3/38 Graded-service arrangements, i.e. some subscribers prevented from establishing certain connections queuing arrangements H04Q3/64
• CPC Class Codes: H04M 3/42314 in private branch exchanges

Abstract

Methods and apparatus are disclosed for providing increased security in a telecommunications network by using quasi-time domain reflectometry techniques to identify those telephone calls which comprise multiple legs. Echo data are collected for the telephone call from a predetermined point in the network to a point where the call originated. The data are processed to generate an indication of whether the telephone call comprises multiple legs, thus identifying those calls most susceptible to unauthorized use. The indication that a telephone call comprises multiple legs is advantageously used together with call attribute information, such as whether the call is placed to an international destination, to determine whether a given multiple-leg call is most likely a valid access to the communication system or most likely fraudulent.

Claims

1. A method comprising the steps of:

analyzing echo characteristics of a path of a telephone call to determine whether the telephone call is a multiple-leg call;

collecting data representing attributes of the telephone call when the echo characteristics indicate that the telephone call is a multiple-leg call; and

processing the data to generate an indication of whether the telephone call was established fraudulently.

2. The method of claim 1 wherein the processing step comprises determining whether the condition of at least one call attribute indicates that the telephone call was established fraudulently.

3. The method of claim 1 wherein the analyzing step comprises the steps of:

generating echo data for the telephone call from a predetermined point in the network to a point where the call originated; and

responding to the echo data to generate an indication of whether the telephone call comprises multiple legs.

4. The method of claim 3 wherein the responding step comprises:

filtering the echo data to identify echo peaks; and

generating an indication that the telephone call is a multiple-leg call if there are at least two identified echo peaks.

5. The method of claim 3 wherein the responding step comprises:

determining from the echo data the echo return loss between the predetermined point and the point where the call originated; and

comparing the determined echo return loss with an expected echo return loss for the telephone call; and

generating an indication that the telephone call is a multiple-leg call if the determined echo return loss exceeds the expected echo return loss by more than a predetermined amount.

6. The method of claim 3 wherein the responding step comprises:

determining from the echo data the approximate distance between the predetermined point and the point where the call originated; and

comparing the determined distance with an expected distance for the telephone call; and

generating an indication that the telephone call is a multiple-leg call if the determined distance exceeds the expected distance by more than a predetermined amount.

7. The method of claim 1 wherein the step of processing call attribute data comprises determining whether the call is placed to a country which belongs to a predetermined group of high-fraud countries.

8. A method comprising the steps of:

detecting the echo characteristics of the path of a telephone call;

collecting data representing attributes of the telephone call;

determining whether the collected data and the echo characteristics of the path are consistent with each other; and

generating an indication that the telephone call was established fraudulently when the collected data and the characteristics of the path are inconsistent with each other.

9. The method of claim 8 wherein the detecting step comprises determining the approximate distance between a predetermined point in the path and a point where the call originated.

10. The method of claim 9 wherein the determining step comprises comparing said distance with a country code which identifies a country from which the telephone call originated.