Method and system for using bad billed number records to prevent fraud in a telecommunication system

• US 6,636,592 B2
• Filed: 09/28/2001
• Issued: 10/21/2003
• Est. Priority Date: 09/28/2001
• Status: Expired due to Fees

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: MCI Incorporated (Verizon Communications Inc.)
• Inventors: Marchand, Dean C., Springer, Arthur Lance
• Primary Examiner(s): Tieu, Binh
• Assistant Examiner(s): TRAN, QUOC DUC
• Application Number:
  US09/964,419
• Publication Number:
  US 20030063725A1
• Time in Patent Office: 753 Days
• Field of Search: 379/32.01, 379/112.01, 379/114.01, 379/114.03, 379/114.14, 379/115.01, 379/126, 379/127.02, 379/133, 379/188, 379/189, 379/196, 379/197, 379/198, 379/210.02, 379/220.01, 379/221.02, 379/221.03, 379/221.14, 379/222, 379/32.03, 379/32.04, 379/32.05, 379/114.04, 379/114.15, 379/114.19, 379/114.28, 379/130, 379/134, 379/137, 379/139
• US Class Current: 379/114.14
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/41 Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 15/58 based on statistics of usage or network monitoring
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0164 Billing record, e.g. Call Data Record [CDR], Toll Ticket[TT], Automatic Message Accounting [AMA], Call Line Identifier [CLI], details, i.e. parameters, identifiers, structure
• CPC Class Codes: H04M 2215/0188 Network monitoring; statistics on usage on called/calling number

Abstract

A method for using at least one Bad Billed Number Record (BBN) to detect fraud in a telecommunication system includes the steps of generating the at least one BBN for each call attempt made using a billing product, when the call attempt satisfies any one of a plurality of fraud criteria; storing the at least one BBN in a storage queue for later retrieval; and retrieving and analyzing the at least one BBN to increment a plurality of fraud control counters according to the analysis. A system for using a plurality of BBNs to detect fraud in a telecommunications system includes a network operator service platform (OSP) for generating BBNs based on received call attempts; a network information concentrator (NIC) for temporarily storing the generated BBNs; and a fraud monitoring system for retrieving the stored BBNs, filtering out unidentifiable BBNs, analyzing identifiable BBNs, and generating alarms based on the analysis.

Claims

1. A method for detecting fraud in a telecommunication system, the method comprising:

determining whether a call attempt stemming from a billing product fails based upon a fraud criterion including at least one of determining whether a number for the billing product is blocked, determining whether the number for the billing product is invalid, and determining whether a call terminating number of the call attempt is blocked;

generating a bad billed number record for the call attempt if the call attempt failed based on the fraud criterion; and

analyzing the generated record if the generated record does not satisfy the filtering criterion that includes at least one of determining whether a call terminating number of the call attempt is less than six digits in length and determining whether a call billing number of the call attempt is less than eight digits in length.

2. The method according to claim 1, wherein the billing product is a calling card.

3. The method according to claim 1, wherein the billing product is a credit card.

4. The method according to claim 1, further comprising:

deleting the record if the filter criterion is satisfied.

5. The method according to claim 1, further comprising:

setting a predetermined threshold for a counter corresponding to the generated record; and

determining whether the predetermined threshold has been exceeded within a predetermined period of time based on the counter.

6. The method according to claim 5, further comprising:

generating an alarm if the predetermined threshold is exceeded within the predetermined time period.

7. The method according to claim 6, wherein the alarm is forwarded to a fraud control terminal to notify a fraud analyst accessing the fraud control terminal, thereby allowing the fraud analyst to take fraud control preventive measures.

8. The method according to claim 7, wherein the fraud control preventive measures include one of blocking a billing product number, blocking a call terminating number and blocking a call originating number.

9. The method according to claim 5, wherein the counter tracks one of a number of call attempts to a call terminating number, a number of call attempts from a call originating number, and a number of call attempts using the number for the billing product.

10. A method for detecting and preventing fraud in a telecommunication system, said method comprising the steps of:

determining whether a call to a number associated with a billing product is blocked or invalid, or whether a call terminating number corresponding to the call is blocked;

generating a record for the call if the number associated with the billing product is invalid or blocked, or the call terminating number corresponding to the call is blocked;

deleting the record if the call terminating number is less than six digits in length or if the number associated with the billing product is less than eight digits in length;

incrementing a plurality of fraud counters, for each corresponding record which is not deleted based on a number of records corresponding to the call terminating number, a number of records corresponding to a call originating number, and a number of records corresponding to the call billing product number;

setting a corresponding predetermined threshold for each one of the plurality of fraud counters;

monitoring each one of the plurality of fraud counters to determine if the corresponding predetermined threshold has been exceeded within a predetermined period of time;

generating an alarm when the corresponding threshold is exceeded within the predetermined time period; and

forwarding the alarm to a fraud control terminal to notify a fraud analyst accessing the fraud control terminal, thereby allowing the fraud analyst to analyze the alarm and take fraud control preventive measures according to the analysis.

11. A system for detecting fraud in a telecommunications system, comprising:

a network operator service platform (OSP) for receiving call attempts using a billing product and generating a record based on each received call attempt if the call attempt fails based upon a fraud criterion including at least one of determining whether a number for the billing product is blocked, determining whether the number for the billing product is invalid, and determining whether a call terminating number of the call attempt is blocked;

a network information concentrator (NIC) for temporarily storing the generated records; and

a fraud monitoring system for retrieving the stored records, filtering out unidentifiable records, analyzing identifiable records, and generating an alarm based on the analysis.

12. The system of claim 11, wherein the OSP comprises:

an automatic operator console (AOC);

a manual operator console (MOC); and

a billed number screening database (BNS),

wherein the call attempt is routed to either the AOC or the MOC, either of which accesses the BNS to determine whether a number for the billing product is blocked, whether the number for the billing product is invalid, or whether a call terminating number is blocked, and to generate the record if the number for the billing product is blocked or invalid, or whether the call terminating number is blocked.

13. The system of claim 11, wherein the identifiable records are analyzed by the fraud monitoring system to increment a plurality fraud counters corresponding to a number of call attempts to a call terminating number, a number of call attempts from a call originating number, and a number of call attempts using a billing product number.

14. The system of claim 13, wherein the alarms are generated when any one of the plurality of fraud counters exceeds a predetermined threshold value within a predetermined period of time.

15. The method according to claim 14, wherein the alarms are forwarded to a fraud control terminal to notify a fraud analyst accessing the fraud control terminal, thereby allowing the fraud analyst to take fraud control preventive measures.

16. A method for detecting fraudulent use of a billing product, the method comprising:

tracking a number of failed call attempts using the billing product having a corresponding number and a corresponding terminating call number;

retrieving a bad billed number record associated with the billing product, wherein the bad billed number record is generated if the call attempts fail, wherein failure occurs if the billing product number is blocked or invalid or the terminating call number is blocked;

analyzing the bad billed number record to generate an alarm if the number of failed call attempts to the billing product exceeds a predetermined threshold;

determining whether the bad billed number record is unidentifiable; and

discarding the bad billed number record if the bad billed number record is unidentifiable.