Method for detecting fraudulent use of a communications system

• US 6,266,525 B1
• Filed: 12/17/1998
• Issued: 07/24/2001
• Est. Priority Date: 12/17/1998
• Status: Expired due to Term

• Current Assignee: WSOU Investments, LLC (WSOU Holdings, LLC)
• Original Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Inventors: Peterson, David Cartwright
• Primary Examiner(s): Chang, Vivian
• Assistant Examiner(s): APPIAH, CHARLES NANA
• Application Number:
  US09/213,905
• Time in Patent Office: 950 Days
• Field of Search: 455/410, 455/411, 455/405, 380/23, 380/25, 380/21, 340/825.3, 340/825.34
• US Class Current: 455/410
• CPC Class Codes: H04M 1/665 by checking the validity of a code
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

A method for detecting fraudulent use of a communications system detects and prevents fraud by assigning codes or randomly generated codes for communication access between a subscriber station and a fixed end and updating the codes upon the occurrence of one or more key events associated with subscriber activity in the communications system. The method permits detection and monitoring of fraudulent activity by permitting a legitimate subscriber station and an illegitimate subscriber station to have two different codes or dynamic codes after the legitimate subscriber station'"'"'s identity has been misappropriated.

Claims

1. A method for detecting fraud in wireless communications system comprising:

establishing one or more call events in a wireless call sequence based on potential call activities of subscriber stations;

assigning codes corresponding to each of the subscriber stations, in response to occurrences of said call events, such that each subscriber station has a distinguishable code from all other subscriber stations even if at least two of the subscriber stations share a common subscriber identity;

maintaining a database of subscriber identities supplemented by the codes such that a unique combination of the code and the subscriber identity uniquely identifies each subscriber station;

identifying identical or common subscriber identities with corresponding different codes in the database, any common subscriber identities with different codes being indicative of potentially fraudulent activity on the communications system.

2. The method according to claim 1 further comprising the step of generating codes for storage in the database and assignment to the subscriber stations.

3. The method according to claim 1 wherein the assigning step comprises transmitting codes to the subscriber stations during their call sequences, where the transmitted codes correspond to stored codes for storage in the database.

4. The method according to claim 1 wherein the identifying step includes:

screening for common subscriber identities by seeking mismatches between subscriber-resident ones of the codes and corresponding database-resident ones of the codes as an indication of common subscriber identities for a subscriber identity associated with the mismatch.

5. The method according to claim 1 further comprising the step of allowing access of the communications system to common subscriber identities, including a legitimate subscriber identity and an illegitimate subscriber identity, until a first unique combination associated with the legitimate subscriber identity or a second unique combination associated with the illegitimate subscriber identity is identified.

6. The method according to claim 5 further comprising the steps of:

synchronizing a code, assigned to a legitimate one of the subscriber stations with a corresponding code for storage in the database, during a verified call placed on the communication system by the legitimate subscriber identity; and

setting a flag in the database to block calls from the illegitimate subscriber identity for a predetermined period of time following the synchronizing step.

7. A method for detecting fraud in wireless communications system comprising:

establishing one or more call events in a wireless call sequence based on potential call activities of subscriber stations;

assigning random codes corresponding to each of the subscriber stations, in response to occurrences of said call events, such that each subscriber station has a distinguishable code from all other subscriber stations even if at least two of the subscriber stations share a common subscriber identity;

maintaining a database of subscriber identities supplemented by the random codes such that a unique combination of the random code and the subscriber identity uniquely identifies each subscriber station;

identifying identical or common subscriber identities with corresponding different random codes in the database, any common subscriber identities with different random codes being indicative of potentially fraudulent activity on the communications system.

8. The method according to claim 7 further comprising the step of generating random codes for storage in the database and assignment to the subscriber stations.

9. The method according to claim 7 wherein the assigning step comprises transmitting random codes to the subscriber stations during their call sequences, where the transmitted random codes correspond to stored random codes for storage in the database.

10. The method according to claim 7 wherein the identifying step includes:

screening for common subscriber identities by seeking mismatches between subscriber-resident ones of the random codes and corresponding database-resident ones of the random codes as an indication of common subscriber identities for a subscriber identity associated with the mismatch.

11. The method according to claim 7 further comprising the step of allowing access of the communications system to common subscriber identities, including a legitimate subscriber identity and an illegitimate subscriber identity, until a first unique combination associated with the legitimate subscriber identity or a second unique combination associated with the illegitimate subscriber identity is identified.

12. The method according to claim 11 further comprising the steps of:

synchronizing a random code, assigned to a legitimate one of the subscriber stations with a corresponding random code for storage in the database, during a verified call placed on the communication system by the legitimate subscriber identity; and

setting a flag in the database to block calls from the illegitimate subscriber identity for a predetermined period of time following the synchronizing step.

