Understanding and Detecting International Revenue Share Fraud

Abstract

Premium rate phone numbers are often abused by malicious parties (e.g., via various phone scams, mobile malware) as a way to obtain monetary benefit. This benefit comes from the 'revenue share' mechanism that enables the owner of the premium rate number to receive some part of the call revenue for each minute of the call traffic generated towards this number. This work focuses on International Revenue Share Fraud (IRSF), which abuses regular international phone numbers as the so-called International Premium Rate Numbers (IPRN). IRSF often involves multiple parties (e.g., a fraudulent telecom operator in collaboration with a premium rate service provider) who collect and share the call revenue, and is usually combined with other fraud schemes to generate call traffic without payment. Although this fraud scheme has been around for several years, it remains to be one of the most common phone fraud schemes, reportedly leading to billions of dollars of losses every year. In this paper we explore the IRSF ecosystem from multiple angles, via: (i) A telephony honeypot that observes IRSF attempts towards an unused phone number range (i.e., a phone number gray space), (ii) A dataset of more than 3 Million test IPRNs and more than 206K test call logs we collected from several online IPRN service providers during 4 years, and finally, (iii) A realworld call data set from a small European operator, involving 689K call records, that we analyze to find IRSF cases. By leveraging our observations from (ii), we propose several machine learning features that can be used in IRSF detection. We validate our approach on the dataset in (iii), achieving 98% accuracy with a 0.28% false positive rate in detecting the fraudulent calls.

International revenue share fraud prediction on the 5G edge using federated learning

“…This capability is especially important in the telecommunication domain since the ML models typically require many updates. This need is mainly due to the fact that Telecom companies frequently generate a huge amount of data (e.g., phone calls) and that new fraud methods are constantly being developed by the fraudulent agents [4,14].…”

“…However, this approach resulted in a large rate of false positives and an overall accuracy of 45% to detect an IRSF call. Another study [14] performed a comprehensive study on the nature of International Premium Rate Number (IPRN) and IRSF. Firstly, the authors defined a set of features based on relations between known test IPRNs and the origin and destination numbers of the calls.…”

“…Thus, the proposed approach requires a continuous IPRN database collection, that changes regularly and needs to be kept up to date, an issue that is also present in the features. One interesting aspect studied in [14] is that the IRSF scam can happen when considering only certain operators or when the call is initiated from a particular geographic point, since some types of IRSF frauds rely on the routes that the call follows from origin to destination. This means that, at times, the classification of a call as a scam call depends on the context in which it happens, which can increase the difficulty of the ML learning task.…”

“…Figure 4 shows the distribution of the two classes for both datasets. As is usual within the fraud domain [14], in both datasets most phone calls were considered "normal", with only a small percentage of records being considered "fraud". For the first batch of data, around 15.71% of the records were labeled as fraud (around 12,000 calls).…”

Red Light/Green Light: A Lightweight Algorithm for, Possibly, Fraudulent Online Behavior Change Detection

“…Telephony-related telecommunications services carry a large volume of call, message and data traffic every day. Such services can be used to monetize third party services, also in unintended ways [7]. In this sense, telephony can become a very profitable environment for fraud schemes.…”