Detection and blocking of cloned mobile devices

• US 9,942,770 B2
• Filed: 01/24/2017
• Issued: 04/10/2018
• Est. Priority Date: 11/20/2014
• Status: Expired due to Fees

• Current Assignee: AT&T Mobility II LLC (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.), AT&T Mobility II LLC (AT&T, Inc.)
• Inventors: Meredith, Sheldon Kent, Cottrill, William, Hilliard, Brandon B.
• Primary Examiner(s): Lai, Daniel
• Application Number:
  US15/414,522
• Publication Number:
  US 20170134958A1
• Time in Patent Office: 441 Days
• CPC Class Codes: H04L 2101/65 Telephone numbers
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04M 15/39 Arrangements for preventing metering, charging or billing
• CPC Class Codes: H04M 15/41 Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 4/025 using location based information parameters
• CPC Class Codes: H04W 4/24 Accounting or billing
• CPC Class Codes: H04W 8/04 Registration at HLR or HSS [Home Subscriber Server]

Abstract

A method is disclosed for blocking a cloned mobile device by a processor of a network. The processor receives a first registration from a first mobile device at a first location. The first registration includes a device identifier and a phone number. The processor then confirms that a second registration from a second mobile device at a second location includes the device identifier and the phone number and calculates a first fraud score for the first mobile device and a second fraud score for the second mobile device. The processor then determines that the second mobile device is the cloned mobile device, when the second fraud score exceeds the first score, and blocks the cloned mobile device from registering on the network.

Claims

1. A method for blocking a cloned mobile device, the method comprising:

receiving, by a processor of a network, a first registration from a first mobile device at a first location, wherein the first registration includes a device identifier and a phone number;

confirming, by the processor, that a second registration from a second mobile device at a second location includes the device identifier and the phone number;

calculating, by the processor, a first fraud score for the first mobile device and a second fraud score for the second mobile device;

determining, by the processor, the second mobile device is the cloned mobile device, when the second fraud score exceeds the first fraud score;

blocking the cloned mobile device from registering on the network; and

transmitting a message to the first mobile device notifying that a usage of the cloned mobile device has been detected and requesting that a subscriber identity module of the first mobile device be replaced.

2. The method of claim 1, wherein the determining the second mobile device is the cloned mobile device comprises determining that the second fraud score exceeds the first fraud score and that the second fraud score further exceeds a threshold fraud score.

3. The method of claim 1, wherein the determining the second mobile device is the cloned mobile device comprises determining that the second fraud score exceeds the first fraud score and that a difference between the second fraud score and the first fraud score exceeds a threshold amount.

4. The method of claim 1, wherein the calculating comprises:

calculating a first distance from the first location to a home location associated with the phone number; and

calculating a second distance from the second location to the home location associated with the phone number, wherein the first fraud score is based upon the first distance and the second fraud score is based upon the second distance.

5. The method of claim 1, wherein the calculating comprises:

calculating a first distance from the first location to a location of a previous usage associated with the phone number; and

calculating a second distance from the second location to the location of the previous usage associated with the phone number, wherein the first fraud score is based upon the first distance and the second fraud score is based upon the second distance.

6. The method of claim 5, wherein the first registration is received prior to the second registration, wherein the calculating comprises:

calculating a plurality of potential locations for the first mobile device based upon a trajectory of the first mobile device; and

comparing the second location to the plurality of potential locations for the first mobile device based upon the trajectory, wherein the second fraud score is based upon whether the second location comprises one of the plurality of potential locations.

7. The method of claim 1, wherein the calculating comprises:

calculating a first level of matching between a first usage pattern associated with the first location and a previous usage pattern associated with the phone number; and

calculating a second level of matching between a second usage pattern associated with the second location and the previous usage pattern associated with the phone number, wherein the first fraud score is based upon the first level of matching and the second fraud score is based upon the second level of matching.

8. The method of claim 7, wherein the first usage pattern and the second usage pattern each comprises a number of calls to a particular region.

9. The method of claim 7, wherein the first usage pattern and the second usage pattern each comprises a volume of calls.

10. The method of claim 7, wherein the first usage pattern and the second usage pattern each comprises a ratio of voice calls to data calls.

11. The method of claim 1, further comprising:

removing billing entries associated with the cloned mobile device from a bill associated with the phone number.

12. The method of claim 1, wherein the blocking comprises refusing to establish communications for the cloned mobile device at a mobile switching center of the network that is associated with the second location.

13. The method of claim 1, wherein the blocking comprises:

removing an entry associated with the device identifier and the phone number from a visiting location register associated with the second location; and

preventing re-registration of the device identifier and the phone number at the visiting location register associated with the second location.

14. The method of claim 1, wherein the blocking comprises correcting an entry associated with the phone number in a home location register or a home subscriber server to associate the phone number with the first location.

15. The method of claim 1, wherein the device identifier comprises at least one of:

an electronic serial number;

a mobile equipment identifier;

an integrated circuit card identifier;

an international mobile equipment identity;

or

an international mobile subscriber identity.

16. A non-transitory computer readable medium storing a plurality of instructions which, when executed by a processor of a network, cause the processor to perform operations for blocking a cloned mobile device, the operations comprising:

receiving a first registration from a first mobile device at a first location, wherein the first registration includes a device identifier and a phone number;

confirming that a second registration from a second mobile device at a second location includes the device identifier and the phone number;

calculating a first fraud score for the first mobile device and a second fraud score for the second mobile device;

determining that the second mobile device is the cloned mobile device, when the second fraud score exceeds the first score;

blocking the cloned mobile device from registering on the network; and

transmitting a message to the first mobile device notifying that a usage of the cloned mobile device has been detected and requesting that a subscriber identity module of the first mobile device be replaced.

17. An apparatus for blocking a cloned mobile device, the apparatus comprising:

a processor of a network; and

a computer-readable medium storing instructions which, when executed by the processor, cause the processor to perform operations, the operations comprising;

receiving a first registration from a first mobile device at a first location, wherein the first registration includes a device identifier and a phone number;

confirming that a second registration from a second mobile device at a second location includes the device identifier and the phone number;

calculating a first fraud score for the first mobile device and a second fraud score for the second mobile device;

determining that the second mobile device is the cloned mobile device, when the second fraud score exceeds the first score;

blocking the cloned mobile device from registering on the network; and

transmitting a message to the first mobile device notifying that a usage of the cloned mobile device has been detected and requesting that a subscriber identity module of the first mobile device be replaced.

18. The apparatus of claim 17, wherein the determining the second mobile device is the cloned mobile device comprises determining that the second fraud score exceeds the first fraud score and that the second fraud score further exceeds a threshold fraud score.

19. The apparatus of claim 17, wherein the determining the second mobile device is the cloned mobile device comprises determining that the second fraud score exceeds the first fraud score and that a difference between the second fraud score and the first fraud score exceeds a threshold amount.

20. The apparatus of claim 17, wherein the calculating comprises:

calculating a first distance from the first location to a home location associated with the phone number; and

calculating a second distance from the second location to the home location associated with the phone number, wherein the first fraud score is based upon the first distance and the second fraud score is based upon the second distance.