Method and apparatus for fraud control in a cellular telephone switch

[0002] This patent application is related to:

[0003] application Ser. No. 08/633,406, filed on Jun. 10, 1996, by William J. Kaminsky et al., and entitled “METHOD AND APPARATUS FOR FRAUD CONTROL IN CELLULAR TELEPHONE SYSTEMS”, which is a continuation-in-part of Ser. No. 08/389,348 below, and is a continuation-in-part of

[0004] application Ser. No. 08/657,974, filed on May 30, 1996, by Ronald S. Rudokas, et al., and entitled “METHOD AND APPARATUS FOR FRAUD CONTROL IN CELLULAR TELEPHONE SYSTEMS UTILIZING RF SIGNATURE COMPARISON”, which is a continuation of Ser. No. 08/389,348 below,

[0005] application Ser. No. 08/389,348, filed Feb. 16, 1995, by Ronald S. Rudokas, et al., now U.S. Pat. No. 5,555,551, and entitled “METHOD AND APPARATUS FOR FRAUD CONTROL IN CELLULAR TELEPHONE SYSTEMS UTILIZING RF SIGNATURE COMPARISON”, which is a divisional of Ser. No. 08/084,367 below, and

[0006] application Ser. No. 08/084,367, filed Jun. 29, 1993, by Ronald S. Rudokas, et al., now U.S. Pat. No. 5,420,910, issued May 30, 1995, and entitled “METHOD AND APPARATUS FOR FRAUD CONTROL IN CELLULAR TELEPHONE SYSTEMS UTILIZING RF SIGNATURE COMPARISON”;

[0007] all of which are incorporated by reference herein.

[0008] This patent application is related to:

[0009] Application Ser. No. 08/633,406, filed on Jun. 10, 1996, by William J. Kaminsky et al., now U.S. Pat. No. 5,950,121, issued Sep. 7, 1999 and entitled “METHOD AND APPARATUS FOR FRAUD CONTROL IN CELLULAR TELEPHONE SYSTEMS”, which is a continuation-in-part of Ser. No. 08/389,348 below, and is a continuation-in-part of

[0010] Application Ser. No. 08/657,974, filed on May 30, 1996, by Ronald S. Rudokas, et al., and entitled “METHOD AND APPARATUS FOR FRAUD CONTROL IN CELLULAR TELEPHONE SYSTEMS UTILIZING RF SIGNATURE COMPARISON”, which is a continuation of Ser. No. 08/389,348 below,

[0011] Application Ser. No. 08/389,348, filed Feb. 16, 1995, by Ronald S. Rudokas, et al., now U.S. Pat. No. 5,555,551, issued Sep. 10, 1996 and entitled “METHOD AND APPARATUS FOR FRAUD CONTROL IN CELLULAR TELEPHONE SYSTEMS UTILIZING RF SIGNATURE COMPARISON”, which is a divisional of Ser. No. 08/084,367 below, and

[0012] Application Ser. No. 08/084,367, filed Jun. 29, 1993, by Ronald S. Rudokas, et al., now U.S. Pat. No. 5,420,910, issued May 30, 1995, and entitled “METHOD AND APPARATUS FOR FRAUD CONTROL IN CELLULAR TELEPHONE SYSTEMS UTILIZING RF SIGNATURE COMPARISON”;

[0013] all of which are incorporated by reference herein.

[0014] 1. Field of the Invention

[0015] This invention relates in general to radio frequency (RF) communication systems, and in particular, to a method and apparatus for fraud control in cellular mobile radiotelephone (CMR) and personal communications services (PCS) systems.

[0016] 2. Description of Related Art

[0017] Cellular phones combine the mobility of the radio link and the world-wide land telephone network to provide a communication link to any other telephone in the world. However, as cellular phones have become more prevalent throughout the country, fraud has become a major problem. Cellular phone fraud robs service providers of hundreds of millions of dollars every year. Like all crimes, there are several varieties of cellular fraud, including “cloning.”

[0018] Cloning fraud, which occurs when a legitimate subscriber's mobile identification number (MIN) and electronic serial number (ESN) combination is used for illegal purposes, is among the most sophisticated and difficult forms of fraud to prevent. Often, the fraudulent user will use simple electronic receivers to “capture” the legitimate MIN/ESN combination during its transmission. In these cases, the legitimate subscriber often does not know fraud is being committed. This is currently the most popular method of gaining illegal access to a cellular system because the legitimacy of the stolen MIN/ESN combinations makes cloning difficult to catch.

