[VoiceOps] Fraud

[Alex Balashov]

I've said it before and I'll say it again:

We stopped 95-98% of the losses on this sort of thing for a large 
customer who was losing thousands of dollars per day on it, by 
implementing the following approach:

Every trunk group gets a 'high-cost channel limit', which is the X 
number of simultaneous calls that they are allowed to make to 
destinations that cost over $Y/min. The limit was typically something 
like $0.10, so as to exclude domestic US traffic, but certainly catch 
Somalia and Globalstar. Both X and Y are configurable on a per-trunk 
group basis, so customers who have a legitimate need for 50 concurrent 
calls to Dakar can do that. For most typical domestic users, the limit 
was set to something like $0.10 and 2 channels.

When this limit was tripped, typically due to a compromised PBX with 
some extension password of 1234, the following things happen:

(1) All existing calls are terminated;

(2) An alert e-mail is sent out to the customer and to the NOC;

(3) Customer is downgraded to a termination rate plan that only allows 
for domestic calling. That way, they're not totally cut off from calling 
and, in all but the most unusual scenarios, not exceptionally angry. 
There is no reason to cut them off entirely. That's a false dichotomy. 
Downgrade them to a restricted calling plan.

The thinking was that (a) there's only so much exposure that two 
simultaneous calls to rural Chad can create; (2) almost any typical 
attack pattern relies on lighting up as many calls as possible in the 
shortest period of time, since they know they'll get cut off soon. So, 
almost any exploit is going to trip the wire, and do so quickly.

These assumptions proved correct, and the losses virtually disappeared.

Today, this fraud protection feature is integrated into the trunking 
platform that we sell. In our experience, it works very well.

-- 
Alex Balashov - Principal
Evariste Systems LLC
235 E Ponce de Leon Ave
Suite 106
Decatur, GA 30030
United States
Tel: +1-678-954-0670
Web: http://www.evaristesys.com/, http://www.alexbalashov.com/