13. The method according to claim 12 further comprising the step of:

resetting said flag to permit the subsequent tracking of any other misappropriation of the legitimate subscriber identity.

14. The method according to claim 11 further comprising the step of:

storing a phone number in the database associated with the legitimate subscriber identity; and

identifying the legitimate subscriber identity by detecting the legitimate subscriber'"'"'s calling of the phone number stored in the database.

15. The method according to claim 11 further comprising the steps of:

storing historic call pattern data in the database associated with the legitimate subscriber identity; and

identifying the legitimate subscriber'"'"'s identity by detecting the legitimate subscribers calling of a series of phone numbers representing the historic call pattern.

16. The method according to claim 7 wherein the identifying step comprises:

comparing the random codes previously assigned to subscriber stations to corresponding random codes stored in the database to determine whether or not the random codes stored in each subscriber station match the corresponding random code stored in the database for a single call sequence; and

setting a flag, associated with one or more subscriber identities, for each random code that does not match as indicating the potential of fraudulent activity.

17. The method according to claim 16 further comprising the step of:

denying access to one or more subscriber identities having the flag.

18. The method according to claim 7 wherein the identifying step comprises:

searching the database to find common subscriber identities with associated random codes that do not match one another;

separating each of the common subscriber identities into one or more unauthorized subscriber identities and one authorized subscriber identities by tracking call activities of the common subscriber identities found.

19. A method for preventing fraud in wireless communications system comprising:

establishing a first database of call events in a wireless call sequence based on potential call activity of a subscriber station;

assigning a random code to a subscriber station in response to a first occurrence of one of said established call events such that the subscriber station and the fixed end share a common code assignment for the subscriber station;

maintaining a second database of random code assignments associated with subscriber station identities;

updating the random code in the subscriber station having the assigned random code at a second occurrence of one of said established call events during the wireless call sequence; and

monitoring a grant of access of the subscriber station identities to the communications system based upon a simultaneous comparison of subscriber-resident random codes and database-resident random codes after one of said first and second occurrence, where the subscriber-resident random codes have synchronized states with respect to the database-resident codes in the absence of fraudulent activity, and where a subscriber-resident random code has at least one unsynchronized state with respect to a database-resident code in the presence of potentially fraudulent activity.

20. The method according to claim 19 wherein the establishing step comprises establishing a database of the call events selected from the group consisting of subscriber'"'"'s request for access to the communications system, subscriber'"'"'s termination of a mobile-originated call, subscriber'"'"'s termination of a land-line originated call, communication system'"'"'s grant of a voice channel, communication system'"'"'s transmitting on paging channel, subscriber'"'"'s receiving on an access channel, a grant of a data channel, a grant of a control channel access, a call length interval exceeding a minimum interval time, dialing of a key phone number, dialing of a service provider'"'"'s phone number for update of random code, dialing of a service provider'"'"'s phone number plus entry of a personal identification code for update of random code, transmission of a supervisory audio tone for a predetermined duration, transmission of an inaudible tone, transmission of a character string, turning on a subscriber station, and turning off a subscriber station.

21. The method according to claim 19 further comprising the step of designating the call events in the data base as active or inactive, and wherein only said active events trigger the assigning and updating of the random code.

22. The method according to claim 19 wherein the monitoring step comprises denial of a communications channel if the codes at the fixed end and the corresponding subscriber-resident code at the subscriber station do not match.

23. The method according to claim 19 wherein the monitoring step comprises assigning a communication channel to a subscriber station if the codes at the fixed end and the subscriber station match.

24. The method according claim 19 wherein the monitoring step comprises assignment of a communications channel regardless of whether the codes match or not.

25. The method according to claim 19 wherein the monitoring step includes monitoring subscriber access of a legitimate subscriber station and an illegitimate subscriber station.

26. The method according to claim 25 further comprising the step of distinguishing the legitimate subscriber station from the illegitimate subscriber station based upon a test call conducted by the legitimate subscriber upon notification by an operator of the communications system.

27. The method according to claim 25 further comprising the step of deactivating the legitimate subscriber station'"'"'s access and the illegitimate subscriber station'"'"'s access as soon as two different random codes for one subscriber station identity are noted.

28. A method for detecting fraud in wireless communications system comprising:

establishing one or more call events in a wireless call sequence based on potential call activities of subscriber stations;

assigning random codes to each of the subscriber stations, in response to occurrences of said call events, such that each subscriber station has a distinguishable code from all other subscriber stations even if at least two of the subscriber stations share a common subscriber identity;

maintaining a database of subscriber identities supplemented by the random codes such that a unique combination of the random code and the subscriber identity uniquely identifies each subscriber station;

generating a suspect list of subscriber identities by determining if subscriber-resident ones of the assigned random codes match corresponding database-resident ones of the assigned random codes, and adding subscriber identities to the suspect list if the subscriber-resident ones and the database-resident ones do not match.