[0019] Techniques exist for identifying situations in which two cellular phones with the same MIN/ESN combination are making a call at the same time. Motorola Technical Education and Documentation, 68P09222A54-O, of Aug. 14, 1994 entitled “Clone Clear Feature”, which is incorporated by reference herein, discloses a method of detecting duplicate MIN/ESN combinations present on a switch simultaneously and for dealing with such duplicate calls.

[0020] Duplicate calls may arise in any number of different ways. For example, a first call from a cellular phone may be disconnected because of carrier loss, wherein the cellular phone immediately attempts a second call to re-establish its connection before the switch has completely torn down the first call. In another example, interference on the channel at the base station controller causes the controller to mark the first call as active, when in fact the cellular phone has completed its first call and has started a second call. In yet another example, a fraudulent cellular phone may be illegally using the valid MIN/ESN combination.

[0021] When simultaneous, duplicate MIN/ESN combinations are detected on a switch, the first cellular phone detected, the second cellular phone detected, or neither of the cellular phones can be terminated using the Clone Clear Feature of the switch Generally, these options are left to the discretion of the switch operator.

[0022] Calls terminated by the Clone Clear Feature are typically marked with a Call Final Class (CFC) “8E” hexadecimal value in their associated call records. When this particular CFC value is present in a call record, it is usually interpreted as an unbillable call by accounting systems. Unfortunately, this results in lost revenue in the first two examples described above, where the duplicate calls arose through the actions of a legitimate subscriber without the presence of clone activity.

[0023] Additionally, inherent to the Clone Clear Feature is a situation referred to as a “glare war.” There are numerous scenarios that can cause a glare war. For example, a call placed by a legitimate cellular phone may be interrupted by the activity of a fraudulent cellular phone. The legitimate cellular phone may be forcibly disconnected by the Clone Clear Feature when the call from the fraudulent cellular phone occurs on the switch. The legitimate subscriber may perceive that a dropped call has occurred (which itself is detrimental to the carrier's reputation). If the legitimate subscriber attempts to re-connect, while the call from the fraudulent cellular phone is still connected, then the Clone Clear Feature will forcibly disconnect the call from the fraudulent cellular phone. If the fraudulent cellular phone attempts to immediately re-connect, using the same MIN/ESN combination as the legitimate subscriber, it is likely the call placed by the legitimate subscriber will once again be interrupted by the Clone Clear Feature.

[0024] While the Clone Clear Feature is efficient for minimizing fraudulent use, it can cause the indiscriminate termination of calls, including those placed by legitimate cellular phones. Thus, the Clone Clear Feature has its drawbacks when used by carriers. It can be seen, then, that there is a need for fraud control techniques which terminate only fraudulent calls when duplicate MIN/ESN combinations are detected on a switch.

[0025] To overcome the limitations in the prior art described above, and to overcome other limitations that will become apparent upon reading and understanding the present specification, the present invention discloses an apparatus and method for fraud control using enhanced techniques with a call interdiction feature of a switch. A system in accordance with the principles of the present invention includes a fraud control system that monitors calls, identifies both legitimate and fraudulent cellular phones, discriminates legitimate cellular phones from fraudulent cellular phones, and then transmits an interdiction message to the switch, wherein the interdiction message instructs the switch to terminate calls placed from fraudulent cellular phones, while allowing calls placed by legitimate cellular phones to continue undisturbed.

[0026] One aspect of the present invention is that the switch may terminate one, more than one, or none of the calls with identical MIN/ESN combinations. Another aspect of the present invention is that the interdiction message may comprise a call setup message having an identical MIN/ESN combination as the fraudulent cellular phone present on the switch, but including a special prefix and the called number associated with the call placed by the fraudulent cellular phone. Still another aspect of the present invention is that the switch recognizes and terminates the fraudulent call by comparing the called number in the interdiction message with the called numbers from the duplicate MIN/ESN combinations. Yet another aspect of the present invention is that the switch may mark the fraudulent call with a call code in its associated call record identifying it as a terminated call.

