Defeating Telecom Fraud: Mitigating Wangiri, Unlicensed Gateway Bypass & IRSF across Carrier Networks
Published by AVM Networks NOC Engineering • Category: Standards & Compliance • 9 min read
A definitive operational manual for carrier fraud prevention. Covers the anatomy of Wangiri one-ring scams, International Revenue Share Fraud (IRSF), unlicensed gateway bypass, and real-time automated fraud filtering in Class 4 softswitches.
A definitive operational manual for carrier fraud prevention. Covers the anatomy of Wangiri one-ring scams, International Revenue Share Fraud (IRSF), unlicensed gateway bypass, and real-time automated fraud filtering in Class 4 softswitches.
- International Revenue Share Fraud (IRSF) generates over $6B in annual carrier damages via unallocated premium number hijacking and automated PBX pumping.
- Inline softswitch FMS heuristics detect and terminate Wangiri dialing bursts (<1% ASR, >200 CPS) at the SIP signaling border within milliseconds.
- Originating carriers remain legally and financially liable for fraudulent termination minutes unless real-time cryptographic and destination caps are enforced.
1. What Are IRSF and Wangiri Attacks and How Do They Exploit Carrier Interconnects?
International Revenue Share Fraud (IRSF) remains the single most costly fraud category in wholesale voice, causing an estimated $6 billion in annual losses. Criminal syndicates obtain unallocated premium rate number ranges from corrupt or compromised minor operators. They then hack enterprise PBXs or generate automated burst calls to run up millions of minutes of unpayable wholesale termination charges.
In Wangiri ("one ring and cut") attacks, high-speed automated dialers blast thousands of international calls, hanging up after a single ring. Unwitting mobile subscribers call back the missed number, incurring astronomical international premium rate toll charges settled back to the fraudsters.
2. How Do Real-Time Fraud Management Systems (FMS) Detect and Block Malicious Traffic?
Effective fraud mitigation requires inline softswitch policing rather than post-call CDR analysis. AVM Networks FMS applies millisecond-level heuristics on every SIP INVITE:
• High-Risk Destination Caps: Limiting concurrent channels and CPS to known high-risk IRSF island territories (e.g., Diego Garcia, Tuvalu, São Tomé).
• Duration Anomaly Triggers: Flagging calls exceeding 120 continuous minutes or sudden 1,000% spikes in traffic volume to rare numbering plans.
• Low ASR / High Seizure Correlation: Detecting automated Wangiri dialing scripts where ASR is < 1% and seizure rates exceed 200 CPS.
route[FRAUD_DETECTION] {
# Check destination against dynamic high-risk IRSF prefix list
if (redis_cmd("redis://fms.local:6379", "SISMEMBER irsf_high_risk_prefixes $rU", "$var(is_fraud)")) {
if ($var(is_fraud) == "1") {
# Check current concurrent channel count for customer trunk
get_profile_size("customer_calls", "$fU", "$var(active_channels)");
if ($var(active_channels) > 5) {
xlog("L_ALERT", "IRSF FRAUD BLOCKED: Customer $fU attempting burst to $rU! Dropping.");
sl_send_reply("403", "Destination Blocked by Carrier Fraud Shield");
exit;
}
}
}
}3. How Does Bilateral Intelligence Sharing Protect Carriers from Multi-Million Dollar Liabilities?
AVM Networks participates in international carrier intelligence exchanges, ingesting daily threat feeds of compromised number ranges. Our automated fraud shield intercepts unauthorized traffic in flight, protecting partner credit lines and safeguarding interconnect integrity.
AVM Secure Direct SIP Peering & Voice Gateways
Protect your voice traffic with automated real-time IRSF and Wangiri fraud filtering.
Secure Voice Interconnect →Authoritative Standards & Regulatory Citations
- GSMA PRD FF.12: Fraud Management Guidelines for Mobile Operators (GSMA - GSMA FF.12)
- ITU-T Recommendation E.164: The international public telecommunication numbering plan (ITU-T - Rec. E.164)
Frequently Asked Engineering Questions
What immediate steps should a carrier take upon discovering an IRSF breach?
Immediately disable the affected SIP trunk credentials in the SBC, block the destination dial codes globally, verify softswitch CDRs, and notify your upstream carrier NOC within 60 minutes.
How does AVM Networks prevent false positives during legitimate traffic surges?
Our FMS employs dynamic baseline profiling, distinguishing authorized enterprise customer broadcasts from fraudulent anomalies using pre-registered route authorizations.