Detecting and preventing fraudulent use in a telecommunications network

[0002] This application is a continuation of international application PCT/F199/01026 filed on Dec. 10, 1999

[0003] The invention relates to a method and an arrangement for fraud detection and prevention in a telecommunications network, especially in a mobile communications network.

[0004] Modern telecommunications networks offer a subscriber several supplementary services in directing a call. Call Forwarding (CF) is a supplementary service which permits a called subscriber to have the network route all incoming calls to a preset number. Call Transfer (CT) is another supplementary service which permits a subscriber to transfer an established incoming or outgoing call to a third party. Such supplementary services pose the threat of fraud, making use of telecommunication services without the intent to pay. Typically, a fraudulent user applies for a subscription with false identity and with no intention to pay any telephone bills. The most common types of fraud are related to the ability to sell calls, such as forwarded or transferred calls. In such cases, the fraudulent user programs the desired telephone number as the forwarded-to number for the fraudulent subscription, after which the caller pays only for a local call, for example. Without good control large unpaid bills could be produced by calling expensive destinations such as Premium Rate or international numbers. It is very much in the interests of the network operators to detect the misuse and stop it at the earliest possible opportunity.

[0005] FIG. 1 of the attached drawing shows a simplified block diagram of the GSM mobile communications system. The mobile station MS is connected via a radio path to a base transceiver station BTS, in FIG. 1, to the base station BTS1. A base station sub-system BSS consists of a base station controller BSC and the base stations BTS controlled by it. A mobile services switching center MSC usually controls several base station controllers BSC and is connected to other mobile services switching centers and a GMSC (Gateway Mobile Services Switching Center). Via the GMSC the GSM network is connected to other networks, such as the PSTN (Public Service Telephone Network), another mobile communication network PLMN, the ISDN network, the intelligent network IN, or the short message service center SMSC. The operation of the entire GSM system is monitored by the operation and maintenance center OMC. Subscriber data of the mobile station MS is stored permanently in the Home Location Register HLR and temporarily in the Visitor Location Register VLR of the area in which the mobile station MS is currently located. Subscriber data contains information on all the services the subscriber is entitled to and the subscriber's present location. The information as to the location of the mobile station MS is stored in the visitor location register VLR with the accuracy of a Location Area LA.

[0006] In order to limit possible fraudulent use of the network, parameters limiting the use of certain services are known to be set. These limiting parameters are common for all the subscribers. Typically, the parameters are activated for all the subscribers communicating through one network element, such as the switching center, or for none. One solution for preventing fraudulent call transfers in a radio telecommunications network is described in patent application WO 97/47152. The method in the publication restricts or disables the immediate call transfer feature if the number of call transfer requests exceeds a threshold number of requests within a predetermined time period. The method may also restrict or disable the call transfer feature if the transfer-to telephone number included in the call transfer request is not on a list of approved transfer-to telephone numbers.

[0007] The problem with known fraud prevention methods is that they provide only default values which are either used for each subscriber or not used. It is not possible to define parameter values on a subscriber basis. Yet the operator has varying needs to monitor the possible fraudulent use of different subscribers.

[0008] The object of this invention is to implement effective and flexible prevention of fraudulent use in a telecommunications network on a subscriber basis.

[0009] This is achieved through a method and an arrangement according to the invention characterized by what is stated in the independent claims. Special embodiments of the invention are presented in the dependent claims.

[0010] The invention is based on the idea that at least one fraud profile identified by an identifier is created and the identifier is included in the subscriber data of some subscribers. Based on this identifier the fraud restriction parameters of the subscriber are retrieved from the subscribers fraud profile, and these fraud restriction parameters are used in detecting and indicating possible fraudulent use. The fraud restriction parameters include values for different service limits, such as the maximum number of call forwarding requests and/or the maximum number of location updates during a certain period, and possibly at least for some features an action parameter related to a service limit and implemented when the service limit is reached.

