Introduction
ClearIP can analyze calls for various types of toll fraud attacks. The different types of fraud that ClearIP is currently able to manage are listed below. Fraud control is configured in ClearIP by setting fraud triggers. A fraud trigger describes the conditions that should be met for a fraud attack to be detected and says what action to take as a result.
Types of Fraud
Toll fraud types are mainly characterized by the call source or destination. The call source may refer to the specific calling number, user, combined user and calling number, or group. The call destination may refer to the specific called number or called country.
The different types of fraud are defined in more depth below.
Note: To block Neighbor Spoofing, please visit the Whitelist/Blacklist documentation. For carriers based in countries that participate in the North American Numbering Plan, Neighbor Spoofing is when a calling party modifies their asserted calling number to match the called party’s NPA-NXX number to seem like a neighbor.
| Fraud Trigger Type | Destination | Time Period | Fraud Score Unit |
|---|---|---|---|
| Targeted Pumping | Specific Number | 15 minutes | Call Count |
| Fast Traffic Pumping | Specific Country | 5 minutes | Called Fraud Score |
| Slow Traffic Pumping | Specific Country | 60 minutes | Called Fraud Score |
| Theft of Service | All | 60 minutes | Called Fraud Score |
| Robocalling | All | 60 minutes | Call Count |
| Wangiri | All | 5 minutes | Calling Fraud Score |
Targeted Pumping
Targeted pumping triggers can help stop someone from making repeated calls to a specific called number within a 15-minute period. If someone makes too many call attempts to the same number within the 15-minute time period based on the configured threshold value, ClearIP can automatically block subsequent call attempts from the call source to the specific called number.
These triggers monitor calls going to a specific called number over a 15-minute period from a specific call source. Each call is rated with a fraud score of 1, effectively making this trigger a simple call counter. Only calls from the specific call source to the specific called number will be blocked or diverted when a trigger event occurs.
In this example of a targeted pumping trigger event, someone made numerous call attempts from the calling number 16153720300 to a Nicaragua number 50582314128 within one minute. After the first few call attempts, ClearIP automatically blocked 16153720300 from making anymore calls to 50582314128. The calling number 16153720300 may still place calls to other called numbers, and other calling numbers may still call 50582314128.
The Fraud Score Threshold of this trigger refers to the number of allowed call attempts between a specific call source and called number. If the Fraud Score Threshold is set to 10, then a call source is allowed to make 10 call attempts to the same number within 15 minutes or less. Any call attempts over the 10 call limit can be automatically blocked temporarily.
Fast Traffic Pumping
Fast traffic pumping triggers can help stop traffic pumping calls quickly made to different called numbers in a specific called country. If someone makes too many call attempts to a particular country within a 5-minute period, ClearIP can automatically block subsequent call attempts from the call source to the specific called country.
These triggers monitor calls going to a specific called country over a 5-minute period from a specific call source. Each call is rated for fraud based on the called fraud score. Only calls from the specific call source to the specific called country will be blocked or diverted when a trigger event occurs.
In this example of a fast traffic pumping trigger event, someone made numerous call attempts from the calling number 19072778671 to many different Tanzanian numbers within five minutes. After the first few call attempts, ClearIP automatically blocked 19072778671 from making anymore calls to Tanzania.
The Fraud Score Threshold of this trigger refers to the allowed financial risk of call attempts between a specific call source and called number. The financial risk of the call is determined by the termination rates uploaded into the Default or Custom Fraud Rates page. If the Fraud Score Threshold is set to 2, then a call source is allowed to make call attempts to the same country within 5 minutes or less.
Slow Traffic Pumping
Slow traffic pumping triggers can help stop traffic pumping calls gradually made to different called numbers in a specific called country. If someone makes too many call attempts to a particular country within a 60-minute period, ClearIP can automatically block subsequent call attempts from the call source to the specific called country.
Slow traffic pumping triggers monitor calls going to a specific called country over a 60-minute period from a specific call source. Each call is rated for fraud based on the called fraud score. Only calls from the specific call source to the specific called country will be blocked or diverted when a trigger event occurs.
In this example of a slow traffic pumping trigger event, someone made 31 call attempts from the calling number 33978080455 to a Burkina Faso number 22625497900 spanning over a 90-minute period. After the first few call attempts, ClearIP automatically blocked 33978080455 from making anymore calls to Burkina Faso.
Theft of Service
Theft of service triggers can help stop traffic pumping calls made to a variety of international countries. If someone makes too many expensive international calls within a 60-minute period, ClearIP can automatically block subsequent call attempts from the call source to any international destination.
These triggers monitor all calls over a 60-minute period coming from a specific call source. Each call is rated for fraud based on the called fraud score. All calls from the specific call source will be blocked or diverted when a trigger event occurs.
In this example of a theft of service trigger event, someone made numerous call attempts from the calling number 13855014545 to many different international countries within ten minutes. After the several suspicious call attempts, ClearIP automatically blocked 13855014545 from making anymore international calls.
Robocalling
Robocalling triggers can help prevent subscribers from making a high-volume of outbound calls or prevent excessive incoming calls from the same calling number.
These triggers monitor all calls over a 60-minute period, coming from a specific call source. Each call is rated for fraud with a fraud score of 1, effectively making this trigger a simple call counter. All calls from the specific call source will be blocked or diverted when a trigger event occurs.
Note: Robocalling triggers focus on the volume of calls whereas Theft of Service triggers focus on the potential financial cost of calls.
Suggestion: You can also use Reputation lookup services and Inbound Shield services to prevent robocalls on inbound calls.
Wangiri
Wangiri triggers can help stop fraudsters that bait potential fraud victims by calling from high termination rate destinations and then expect to be called back.
These triggers monitor all calls over a 5-minute period, coming from a specific call source. Each call is rated for fraud based on the calling fraud score. All calls from the specific call source will be blocked or diverted when a trigger event occurs.