Apparatus and method for detecting potentially fradulent telecommunication

• US 6,594,481 B1
• Filed: 12/30/1994
• Issued: 07/15/2003
• Est. Priority Date: 11/12/1992
• Status: Expired due to Term

• Current Assignee: Authorize Net LLC (Visa, Inc.)
• Original Assignee: Lightbridge Incorporated
• Inventors: Johnson, Eric A., Handzel, Mark J.
• Primary Examiner(s): Urban, Edward F.
• Assistant Examiner(s): SOBUTKA, PHILIP
• Application Number:
  US08/367,972
• Time in Patent Office: 3,119 Days
• Field of Search: 455/33.1, 455/34.1, 455/34.2, 455/56.1, 455/67.1, 455/67.7, 455/53.1, 455/410, 455/411, 455/405, 455/517, 379/58, 379/59, 379/60, 379/145, 356/459
• US Class Current: 455/410
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/41 Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 15/88 Provision for limiting connection, or expenditure
• CPC Class Codes: H04M 15/887 limit per user or user related number
• CPC Class Codes: H04M 17/00 Prepayment of wireline communication systems, wireless communication systems or telephone systems using a coded card to authorise calls from a telephone set H04M1/675
• CPC Class Codes: H04M 2203/6027 Fraud preventions
• CPC Class Codes: H04M 2215/0116 Provision for limiting expenditure, e.g. limit on call expenses or account
• CPC Class Codes: H04M 2215/014 Limit per user or user related number
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0164 Billing record, e.g. Call Data Record [CDR], Toll Ticket[TT], Automatic Message Accounting [AMA], Call Line Identifier [CLI], details, i.e. parameters, identifiers, structure
• CPC Class Codes: H04M 2215/32 Involving wireless systems
• CPC Class Codes: H04M 3/38 Graded-service arrangements, i.e. some subscribers prevented from establishing certain connections queuing arrangements H04Q3/64
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 4/24 Accounting or billing
• CPC Class Codes: H04W 60/00 Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration

Abstract

The present invention provides an apparatus for credit based management of a telecommunication system. One embodiment of the apparatus includes an interface for communicating credit information on a particular subscriber and for receiving call records for the particular subscriber that are derived from a switch which establishes connections between telecommunication devices. A credit limit device then utilizes the credit information to establish a credit limit for the subscriber. The apparatus also includes a device for comparing the particular subscriber'"'"'s call usage to a credit limit established for the subscriber based on information obtained from the credit bureau. An output device is used to provide an indication that the subscriber has exceeded their credit limit. Another embodiment of the apparatus, includes a device for, upon expiration of a predetermined time period, contacting the credit bureau to obtain a new credit score for a subscriber and use this score to update the subscriber'"'"'s credit limit.

Claims

1. An apparatus for allowing a telecommunication service provider, who provides a plurality of subscribers with the ability to contact other subscribers of the telecommunication service provider and subscribers of a different telecommunication service provider, to detect potentially fraudulent telecommunication activity, comprising:

a digital computer;

interface means, operating within said digital computer, for receiving a call information record for substantially each call involving the use of a telecommunication device associated with a particular subscriber, wherein association of a telecommunication device with said particular subscriber can be in the form of a telecommunication device associated with a fraudulent user that appears to be said particular subscriber;

wherein said interface means include means for receiving call information records derived from a wireless home switching center of the telecommunication service provider that provides said particular subscriber with the ability to communicate with other telecommunication devices while the particular subscriber is located in a first geographical region;

wherein said interface means also includes means for receiving call information records from a wireless roamer switching center of the same or a different telecommunication service provider that provides said particular subscriber with the ability to communicate with other telecommunication devices while the particular subscriber is located in a second geographical region that is different than said first geographical region;

analysis means, operating within said digital computer, for receiving call information records from said interface means and using said call information records in analyzing call usage associated with the particular subscriber, said analysis means applying a set of predetermined rules when analyzing said call usage to identify one of a plurality of available alert states indicative of a severity of potentially fraudulent call activity; and

,

display means, operating with said digital computer, for displaying an indication of said potentially fraudulent call activity, wherein said display means includes displaying at least some of the information generated during the analysis that identified said potentially fraudulent call activity so an assessment of potentially fraudulent call activity can be made, and wherein said information includes identifying the type of potentially fraudulent telecommunication activity as at least one of;

a velocity event, a duration event, a velocity threshold event, a suspect number event, a suspect country event, a credit event, and an overlap calls event.

