Under-reported and surprisingly under-discussed, telecoms fraud remains a significant and pervasive problem. It results in massive revenue drain, to the tune of an estimated whopping €29 million annually.
Fraud is a global problem, and as such, a global, collaborative and open approach is needed to really tackle the problem. This is an approach BICS has been taking for years. It’s an approach enabled by our FraudGuard platform, our crowdsourcing model for information sharing, and by our participation in a number of industry bodies. And it’s an approach driven by BICS’ Head of Fraud Prevention and Operation Services, Katia Gonzalez.
We took five minutes out of Katia’s busy day to ask her some key questions on the topic of telecoms fraud.
What tactics are you commonly seeing criminals use to commit telecoms fraud?
We’re still seeing instances of Wangiri. The scam involves prompting the recipient to return a call, which then connects to an international number that incurs significant connection fees.
However, something we’re seeing an increasing amount of is SMS fraud. Criminals are finding ways to push application-to-person (A2P) traffic through person-to-person (P2P) routes and ways to generate important volumes of Premium SMS, all of it at a significant cost to operators.
This has taken many operators by surprise. We’re seeing a similar situation as we did with voice fraud seven or eight years ago – when operators found themselves unprepared to deal with the threat on international traffic streams. Many operators will only detect incidents when they see an invoice from a wholesaler further down the line. This might be three or four times what they usually pay. We’ve heard about bill shock in the subscriber ecosystem. Now, we’re seeing major bill shock for operators!
What’s driving the increase in SMS fraud?
It’s becoming harder to make money via voice fraud. Of course, this problem is still there. However, because it’s more talked about and more known about, more operators have the tools in place, so they’re ready to act and prevent damage. There’s less focus on SMS fraud, which requires detailed real-time monitoring.
SMS fraud has evolved and diversified. We see criminals use more sophisticated means to commit SMS bypass, for instance, using mobile apps and malware to avoid international termination costs. We also see that fraudsters push high volumes of premium SMS through the operator’s network. Once sent, it cannot be blocked, so operators end up paying huge bills. It’s a relatively easy way for criminals to make money. So, unfortunately, the increase in incidents is a natural evolution in the fraud landscape.
What can be done to tackle SMS fraud?
Fortunately, the tools are there, but it’ll take a while for adoption to keep up with attacks. Many operators have SMS firewalls. However, they mainly focus on A2P SMS bypass. This leaves P2P open to abuse and the new A2P fraud attacks disregarded.
BICS is helping to support operators with our complete SMS Fraud protection solution. The solution manages all A2P and P2P activity and filters out fraud and prevents bypass. This means that spoofed and faked messages are stopped before they even enter the operator’s network, and network bandwidth is released for revenue-generating traffic.
What other developments have you seen in tackling fraud?
We’ve seen regulatory changes that can help in addressing telecoms fraud. UK regulator Ofcom, for instance, introduced price caps on the wholesale cost of calls to 070 numbers last October 2019.
Ofcom’s move was intended to help tackle a scam that involved fraudsters purchasing and abusing 070 numbers. Easily mistaken for British mobile numbers, these were very expensive to call. Subscribers were therefore tricked into dialling high-rate lines. Operators meanwhile were unable to distinguish between premium-rate numbers and mobile numbers. As a result of Ofcom’s move, fraudulent attacks using the numbering range fell by 75% between October 2019 and September 2020.
We’re also seeing wider collaboration between different players in the telecoms ecosystem, both in Voice and SMS. This is crucial, as the bridge between traditional telecoms and digital service providers narrows.
BICS has worked with cybersecurity expert POST Cyberforce, for instance. We’ve combined our worldwide reach and extensive visibility into network traffic with POST Cyberforce’s expertise in security optimisation. The resulting solution is being used by mobile operators to secure network infrastructure against signalling attacks. The solution provides threat detection, monitoring, and vulnerability assessments. It’s underpinned by 24/7 business support including forensic investigations.
Can you make any predictions for the future of telecoms fraud?
We have seen a regulatory push in some jurisdictions recently (e.g. FCC regarding robocalling, Ofcom regarding UK 070 range misuse) with good results. But regulatory-driven initiatives tend to take time to be fully realised. In the meantime, we expect to see a continuation of industry collaboration, and a growing number of operators realising the benefits of intelligence-sharing in the fight against fraud.
We must remember, though, that fraudsters will always seek out vulnerabilities for exploitation. Vigilance is a must in the constant evolution of our detection methods and tools, and industry collaboration is crucial in reducing those vulnerabilities and susceptibility to fraud.
This is the idea behind BICS’ crowdsourcing fraud intelligence database. This allows operators to benefit from the holistic view that BICS has across services (Voice, SMS, roaming) and get protection against the most recent attacks. It then allows customers to pro-actively address and minimise potential threats.