Real-time communications fraud monitoring system

• US 5,706,338 A
• Filed: 07/25/1996
• Issued: 01/06/1998
• Est. Priority Date: 03/31/1993
• Status: Expired due to Term

• Current Assignee: AT&T, Inc.
• Original Assignee: AT&T, Inc.
• Inventors: Ronca, Suzanne E., Relyea, Wayne E.
• Primary Examiner(s): MATAR, AHMAD
• Application Number:
  US08/686,460
• Time in Patent Office: 530 Days
• Field of Search: 379/91, 379/188, 379/189, 379/200, 379/112, 379/113, 379/114, 379/145, 379/146, 379/249, 379/143, 379/196
• US Class Current: 379/189
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 2203/6027 Fraud preventions
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 3/36 Statistical metering, e.g. recording occasions when traffic exceeds capacity of trunks
• CPC Class Codes: H04M 3/38 Graded-service arrangements, i.e. some subscribers prevented from establishing certain connections queuing arrangements H04Q3/64
• CPC Class Codes: H04M 3/4228 in networks
• CPC Class Codes: H04Q 2213/13092 Scanning of subscriber lines, monitoring
• CPC Class Codes: H04Q 2213/13093 Personal computer, PC
• CPC Class Codes: H04Q 2213/13095 PIN / Access code, authentication
• CPC Class Codes: H04Q 2213/13097 Numbering, addressing
• CPC Class Codes: H04Q 2213/13103 Memory
• CPC Class Codes: H04Q 2213/1313 Metering, billing
• CPC Class Codes: H04Q 2213/13139 Fraud detection/prevention
• CPC Class Codes: H04Q 2213/13179 Fax, still picture
• CPC Class Codes: H04Q 2213/13204 Protocols
• CPC Class Codes: H04Q 2213/13216 Code signals, frame structure
• CPC Class Codes: H04Q 2213/1322 PBX
• CPC Class Codes: H04Q 2213/13284 Call tracing
• CPC Class Codes: H04Q 2213/13383 Hierarchy of switches, main and subexchange, e.g. satellite exchange
• CPC Class Codes: H04Q 2213/13512 : 800 - freefone
• CPC Class Codes: H04Q 2213/13515 : authentication, authorisation - fraud prevention
• CPC Class Codes: H04Q 2213/13545 : monitoring of signaling messages, intelligent network
• CPC Class Codes: H04Q 3/0029 : Provisions for intelligent networking
• CPC Class Codes: H04Q 3/62 : for connecting to private branch exchanges

Abstract

Increased network security is provided by monitoring in real time one or more characteristics or attributes of telephone calls that are placed through the network and notifying the network customer (i.e., the party responsible for paying for the telephone calls), in real time, when the attributes are indicative of abnormal or fraudulent network usage. The network customer, once notified of the abnormal usage, is in a position to take steps to minimize unauthorized network usage. For example, the network customer can selectively block network usage, deny access to the network on a call-by-call basis, or trace the call to catch the unauthorized user while the call is still in progress.

Claims

1. A method of monitoring a telephone call from a calling communication station to a called communication station through a communications network to detect abnormal usage of the communications network, the method comprising the steps of:

collecting in real time a plurality of predetermined attributes of the telephone call;

retrieving from a database predetermined criteria, the predetermined criteria representing abnormal usage of the communications network;

comparing the plurality of predetermined attributes collected for the telephone call to the retrieved predetermined criteria to determine in real time whether the telephone call represents abnormal usage of the communications network;

generating in real time an indication of abnormal usage of the communications network when the plurality of predetermined attributes satisfy the predetermined criteria; and

delivering in real time the indication of abnormal usage to a network customer responsible for paying for usage of the communications network.

2. The invention as described in claim 1 wherein the plurality of predetermined attributes are collected while the call is in-progress.

3. The invention as described in claim 1 wherein the generating step is performed while the call is in progress.

4. The invention as described in claim 1 wherein the predetermined criteria are thresholds indicative of possible unauthorized use of the communications network.

5. The invention as described in claim 4 wherein the thresholds are indicative of abnormal usage for calls originating from a predetermined originating telephone number.