2. An apparatus, as claimed in claim 1, wherein:

said information displayed by said display means includes a graph of a pattern usage associated with the particular subscriber.

3. An apparatus, as claimed in claim 1, wherein:

said information displayed by said display means includes a graph of the call velocity associated with said particular subsenber over a period of time.

4. An apparatus, as claimed in claim 1, wherein:

said information displayed by said display means includes a plurality of graphs, each graph relating to the call velocity associated with said particular subscriber over a particular period of time.

5. An apparatus, as claimed in claim 1, wherein:

information displayed by said display means includes information relating to a group of subscribers within a defined geographical region that includes said particular subscriber.

6. An apparatus, as claimed in claim 1, wherein said analysis means includes:

pattern means for using a plurality of said call information records associated with said particular subscriber to develop information relating to a pattern of historical call usage associated with said particular subscriber; and

,

means for comparing current call usage associated with said particular subscriber to said information relating to a pattern of historical call usage associated with said particular subscriber.

7. An apparatus, as claimed in claim 6, wherein:

said current call usage associated with said particular subscriber includes a first average of call usage;

said information relating to a pattern of historical call usage associated with said particular subscriber includes a second average of call usage; and

said comparison means compares said first average of call usage to said second average of call usage.

8. An apparatus, as claimed in claim 6, wherein:

said current call usage associated with said particular subscriber includes a first average of call usage over a first period of time;

said information relating to a pattern of historical call usage associated with said particular subscriber includes a second average of call usage over a second period of time that is different than said first period of time; and

,

said comparison means compares said first average of call usage to said second average of call usage.

9. An apparatus, as claimed in claim 6 wherein:

at least one of said current call usage associated with said particular subscriber and said information relating to a pattern of historical call usage associated with said particular subscriber includes a moving average; and

said comparison means performs a comparison using said moving average.

10. An apparatus, as claimed in claim 6, wherein:

said information relating to a pattern of historical call usage associated with said particular subscriber includes information relating to a high of call usage associated with said particular subscriber; and

said comparison means compares said current call usage associated with said particular subscriber to said information relating to said high of call usage associated with said particular subscriber.

11. An apparatus, as claimed in claim 6, wherein:

said current call usage associated with said particular subscriber includes an average call usage over a period of time;

said information relating to a pattern of historical call usage associated with said particular subscriber includes a threshold; and

said comparison means compares said average call usage to said threshold.

12. An apparatus, as claimed in claim 6, wherein:

said current call usage associated with said particular subscriber includes an average call usage over a period of time;

said information relating to a pattern of historical call usage associated with said particular subscriber includes information relating to a high of call usage associated with said particular subscriber; and

said comparison means compares said average call usage to said information relating to said high of call usage associated with said particular subscriber.

13. An apparatus, as claimed in claim 6, wherein:

said information relating to a pattern of historical call usage associated with said particular subscriber includes a pattern of historical call duration usage associated with said particular subscriber; and

said comparison means compares current call duration usage associated with said particular subscriber with said pattern of historical call duration usage associated with said particular subscriber.

14. An apparatus, as claimed in claim 6, wherein:

said information relating to a pattern of historical call usage associated with said particular subscriber includes a pattern of historical call velocity usage associated with said particular subscriber; and

said comparison means compares current call velocity usage associated with said particular subscriber with said pattern of historical call velocity usage associated with said particular subscriber.

