How big is the impact of the IRSF Fraud and how are the attacks launched?
International Revenue Share Fraud (IRSF) is one of those fraud types that has been alive for two decades now, all because of the fraud being intricate in its pattern while the approach to it being still very reactive. Here, the motive of the fraudster is to abuse a telecom operator’s network infrastructure to artificially inflate traffic onto high-risk international destinations with the intention of non-payment. This fraud is common to multiple geographies and has estimated for a fraud loss of USD 6.1 Billion (The highest fraud loss contributor) as per the Communications Fraud Control Association (CFCA) Global Fraud Loss Survey, 2017.
Lack of adequate steps taken to protect the network has caused this fraud to grow by leaps and bounds. In this fraud, the attacker usually tries to exploit the vulnerabilities of the Telecom Service Provider’s assets and attacks by either calling to unallocated number ranges or land calls onto international premium rated services or illegitimately route calls to short stopped mobiles. PBX hacking and abuse of promotional services are often the commonly used methods for executing the fraudulent practices. The fraud is also quite common with many fixed line providers.
In my experience of working with multiple operators, globally, I feel that the most common challenge faced by operators is in understanding the fraud pattern and method used by the attacker. The impact to operator becomes brutal when fraudsters use unknown patterns of execution and sophisticated techniques to attack the network. IRSF attack from roaming network, call conferencing, call forwarding, calling cards, negative margin abuse for products and services are among the more popular methods for fraudster in launching attacks.
Also, the lack of regulatory precedence in governing the way of carrying out business with international carriers is quite laxative now, setting the perfect breeding ground for fraudsters to flourish.
Why has this fraud grown in leaps and bounds and how do I ensure control Proactiveness?
Now here is the bummer – the traditional and reactive fraud countering mechanisms as of date do not have a full-proof solution, and one of the biggest reasons is that there are not enough fraud controlling strategies, mechanisms, and systems in place. IRSF, unlike other fraud types, requires a continual and proactive measure for control. More than just the “run-of-the-mill” detection techniques, the fraud type requires a well-planned control and mitigation steering strategy and here are six simple strategies, to begin with:
- Fraudulent practices have become cleverer over time.
If we brag of the fact that the fraud detection technologies have become quite sophisticated over time, we must not forget that the fraud practices too have gained an equal amount of intelligence. Fraudsters these days are quick to realize technology loopholes and system fault lines. It does not take much for fraudsters today to detect the fraud finding patterns and control logic of Telecom Service providers and identified the loophole in the system. Study of method and pattern become a critical process.
- Demoralize your IRSF attacker.
Letting your attacker attack you to dig his own grave sounds like an oxymoron? Actually not! It is, in fact, possible to have a honey -trap system in place where you lure the attacker to launch his/her attacks onto it without a fruitful outcome. The more the attacker’s attempts fail, the less hopeful he/she gets to strive any further.
- Think of the customer and protect their interests
IRSF not just drains away revenue resources but also can cause customer dissatisfaction, causing them to churn out of the network eventually. Hence it is crucial that we don’t ignore whenever a customer complains of frequent cross-connections or call diversions for international calls.
- Have an “Anytime-Anywhere” vigilance strategy with automation to your advantage
There is no denial to the fact that detection processes for IRFS are very complicated and resource intensive. However, having the right strategies, the right processes with the right amount of automation applied to them can help the business in a significant way. I personally recommend a 24 x 7 detection strategy to be put in place to counter the IRSF attacks. From the cases that I have dealt with, it’s my observation that the IFRS attacks happen round the clock, including the wee hours of the morning or off-business hours. Having a rotational manpower strategy can really work wonders at times. However, there could also be instances where having a 24*7 approach may not be possible owing to the lack of capital or high cost of human resources. In such instances, the automation of detection processes will be of value.
- Never ignore Negative Margins
Negative margins can occur at any level. It could emerge while planning the pricing strategies of the products, services, use of calling cards in international destinations or Interconnect agreements. Feeble margins on profits can often open a Pandora’s box for fraudsters. Just the basic knowledge on negative margins is enough for fraudsters to break open mayhem. Trend reports on traffic patterns with priorities given to partnerships with frugal margins can save the day!
- Pursue Strategic Knowledge Partnerships to establish Fraudster Intelligence
Sharing knowledge and having a supportive ecosystem for interaction with carrier partners and vendors in the value chain can be a practical step closer to proactiveness. Also, MoU’s established with knowledge bodies and CoEs like GSMA, CFCA, and others can help the TSP gain information such on PRS test numbers and services, high-risk range numbers, unallocated number series which can be used as vital sources of references to counter this fraud.
When I say, a reactive approach for IRSF fraud, I mean that much of the effort and systems built towards countering the fraud is in silos and so are the human efforts that go into it. By a proactive system, I would mean a system that is quite unified in its approach and can perform end to end operations associated with the fraud type. One of the many ways of building a more unified system is to go the AI (Artificial Intelligence) way. A well thought out AI technology strategy can really help detect the fraud at a very early stage and help you choose the right controls for specific problems in question. It aims to reduce the time taken by the laborious human efforts that goes into the detection stage while helping analysts and investigators concentrate on the need of the hour. Much as the famous English saying goes “Every Cloud has a silver lining,” the impact of the IRSF can considerably be reduced by just broadening the organizational perspectives towards the fraud.
Vijay is a Principal Consultant in Subex’s Managed Services vertical, focusing on Fraud Management. He has over 12+ years of experience in Telecom fraud, & Revenue Assurance management professional with progressive experience in process management and managing risks in telecom business.