[0027] These and various other advantages and features of novelty which characterize the invention are pointed out with particularity in the claims annexed hereto and form a part hereof. However, for a better understanding of the invention, its advantages, and the objects obtained by its use, reference should be made to the drawings which form a further part hereof, and to accompanying descriptive matter, in which there is illustrated and described specific examples of an apparatus in accordance with the invention.

[0028] Referring now to the drawings in which like reference numbers represent corresponding parts throughout:

[0029] FIG. 1 is a diagram of a typical cellular phone system according to the present invention;

[0030] FIG. 2 illustrates the components of an exemplary cellular switch in a mobile telephone switch office according to the present invention;

[0031] FIG. 3 is a block diagram further illustrating the components of an exemplary fraud control system coupled to the switch according to the present invention;

[0032] FIG. 4 is a flowchart illustrating the steps performed by the fraud control system according to the present invention; and

[0033] FIG. 5 is a flowchart illustrating the steps performed by the switch according to the present invention.

[0034] In the following description of the exemplary embodiment, reference is made to the accompanying drawings which form a part hereof, and in which is shown by way of illustration the specific embodiment in which the invention may be practiced. It is to be understood that other embodiments may be utilized as structural changes may be made without departing from the scope of the present invention.

[0035] FIG. 1 is a diagram of a typical cellular phone system 10 according to the present invention. The basic concept of the cellular phone system 10 is to increase the availability of mobile phone service, which always has been a scarce luxury, by reducing the area covered by a transceiver 12 by reducing the power of transmission. In this way, concentrated areas of population can have more transceivers 12, and thus more channels, because each transceiver 12 handles a given number of conversations. In addition, because the transceivers 12 cover less area, the same frequency can be re-used in a common geographical area.

[0036] Within a cellular phone system 10, a service area is divided into regions called cells 14, each of which has the necessary equipment to transmit and receive calls to/from any cellular phone 16 located in the cell's coverage area, and to connect the calls to a switch. A transceiver 12 in each cell 14 can transmit and receive a plurality of channels in a specified frequency range simultaneously.

[0037] Each cell 14 has at least one setup channel dedicated for signaling between the cell 14 and cellular phones 16 located therein. The remaining channels are used for voice conversations or data sessions. Each channel may be used for many simultaneous voice conversations or data sessions in cells 14 which are not adjacent to one another, but are far enough apart to avoid excessive interference. Thus, a system 10 with a relatively small number of subscribers can use large cells 14, and as demand grows, the cells 14 are divided into smaller ones.

[0038] A cellular phone 16 consists of a control unit, a transceiver, and appropriate antennas. The transceiver contains circuits that can tune to any of the channels assigned to the cellular phone system 10. Each cellular phone 16 has a unique electronic serial number (ESN). Additionally, each cellular phone 16 is assigned a unique 10-digit mobile identification number (MIN) identical in form to any other telephone number. Users of the cellular phone 16 dial the local or long-distance number where applicable, as if calling from a fixed telephone. The cellular customer is typically charged a monthly connect charge as well as air-time usage charges for either incoming or outgoing calls.

[0039] Cells 14 are interconnected and controlled by a central Mobile Telecommunications Switching Office (MTSO) 18, which is basically a telephone switching office as far as hardware is concerned, but includes a substantial amount of additional digital equipment programmed for cellular control. The MTSO 18 not only connects the system 10 to the land telephone network, but also records call information for billing purposes.

[0040] FIG. 2 illustrates the components of an exemplary cellular switch 20 in an MTSO 18 according to the present invention. The cellular switch 20 may be, for example, a Motorola EMX Series switch or the switch of another manufacturer, and may include a CPU 22, tone signaling units 24, switch units 26, controlling group multiplexer units 28, and voice group units 30 for connection to telephone trunks, lines, base site controllers, and announcement machines. The switch 20 may further include maintenance and status units 32, displays 34, teleprinters 36, tape drives 38, and modems 40 connecting the switch 20 to base site controllers 42 which interface the switch 20 to the radiotelephone equipment in each cell 14 and provide the translation between data messages to and from the switch 20 and digital signaling to and from the cellular phone 16. The switch 20 is linked to the cells 14 by a group of voice trunks 44 for conversations, together with one or more data links 46 for signaling and control. Those skilled in the art will recognize that the invention is not meant to be limited by this example. Rather, this example is provided for illustration only, and other switches 20 may be used without departing from the invention.