15. An apparatus, as claimed in claim 6, wherein:

said information relating to a pattern of historical call usage associated with said particular subscriber includes call velocity thresholds associated with said particular subscriber; and

said comparison means compares current call velocity usage associated with said particular subscriber with said call velocity thresholds associated with said particular subscriber.

16. An apparatus as claimed in claim 1, wherein:

said analysis means includes means for comparing call destination information from said call information record to predetermined call destination information.

17. An apparatus, as claimed in claim 16, wherein:

said predetermined call destination comprises a suspect termination number.

18. An apparatus as claimed in claim 1, wherein:

said analysis means includes means for determining if a credit limit for said particular subscriber has been exceeded.

19. An apparatus, as claimed in claim 16, wherein:

said predetermined call destination comprises a suspect country code.

20. An apparatus for allowing a telecommunication service provider, who provides a plurality of subscribers with the ability to contact other subscribers of the telecommunication service provider as well as subscribers of a different telecommunication service provider, to detect potentially fraudulent telecommunication activity, comprising:

a digital computer;

interface means, operating within said digital computer, for receiving a call information record for a wireless public switch, wherein said wireless public switch establishes connections between telecommunication devices, for substantially each call initiated by the use of a telecommunication device associated with a particular subscriber, wherein association of a telecommunication device with said particular subscriber can be in the form of a telecommunication device associated with said particular subscriber or a telecommunication device associated with a fraudulent user that appears to be said particular subscriber;

analysis means, operating within said digital computer, for receiving call information records from said interface means and using said call information records in analyzing the particular subscriber'"'"'s call usage, said analysis means applying a set of predetermined rules when analyzing said call usage to identify one of a plurality of available alert states indicative of a severity of potentially fraudulent telecommunication activity; and

,

display means, operating with said digital computer, for displaying an indication of said potentially fraudulent call activity, wherein said display means includes displaying at least some of the information generated during the analysis that identified said potentially fraudulent call activity so an assessment of potentially fraudulent call activity can be made, and wherein said information includes identifying the type of potentially fraudulent telecommunication activity as at least one of;

a velocity event, a duration event, a velocity threshold event, a suspect number event, a suspect country event, a credit event, and an overlap calls event.

21. An apparatus, as claimed in claim 20, wherein:

said interface means includes means for receiving a call information record from a wireless public switch that establishes connections to telecommunication devices in a defined geographical region.

22. An apparatus as claimed in claim 20, wherein:

said analysis means includes means for determining if a credit limit for said particular subscriber has been exceeded.

23. An apparatus, as claimed in claim 21, wherein:

said information displayed by said display means includes a graph of a pattern usage associated with the particular subscriber.

24. An apparatus, as claimed in claim 21, wherein:

said information displayed by said display means includes a graph of the call velocity associated with said particular subscriber over a period of time.

25. An apparatus, as claimed in claim 21, wherein:

said information displayed by said display means includes a plurality of graphs, each graph relating to the call velocity associated with said particular subscriber over a particular period of time.

26. An apparatus, as claimed in claim 21, wherein:

information displayed by said display means includes information relating to a group of subscribers within a defined geographical region that includes said particular subscriber.

27. An apparatus, as claimed in claim 20, wherein said analysis means includes:

pattern means for using a plurality of said call information record associated with said particular subscriber to develop information relating to a pattern of historical call usage associated with said particular subscriber; and

means for comparing current call usage associated with said particular subscriber to said information relating to a pattern of historical call usage associated with said particular subscriber.

28. An apparatus, as claimed in claim 27, wherein:

said information relating to a pattern of historical call usage associated with said particular subscriber includes a pattern of historical call velocity usage associated with said particular subscriber; and

said comparison means compares current call velocity usage associated with said particular subscriber with said pattern of historical call velocity usage associated with said particular subscriber.

