Initial Fraud Trigger Setup

When setting up ClearIP fraud triggers for the first time, it is recommended that these 5 fraud triggers are set up:

Targeted Pumping
Fast Traffic Pumping
Slow Traffic Pumping
Theft of Service
Robocalling

The trigger Actions should be set to Report Only mode for ClearIP to monitor traffic and optionally send email alerts without automatically blocking any traffic. This allows ClearIP to analyze and learn normal traffic patterns while collecting data for reports.

It is recommended that these fraud triggers are left in Report Only mode to allow ClearIP to monitor production traffic for at least one week for any alerts to look for any false positives. If necessary, the fraud trigger thresholds can be adjusted to eliminate false positives. Once the fraud trigger thresholds are stable and do not create recurring false positives, the Action can be switched to Block or Divert mode to allow ClearIP to start automatically blocking or diverting any detected toll fraud.

NOTE: The organizational setup of call sources should be considered to determine the best course of action for initial setup. Typically, ClearIP customers don’t have Users, which is why it is recommended to set up triggers by Calling Number first. If a customer only has a Default User and plans on only having a single Default User, it is recommended to first set up triggers by Calling Number. If a customer has only a Default User for now, but plans to set up additional Users later, perhaps initial setup should be by User and Calling Number first and then by User. If a customer has multiple Users already set up, initial setup by User might make most sense.

Setup Triggers Based on Calling Number

In most cases, it is recommended to start by creating fraud triggers based on Calling Number. These initial triggers should be wildcard triggers. The process for setting up wildcard triggers based on calling number is basically the same for the 5 types of fraud that should be set up. Below are the instructions for setting up each of these triggers:

Targeted Pumping by Calling Number

In the Fraud dropdown menu in ClearIP, select the Targeted Pumping by Calling Number option. On this page, click the Add button. Fill out the form as follows:

Select the Operator if applicable.
Set the Service Provider and Group to the Default Service Provider and Default Group.
Set Action to ‘Report Only’.
Optionally enter Alert Email, Alert Phone and/or Alert URL to receive trigger alerts.
Leave all other fields blank or at the default value.

Leaving Calling Number blank on this form is what makes this a wildcard trigger. This trigger directs ClearIP to monitor traffic from all calling numbers for targeting pumping.

Once the wildcard trigger is created, more specific triggers by calling number should be created. To monitor target pumping for specific calling numbers, follow the same steps as above, but instead of leaving Calling Number blank, enter the calling number for which traffic should be monitored. This process must be repeated for each individual calling number that it is desired to monitor traffic for.

To be even more specific about which calls to monitor, triggers can also be created to direct ClearIP to not do fraud analysis on traffic from specific calling numbers. The process is the same as above, save for setting the Status to ‘Disabled’ instead of ‘Enabled’. This process must be repeated for each individual calling number that it is not desired to monitor traffic for.

Fast Traffic Pumping by Calling Number

In the Fraud dropdown menu in ClearIP, select the Fast Traffic Pumping by Calling Number option. On this page, click the Add button. Fill out the form as follows:

Select the Operator if applicable.
Set the Service Provider and Group to the Default Service Provider and Default Group.
Set Action to ‘Report Only’.
Optionally enter Alert Email, Alert Phone and/or Alert URL to receive trigger alerts.
Leave all other fields blank or at the default value.

Leaving Calling Number blank on this form is what makes this a wildcard trigger. This trigger directs ClearIP to monitor traffic from all calling numbers for fast traffic pumping.

Once the wildcard trigger is created, more specific triggers by calling number should be created. To monitor fast traffic pumping for specific calling numbers, follow the same steps as above, but instead of leaving Calling Number blank, enter the calling number for which traffic should be monitored. This process must be repeated for each individual calling number that it is desired to monitor traffic for.

Slow Traffic Pumping by Calling Number

In the Fraud dropdown menu in ClearIP, select the Slow Traffic Pumping by Calling Number option. On this page, click the Add button. Fill out the form as follows:

Select the Operator if applicable.
Set the Service Provider and Group to the Default Service Provider and Default Group.
Set Action to ‘Report Only’.
Optionally enter Alert Email, Alert Phone and/or Alert URL to receive trigger alerts.
Leave all other fields blank or at the default value.

Leaving Calling Number blank on this form is what makes this a wildcard trigger. This trigger directs ClearIP to monitor traffic from all calling numbers for slow traffic pumping.

Once the wildcard trigger is created, more specific triggers by calling number should be created. To monitor slow traffic pumping for specific calling numbers, follow the same steps as above, but instead of leaving Calling Number blank, enter the calling number for which traffic should be monitored. This process must be repeated for each individual calling number that it is desired to monitor traffic for.

Theft of Service by Calling Number

In the Fraud dropdown menu in ClearIP, select the Fast Traffic Pumping by Calling Number option. On this page, click the Add button. Fill out the form as follows:

Select the Operator if applicable.
Set the Service Provider and Group to the Default Service Provider and Default Group.
Set Action to ‘Report Only’.
Optionally enter Alert Email, Alert Phone and/or Alert URL to receive trigger alerts.
Leave all other fields blank or at the default value.

Leaving Calling Number blank on this form is what makes this a wildcard trigger. This trigger directs ClearIP to monitor traffic from all calling numbers for theft of service. Once the wildcard trigger is created, more specific triggers by calling number should be created. To monitor theft of service for specific calling numbers, follow the same steps as above, but instead of leaving Calling Number blank, enter the calling number for which traffic should be monitored. This process must be repeated for each individual calling number that it is desired to monitor traffic for.

Robocalling by Calling Number

In the Fraud dropdown menu in ClearIP, select the Robocalling by Calling Number option. On this page, click the Add button. Fill out the form as follows:

Select the Operator if applicable.
Set the Service Provider and Group to the Default Service Provider and Default Group.
Set Action to ‘Report Only’.
Optionally enter Alert Email, Alert Phone and/or Alert URL to receive trigger alerts.
Leave all other fields blank or at the default value.

Leaving Calling Number blank on this form is what makes this a wildcard trigger. This trigger directs ClearIP to monitor traffic from all calling numbers for robocalling. Once the wildcard trigger is created, more specific triggers by calling number should be created. To monitor robocalling for specific calling numbers, follow the same steps as above, but instead of leaving Calling Number blank, enter the calling number for which traffic should be monitored. This process must be repeated for each individual calling number that it is desired to monitor traffic for.