[0011] The advantage of the method according to the invention is that the network operator is able to monitor and control the activities of the subscribers individually when the call is active. The system provides tools for the operator to monitor and limit the subscriber's calls, including transferred and forwarded calls.

[0012] Another advantage of the method according to the invention is that the management of the fraud restriction parameters is simple.

[0013] The advantage of the arrangement according to the invention is that the subscriber data file is increased only by the identifier of one of the fraud profiles, which are centrally stored in a storage separate from the subscriber data.

[0014] The preferred embodiments of the invention will now be described with reference to the attached drawings, in which

[0015] FIG. 1 shows the parts of the mobile communication network that are essential for the invention;

[0016] FIG. 2 shows an example structure of one fraud profile according to the invention;

[0017] FIG. 3 shows the first embodiment of the method according to the invention as a flow chart;

[0018] FIG. 4 shows an example structure of one fraud profile according to the second embodiment of the invention; and

[0019] FIG. 5 shows an arrangement according to the invention as a block diagram.

[0020] The present invention can be applied to any telecommunications network. The invention will be described below in more detail mostly by using the digital mobile communications system GSM as an example. FIG. 1 shows the simplified structure of a GSM network as described earlier. The GSM system is described in GSM specifications and the book: “The GSM System for Mobile Communications”, M. Mouly&M. Pautet, Palaiseau, France, 1992, ISBN:2-9507190-0-7, where an interested reader can find more background information.

[0021] In the following, the first embodiment of the invention is described in more detail with reference to FIGS. 2 and 3. FIG. 2 shows an example structure of one fraud profile file according to the invention. The fraud profile includes identifier 21 and one combination of fraud restriction parameters 22, such as restricting time limits for different type of calls, maximum values of service usage, and/or action parameters. The profile identifier 21 can be any index and/or name unambiguously identifying the fraud profile file. This same identifier is added to the subscriber data in the home location register HLR for those subscribers to whom this fraud profile is to be applied. Fraud restriction parameters 22 each relate to a certain service or a specific activity in the network, such as call forwarding, call transfer, mobile originated call, or location update. Fraud restriction parameters 203, 205, 207, 209, 211, and 213 can have values such as some number, between 1and 255, for example, “DEFAULT VALUE” indication, or “NO RESTRICTION” indication. “DEFAULT VALUE” label in a fraud restriction parameter indicates that network element specific default value is used for this fraud restriction parameter. The network element specific default values are applicable within one network element, such as the switching center MSC. “NO RESTRICTION” label in a fraud restriction parameter indicates that no restriction is applied for the subscriber relating to this service. In the example in FIG. 2, fraud restriction parameters 204, 206, 208, 210, 212, and 214 are action parameters which define the action to be taken when the limiting value relating to same feature, such as a service or network activity, is encountered. The action defined by the action parameter can be an alarm to the operator, a fraud report to the operator, or a fraud report to the operator and a restriction in the call handling, such as rejecting the requested service or terminating the call. The action taken when the limiting value is encountered can also be an MSC or VLR specific action according to prior art. No indication, i.e. no announcement or tone, is provided to the subscriber at the time of the encounter with the limiting value. Nevertheless, the subscriber gets a notification when the service requested is rejected.

[0022] A few examples of fraud restriction parameters are shown in FIG. 2. Fraud restriction parameters MAX_CF 203 and action_CF 204 relate to call forwarding. The limiting value MAX_CF is the maximum number of call forwarding requests allowed during an observation time. During a call, the unit responsible for call handling, such as an MSC, monitors the number of call forwarding requests and compares this number to the value of MAX_CF. The monitoring is implemented as in prior art. When the number of call forwarding requests exceeds the limiting value MAX_CF 203, an action is taken according to the action parameter action_CF 204. Correspondingly, MAX_CT 205 and action_CT 206 relate to call transfer, and MAX_LOC 207 and action_LOC 208 relate to location updates. The location update restriction detects and indicates an unexceptionally high activity of location updating between switching centers, for example. The fraud profile can also include fraud restriction parameters relating to specific activity in the network other than those described above, such as maximum number of mobile originated calls in a certain direction. The number of each of these activities made by a suspected fraudulent user is limited according to the corresponding limiting value whereby when the limiting value has been encountered, the action defined by the action parameter is performed.