29. An apparatus, as claimed in claim 27, wherein:

said current call usage associated with said particular subscriber includes a first average of call usage;

said information relating to a pattern of historical call usage associated with said particular subscriber includes a second average of call usage; and

said comparison means compares said first average of call usage to said second average of call usage.

30. An apparatus, as claimed in claim 27, wherein:

said current call usage associated with said particular subscriber includes a first average of a call usage over a first period of time;

said information relating to a pattern of historical call usage associated with said particular subscriber includes a second average of call usage over a second period of time that is different than said first period of time; and

said comparison means compares said first average call usage to said second average of call usage.

31. An apparatus, as claimed in claim 27 wherein:

at least one of said current call usage associated with said particular subscriber and said information relating to a pattern of historical call usage associated with said particular subscriber includes a moving average; and

said comparison means performs a comparison using said moving average.

32. An apparatus, as claimed in claim 27, wherein:

said information relating to a pattern of historical call usage associated with said particular subscriber includes information relating to a high of call usage associated with said particular subscriber; and

said comparison means compares said current call usage associated with said particular subscriber to said information relating to said high of call usage associated with said particular subscriber.

33. An apparatus, as claimed in claim 27, wherein:

said current call usage associated with said particular subscriber includes an average call usage over a period of time;

said information relating to a pattern of historical call usage associated with said particular subscriber includes a threshold; and

said comparison means compares said average call usage to said threshold.

34. An apparatus, as claimed in claim 27, wherein:

said current call usage associated with said particular subscriber includes an average call usage over a period of time;

said information relating to a pattern of historical call usage associated with said particular subscriber includes information relating to a high of call usage associated with said particular subscriber; and

said comparison means compares said average call usage to said information relating to said high of call usage associated with said particular subscriber.

35. An apparatus, as claimed in claim 27, wherein:

said information relating to a pattern of historical call usage associated with said particular subscriber includes a pattern of historical call duration usage associated with said particular subscriber; and

said comparison means compares current call duration usage associated with said particular subscriber with said pattern of historical call duration usage associated with said particular subscriber.

36. An apparatus, as claimed in claim 27, wherein:

said information relating to a pattern of historical call usage associated with said particular subscriber includes call velocity thresholds associated with said particular subscriber; and

said comparison means compares current call velocity usage associated with said particular subscriber with said call velocity thresholds associated with said particular subscriber.

37. An apparatus as claimed in claim 20, wherein:

said analysis means includes means for comparing for comparing call destination information form said call information records to predetermined call destination information.

38. An apparatus, as claimed in claim 37, wherein:

said predetermined call destination comprises a suspect termination number.

39. An apparatus, as claimed in claim 37, wherein:

said predetermined call destination comprises a suspect country code.

40. A method of detecting potentially fraudulent telecommunication activity, the method comprising:

accessing call information associated with a subscriber;

computing a first multi-day average of call usage associated with the subscriber from the call information;

computing a second multi-day average of call usage associated with the subscriber from the call information, the first and second multi-day averages being based on a different number of days;

computing a percentage change between the first and second multi-day averages; and

comparing the percentage change to a predetermined limit to detect potentially fraudulent telecommunication activity.

41. The method of claim 40 wherein the potentially fraudulent telecommunication activity is generated within at least one telecommunications system utilizing a unique identifier for each of a plurality of subscribers to limit access to the telecommunications system.

42. The method of claim 40 wherein the first and second multi-day averages are moving averages.

43. The method of claim 40 wherein the first and second multi-day averages of call usage correspond to at least one of a call velocity pattern and a call duration pattern.

44. The method of claim 40 further comprising performing a call event check on at least part of the call information.

45. The method of claim 40 further comprising performing a pattern event check on at least part of the call information.

46. The method of claim 40 further comprising:

identifying one of a plurality of available alert states indicative of a severity of potentially fraudulent call activity associated with at least part of the call information.

47. The method of claim 46 wherein the plurality of available alert states includes a red alert state and a yellow alert state.