[0041] The cellular switch 20 is designed specifically for radiotelephone service, and therefore has capabilities not found in central offices in land telephone network (handoff, roamer files, air-time records, etc.). Nevertheless, it may offer a selection of subscriber features found in most telephone exchanges, including Call Waiting, No-answer Transfer, Call Forwarding and Three-Party Conferencing.

[0042] When handling calls made from the cellular phone 16 to a land party, the switch 20 verifies the MIN/ESN combination of the cellular phone 16 and seizes one of the available trunk circuits 44. After receiving the appropriate signal from the central office of the land telephone network, it forwards the number of the land party being called.

[0043] When handling calls made from a land party to the cellular phone, the land party dials the number of the cellular phone 16 and the telephone network routes the call to the central office serving the switch 20. After receiving the digits, the switch 20 verifies and then forwards the digits on the data lines 46 to the base site controllers 42. Call processing software within the switch 20 performs the functions of responding to call events, establishing path connections, and collecting call data for billing purposes.

[0044] FIG. 3 is a block diagram illustrating the components of an exemplary fraud control system 48 coupled to the switch 20 according to the present invention. Preferably, the fraud control system 48 is a variation of the systems disclosed in the commonly assigned patent applications cited in the Cross-Reference to Related Applications above, all of which are incorporated by reference herein. However, those skilled in the art will recognize that different fraud control systems could also be used without departing from the scope of the present invention.

[0045] The fraud control system 48 comprises a CPU 50, one or more monitors 52, a data link 54 for receiving call records from a port of the switch 20 (or other network element), a data link 56 for transmitting interdiction messages to the switch 20, and (optionally) databases for call records 58, positive validation 60, and negative validation 62. In addition, the fraud control system 48 may be coupled to an radio frequency (RF) fingerprinting system, as described in the commonly assigned patent applications cited in the Cross-Reference to Related Applications above, all of which are incorporated by reference herein.

[0046] The fraud control system 48 performs real-time data collection of call records from the switch 20 into a call record database 58. Using a behavior profiling system and/or RF fingerprinting system, the fraud control system 48 scans the call records in the database 58 and extracts records corresponding to known patterns of probable legitimate and fraudulent use or activity. In behavior profiling, specific activities represented within the different fields of the call records are identified and flagged, including time, duration, cell, dialed digits, etc., and relative probabilities are assigned to the specific activities identified and flagged within the call records. In RF fingerprinting, legitimate and fraudulent cellular phones can be identified by RF transmission characteristics.

[0047] The fraud control system 48 indexes all call records in the call record database 58 associated with a specific MIN/ESN combination and the relative probabilities are accumulated towards an alarm threshold. The alarm threshold reflects an accumulated probability within some defined period. If the alarm threshold is reached, the MIN/ESN combination is identified as a fraudulent cellular phone.

[0048] In some cases, these identifications of fraudulent cellular phones are performed automatically by the fraud control system 48. In other cases, these identifications of fraudulent cellular phones are performed automatically by the fraud control system 48, and then verified through the intervention of an operator.

[0049] Once a fraudulent cellular phone is identified by the fraud control system 48, the positive and/or negative validation databases 60 and 62 are updated to reflect the identification. Moreover, the specific call placed by the fraudulent cellular phone is also identified by the fraud control system 48 using the call records. Thereafter, the called number associated with the specific call is extracted from the call records.

[0050] Once the specific call of the fraudulent cellular phone is identified, the fraud control system 48 generates a termination message comprising a command instructing the switch 20 to terminate the fraudulent call and a data field identifying the fraudulent cellular phone and its associated call. This interdiction message is then transmitted from the fraud control system 48 to the switch 20 for execution. The switch 20 receives the interdiction message, interprets it, and then searches for the call placed by the fraudulent cellular phone using the data field. Once the call is located, the switch 20 terminates the call.

[0051] Although the interdiction message may be in any format agreed upon and recognizable by both the switch 20 and the fraud control system 48, the preferred embodiment formats the interdiction message as a call setup request from a cellular phone, and the interdiction message is transmitted as a standard cellular phone call to the switch 20. The call setup request includes the identified MIN/ESN combination of the fraudulent cellular phone and the called number associated with the call placed by the fraudulent cellular phone. The called number is altered to include a System Prefix (SP), e.g., a string of digits such as “*999”, preceding the called number. The System Prefix acts as a command within the interdiction message instructing the switch 20 to terminate the associated call. The fraud control system 48 then transmits the call setup request to the switch 20.