[0023] Fraud restriction parameters according to the invention can also be set to limit the duration of some kinds of calls. Fraud restriction parameters TIME_MO 209 and action_T_MO 210 in FIG. 2 relate to mobile originating calls. The operator can set in a fraud profile a time limit value and an action parameter for mobile originated calls in general or in a specified direction, such as international calls. Correspondingly, TIME_CF 211 and action_T_CF 212 relate to the time limit for forwarded calls and TIME_CT 213 and action_T_CT 214 relate to the time limits for transferred calls. If there are several time limits for one call, e.g. when the service control point SCP limits the duration, the subscriber specific time limit is given by the fraud profile, and when a network element specific time limit exists, the shortest time limit can be chosen. In addition to the call type, the call direction can be used as a base for restricting the duration of the calls. Examples of call direction division are division by country codes, zones, routing directions, and/or division into national and international calls.

[0024] To sum up, the example in FIG. 2 requires at least the following fields to be included in the fraud profile according to the invention:

[0025] index of the fraud profile and/or—name of the fraud profile

[0026] maximum number of CF registration (limiting value/no restriction/default value)

[0027] maximum number of CT invocation (limiting value/no restriction/default value)

[0028] maximum number of location updates (limiting value/no restriction/default value)

[0029] time limit for MO calls in general and/or in a certain direction (limiting value/no restriction/default value)

[0030] time limit for CF calls (limiting value/no restriction/default value)

[0031] time limit for CT calls (limiting value/no restriction/default value).

[0032] The possible content of the parameters are shown in parentheses after each parameter. In addition to the parameters listed above, the fields for the action parameters of at least some of the features can be included in the fraud profile.

[0033] FIG. 3 shows the first embodiment of the invention as a flow chart. At stage 32, at least one fraud profile file according to the invention is created. Each fraud profile is identified with an identifier. This identifier of the relevant fraud profile is set for those subscribers for whom the fraud profile in question is intended to be used in order to prevent suspected fraudulent use (stage 33). Stages 32 and 33 need to be performed at least once before the method according to the invention is implemented, but not each time the method is utilized. The parameter values set in the fraud profile of the subscriber are monitored at stage 34 according to prior art. At stage 35, it is checked whether any of the limiting parameter values are encountered. If not, the monitoring is continued at stage 34. If some limiting value is encountered, an action according to the action parameter of the fraud profile in question is carried out (stage 36). Possible actions are an alarm to the operator, a fraud report to the operator, or a fraud report to the operator and a restriction in the call handling, such as rejecting the requested service or terminating the call, as described above in the description of FIG. 2. Depending on the action parameter, the fraud detection process can be started from the beginning again, with the possible omission of stages 32 and 33.

[0034] In the second embodiment of the invention, a black list is created and incorporated in the fraud restriction procedure. The black list includes all the numbers to which call transfer is not permitted. Examples of such numbers are Premium rate and operator service numbers. The network operator can define the telephone numbers or telephone number ranges, such as all the Voice Mail numbers under the same MSC, to which calls cannot be transferred. The black list can just as well be a list of all the numbers to which call transfer is permitted. The list is preferably stored in the MSC. The second embodiment enables the operator to reject call transfers to certain suspected telephone numbers.