6. The invention as described in claim 4 wherein the thresholds are indicative of abnormal usage for calls placed using a predetermined authorization code.

7. The invention as described in claim 4 wherein the thresholds are indicative of abnormal usage for calls placed using a predetermined 800 number.

8. The invention as described in claim 4 wherein the thresholds are indicative of abnormal usage for calls placed to a predetermined termination location.

9. The invention as described in claim 1 further comprising the steps of:

processing at least one of the predetermined attributes to derive at least one derived attribute;

retrieving from the database additional predetermined criteria, the additional predetermined criteria representing abnormal usage of the communications network;

comparing the at least one derived attribute with the additional predetermined criteria; and

generating a second indication of abnormal use of the communications network when the derived attribute satisfies the additional predetermined criteria.

10. The invention as described in claim 1 further comprising the step of tracing the telephone call when the plurality of predetermined attributes satisfy the predetermined criteria.

11. The invention as described in claim 1 further comprising the step of modifying, in real time, access to the communications network when the plurality of predetermined attributes satisfy the predetermined criteria.

12. The invention as described in claim 11 wherein the modifying step comprises terminating the telephone call.

13. The invention as described in claim 11 wherein the modifying step comprises automatically blocking completion of a subsequent telephone call.

14. A method of monitoring a telephone call from a calling communication station to a called communication station through a communications network to detect abnormal usage of the communications network, the method comprising the steps of:

collecting in real time a plurality of predetermined attributes of the telephone call;

retrieving from a database predetermined criteria, the predetermined criteria representing abnormal usage of the communications network;

comparing the plurality of predetermined attributes collected for the telephone call to the retrieved predetermined criteria to determine, in real time, whether the telephone call represents abnormal usage of the communications network;

modifying, in real time, access to the network in accordance with action previously authorized by a network customer responsible for paying for usage of the communications network when the comparison of plurality of predetermined attributes and the predetermined criteria indicates abnormal usage of the communications network is occurring; and

notifying the network customer of abnormal usage of the communications network.

15. The invention as described in claim 14 wherein the plurality of predetermined attributes are collected while the call is in-progress.

16. The invention as described in claim 14 wherein the predetermined criteria are thresholds indicative of possible unauthorized use of the communications network.

17. The invention as described in claim 14 wherein the predetermined criteria are indicative of abnormal usage for calls originating from a predetermined originating telephone number.

18. The invention as described in claim 14 wherein the predetermined criteria are indicative of abnormal usage for calls placed using a predetermined authorization code.

19. The invention as described in claim 14 wherein the predetermined criteria are indicative of abnormal usage for calls placed using a predetermined 800 number.

20. The invention as described in claim 14 wherein the predetermined criteria are indicative of abnormal usage for calls placed to a predetermined termination location.

21. The invention as described in claim 14 further comprising the steps of:

processing at least one of the predetermined attributes to derive at least one derived attribute;

retrieving from the database additional predetermined criteria, the additional predetermined criteria representing abnormal usage of the communications network;

comparing the at least one derived attribute with the additional predetermined criteria; and

generating an indication of abnormal use of the communications network when the derived attribute satisfies the additional predetermined criteria.

22. A method for monitoring a communications network to detect abnormal usage of the communications network, the method comprising the steps of:

receiving in real time a call detail record for a telephone call placed through the communications network, the call detail record including a plurality of attributes of the telephone call and an authorization code for obtaining access to the communications network;

determining the authorization code for the telephone call from the call detail record;

searching a database of authorization codes and predetermined criteria associated with each of the authorization codes, using the authorization code for the telephone call, to determine if predetermined criteria are associated with the authorization code for the telephone call;

comparing the plurality of attributes of the call detail record for the telephone call with the predetermined criteria associated with the authorization code for the telephone call;

generating, in real time, an indication of abnormal usage of the communications network for the authorization code when the plurality of attributes of the call detail record for the telephone call satisfy the predetermined criteria for the authorization code; and

notifying a network customer responsible for paying for usage of the communications network of abnormal usage of the communications network.