[0052] It is envisioned that the data link 56 is a radio frequency (RF) communications channel established by a modified transceiver at the fraud control system 48, wherein the transceiver communicates with the switch 20 in a manner identical to a cellular phone. Alternatively, the data link 56 may comprise a radio frequency (RF) communications channel established by a controller at the fraud control system 48, wherein the controller communicates with the switch 20 in a manner identical to a base site controller 42 at a cell 14.

[0053] The switch 20 receives the call setup request from the fraud control system 48 and is programmed to recognize the System Prefix as a command instructing it to terminate the call identified by the called number and associated with the MIN/ESN combination. The switch 20 searches for the identified call, and if it is found, terminates the call. After terminating the call, the switch 20 marks the call records associated with the terminated call with a call code identifying it as a terminated call. The call placed by the legitimate cellular phone is left undisturbed.

[0054] FIG. 4 is a flowchart illustrating the steps performed by the fraud control system according to the present invention.

[0055] Block 64 represents the fraud control system 48 receiving call origination information via call records received from the switch 20 and storing the call records in the call database 58, wherein the call records are associated with a specific MIN/ESN combination. The call records received from the switch 20 comprise an indication that a specific cellular phone 16 has placed a call in the cellular phone system 10 and document any number of different call events or billing actions beginning from call setup through call completion.

[0056] Block 66 represents the fraud control system 48 determining whether the call is fraudulent, through behavior profiling, RF fingerprinting, and/or other techniques. If the call is not fraudulent as represented by Block 68, then control transfers to Block 70; otherwise, control transfers to Block 72.

[0057] Block 70 represents the fraud control system 48 identifying the MIN/ESN combination as a legitimate cellular phone.

[0058] Block 72 represents the fraud control system 48 identifying the MIN/ESN combination as a fraudulent cellular phone.

[0059] Once the call is identified as fraudulent, Block 74 represents the fraud control system 48 extracting the information regarding the call setup request from the call records (usually from the initial call records in the sequence) and generating the interdiction message.

[0060] Block 76 represents the fraud control system 48 transmitting the interdiction message to the switch 20 for execution.

[0061] Block 78 terminates the logic.

[0062] FIG. 5 is a flowchart illustrating the steps performed by the switch 20 according to the present invention. Preferably, the steps performed by the switch 20 comprise a variation of the Clone Clear Feature found in Motorola switches 20, although those skilled in the art will recognize that other switch types may be programmed in a similar manner to perform the recited steps.

[0063] Block 80 represents the switch 20 receiving messages, such as call setup requests, etc.

[0064] Block 82 is a decision block representing the switch 20 determining whether the message is an interdiction message from the fraud control system 48. If not, then control transfers to block 84; otherwise control transfers to block 86.

[0065] Block 84 represents the switch 20 processing the non-interdiction message in a normal manner.

[0066] Block 86 represents the switch 20 searching its active calls for one having a MIN/ESN combination and a called number matching the interdiction message.

[0067] Block 88 is a decision block that represents the switch 20 determining whether a matching call was found. If not, control transfers to block 94, which ends the steps; otherwise control transfers to block 90.

[0068] Block 90 represents the switch 20 terminating the call identified by the called number and associated with the MIN/ESN combination.

[0069] Block 92 represents the switch 20 generating a call record recording the termination event, wherein the call record contains a call code identifying it as a terminated call.

[0070] Block 94 terminates the logic.

[0071] In summary, the present invention discloses a method and apparatus for fraud control using enhanced techniques with the overlapping call interdiction feature of a switch. A system in accordance with the principles of the present invention includes a fraud control system that monitors calls, identifies both legitimate and fraudulent cellular phones, discriminates legitimate cellular phones from fraudulent cellular phones, and then transmits an interdiction message to the switch, wherein the interdiction message instructs the switch to terminate calls placed from fraudulent cellular phones, while allowing calls placed by the legitimate cellular phones to continue undisturbed.

[0072] The foregoing description of the exemplary embodiment of the invention has been presented for the purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed. Many modifications and variations are possible in light of the above teaching. It is intended that the scope of the invention be limited not with this detailed description, but rather by the claims appended hereto.