[0035] FIG. 4 shows an example structure of one fraud profile file according to the second embodiment of the invention. The fraud restriction parameter BL 45 can have the status “on” or “off”. With this parameter the operator can set the black list restriction to “on” or “off” for a subscriber. All the Call Transfers are checked against the black list when the restriction status of the black list is “on” for a subscriber. When subscriber A is calling subscriber B and subscriber B transfers the call to subscriber C, the number checking against the black list is done for number C. Both numbers B and C are checked against the black list when subscriber A first calls subscriber B and sets subscriber B on hold while calling subscriber C and finally transfers the call with subscriber C to subscriber B. The telephone number from the Private Numbering Plan (PNP) is first converted into the actual number of the normal numbering plan before comparison with the black list. The same applies to other short numbers and area depended numbers. When analysis for the checked number matches the number on the black list, call transfer is rejected or the call is terminated according to the action parameter 46 or the network element specific action. According to prior art, the subscriber gets notification when the call transfer attempt fails. In addition to the action described above, the operator may get a fraud report about the call transfer attempts to the black list numbers. This function is available only for subscribers within the home network.

[0036] In another embodiment of the invention, the black list includes some special numbers a transfer to which cause the action according to the action parameter 46 or the network element specific action to be carried out. The action can be any action described above in connection with different embodiments of the invention. Therefore, the call is not necessarily released when call transfer to a number in the black list takes place.

[0037] In the third embodiment of the invention, a fraud restriction parameter is included in the fraud profile to restrict the number of parallel call transfers or forwardings of a subscriber. The monitoring is preferably carried out in the switching center MSC with the aid of counters counting the number of parallel call transfers or forwardings each time. When the number of parallel call transfers or forwardings of a subscriber exceeds the maximum value of parallel call transfers or forwardings, an action according to the action parameter relating to this feature is performed or alternatively a network element specific action is taken.

[0038] The fraud profile files according to the invention are preferably stored in a new file in the home location register HLR or some other database. An operator can create different kinds of fraud profiles to suit the need to supervise the activities of different subscribers. Useless fraud profiles can be deleted. The fraud profile files can preferably not be modified, so that only the fraud profile identifier stored in the individual subscriber data can be changed to refer to another fraud profile. When the subscriber is roaming within the network, the fraud profile of the subscriber is transferred via the MAP interface to the visited location register VLR to be stored as limiting values and possibly action parameters in association with the subscriber data copied from the HLR. The fraud profile procedure according to the invention allows the operator to classify the subscribers into one fraud classification according to the fraud profile set for the subscriber.

[0039] Emergency calls are normally not limited. Therefore, the operator defines the type of calls for which the fraud restriction parameters in the fraud profiles are applicable.

[0040] FIG. 5 shows an example structure of the arrangement according to the invention. The arrangement includes subscriber data 51 according to prior art. According to the invention the arrangement includes a storage 52 including fraud profile files, retrieving means 53 for associating a subscriber with the correct fraud profile, monitoring means 54 for monitoring the subscriber's communication on the basis of the fraud profile according to the invention, and indicative means 55 for indicating an encounter with a fraud restriction parameter in the subscribers fraud profile. The retrieving means 53 associates the subscriber with the correct fraud restriction parameters based on an identifier stored in the subscriber data. The output of the indicative means 55 can be provided to the operator of the network. The storage 52 is preferably located in the home location register HLR or some other database containing the subscriber data 51. The retrieving means 53, the monitoring means 54, and the indicative means 55 can be located in association with the switching center MSC as shown in FIG. 5.

[0041] The drawings and the related description are only intended to demonstrate the principles of the invention. The details of the method according to the invention can vary within the patent claims. Although the invention is described above mainly in terms of GSM network, it may also be used with other telecommunications networks, such as Wireless Local Area Network WLAN. The invention is also applicable to data calls. As described above, each subscriber data file preferably includes reference to whether a fraud profile is used for the subscriber or not, but the invention can also be implemented only partially. For example, fraud prevention can be carried out according to prior art using network element specific default values when the subscriber data does not include a fraud profile identifier, or the limitation can be implemented on a subscriber basis according to the invention for home subscribers and based on common default values for roamers. Also fraud restriction parameters other than those described above can be included in a fraud profile according to the invention.