Advanced predictive intelligence for termination bypass detection and prevention

• US 9,002,320 B2
• Filed: 07/05/2011
• Issued: 04/07/2015
• Est. Priority Date: 07/02/2010
• Status: Active Grant

• Current Assignee: Mobileum, Incorporated fka Roamware
• Original Assignee: Mobileum, Incorporated fka Roamware
• Inventors: Jiang, John Yue Jun, Gillot, David
• Primary Examiner(s): Sarwar, Babar
• Application Number:
  US13/176,508
• Publication Number:
  US 20120021720A1
• Time in Patent Office: 1,372 Days
• Field of Search: 455/410, 455/433, 455/411, 455/445, 455/422, 455/426, 455/432, 455/435, 455/458, 455/461, 455/550, 455/459, 379/114.14, 379/189, 379/188, 379/127.02, 379/196
• US Class Current: 455/410
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/08 Metering calls to called party , i.e. B-party charged for the communication
• CPC Class Codes: H04M 15/8038 Roaming or handoff
• CPC Class Codes: H04M 15/8044 Least cost routing
• CPC Class Codes: H04W 24/06 Testing, supervising or monitoring using simulated traffic
• CPC Class Codes: H04W 4/24 Accounting or billing
• CPC Class Codes: H04W 8/06 Registration at serving network Location Register, VLR or user mobility server
• CPC Class Codes: H04W 8/12 between location registers or mobility servers
• CPC Class Codes: H04W 88/16 Gateway arrangements

Abstract

Provided are methods and systems for detecting and preventing bypass fraud in telecommunication networks, primarily for detecting and preventing SIM box fraud in telecommunication networks. The methods include generating one or more test calls from a remote agent to a local agent where the remote agent can be a roaming agent or a remote dialer. The local agent is a subscriber number. The methods further include facilitating call forwarding of the test calls from the local agent to a local number. The methods include identifying the presence of bypass fraud by analyzing caller identification information of the test call received on the local number. Finally, the methods include preventing future use of a detected SIM box.

Claims

1. A method for detecting bypass fraud in a telecommunication network, the method comprising:

generating one or more test calls from a remote agent to a local agent, wherein the local agent is a subscriber number of a subscriber;

facilitating call forwarding of the test calls from the local agent to a local number; and

identifying a presence of bypass fraud by analyzing caller identification information of the test call received on the local number.

2. The method of claim 1, wherein the test calls from the remote agent are triggered by a Predictive Intelligence (PI) gateway.

3. The method of claim 1, wherein the subscriber is selected based on predefined logic.

4. The method of claim 1, wherein the subscriber number is selected from a pool of subscriber numbers as a local agent.

5. The method of claim 1, wherein the call forwarding from the local agent to the local number is facilitated by setting unconditional call forwarding in a profile of the subscriber to the local number.

6. The method of claim 1, wherein the remote agent is a roaming agent created in a roaming partner network of the network the subscriber numbers belong to, wherein the roaming agent has a conditional call forwarding profile set to the local agent.

7. The method of claim 1, wherein a current unconditional call forwarding profile of the subscriber is stored before facilitating call forwarding from the local agent to the local number.

8. The method of claim 1, further comprising:

restoring the stored unconditional call forwarding profile of the subscriber after the test call is completed.

9. The method of claim 1, wherein the bypass detected is one of an on-net and off-net GSM SIM box.

10. The method of claim 9, wherein the GSM SIM box presence is detected by tracking caller ID while terminating the test calls to the local number.

11. The method of claim 10, wherein the GSM SIM box presence is suspected when an originating caller ID in the test calls generated to the roaming agent is different from the caller ID in the test calls terminating to the local number.

12. The method of claim 10, wherein the caller ID of the test call is tracked by provisioning T-CSI in the local number'"'"'s profile.

13. The method of claim 9 further comprising:

releasing the test calls upon detection of the GSM SIM box.

14. The method of claim 13, wherein the test calls are released immediately after detection of the GSM SIM box.

15. The method of claim 13, wherein the test calls are released after a configurable time period.

16. The method of claim 9 further comprising:

answering the test calls to identify the GSM SIM box.

17. The method of claim 16, wherein the test calls are answered for a pre-defined time period.

18. The method of claim 16, wherein a cost of the test calls is monitored to determine the pre-defined time period for answering the test calls.

19. The method of claim 9, wherein the GSM SIM box is an on-net GSM SIM box, the method further comprising:

deactivating the on-net GSM SIM box by barring all calls to VLR where the GSM SIM box is being latched.

20. The method of claim 9, wherein the GSM SIM box is an on-net GSM SIM box, the method further comprising:

disabling the on-net SIM box based on remaining credit in the prepaid account.

21. The method of claim 9, wherein the GSM SIM box is an on-net GSM SIM box, and wherein a profile of the on-net GSM SIM box is suspended or disabled.

22. The method of claim 9, wherein the GSM SIM box is an on-net GSM SIM box, the method further comprising:

monitoring a usage, a location and a movement of the on-net GSM SIM box.

23. The method of claim 9, wherein the GSM SIM box is an off-net GSM SIM box, the method further comprising:

storing the off-net SIM box in a data base and using the database to release any off-net calls from off networks with caller ID from the data base of off-net GSM SIM boxes.

24. The method of claim 9, wherein the GSM SIM box is an off-net GSM SIM box, where the test number is quarantined for a time based on logic each time the test call involving the test number discovered a GSM SIM box.

25. The method of claim 1, wherein the bypass detected is a termination bypass.

26. The method of claim 1, wherein the bypass detected is a fixed line termination bypass.

27. The method of claim 1, wherein the bypass detected is a CDMA termination bypass.

28. The method of claim 1, wherein the subscriber number is provisioned with T-CSI in its HLR to pass the termination call control to PI.

29. The method of claim 1, wherein the subscriber number has unconditional call forwarding set towards the local number in its HLR.

30. The method of claim 1, wherein the local number is selected from a pool of pre-defined numbers.

31. The method of claim 1, wherein the one or more test calls are made using randomized call parameters.

32. The method of claim 31, wherein the call parameters are randomized using one or more of:

a calling party in test calls with no CLI;

a calling party in test calls with real subscriber number;

a calling party in test calls with any number;

test calls from random number from roaming partner country range;

test calls from corrupted numbers; and

an origin of release of the test call.

33. The method of claim 1, wherein the remote agent is a dialer using one of a group consisting of VoIP carriers, wholesale carriers and calling cards.

34. The method of claim 1, wherein a cost of the test call is metered to control the cost of early answer fraud.

35. A system for preventing termination bypass fraud in mobile communication, the system comprising:

a gateway that causes one or more test calls from a remote agent to a local agent, wherein the local agent is a subscriber number of a subscriber;

wherein the gateway facilitates call forwarding of the test calls from the local agent to a local number; and

wherein the gateway identifies presence of termination bypass fraud by analyzing termination of the test calls to the local number.

36. The system of claim 35, wherein the gateway is a termination bypass detection module.

37. The system of claim 35, wherein the gateway uses signalling to generate the test call from the remote agent to the local agent.

38. The system of claim 35, wherein the gateway releases the test calls upon detection of the termination bypass.

39. The system of claim 38, wherein the gateway releases the test calls immediately after detection of the termination bypass.

40. The system of claim 38, wherein the gateway releases the test calls after a configurable time period.

41. The system of claim 38, wherein the gateway answers the test calls to identify a SIM box.