UC SIM Box Detection1

Keynote SIGOS GmbH

Klingenhofstrasse 50d

90411 Nuremberg

Germany

www.keynote-sigos.com

SIM Box Detection

A Best-in-Best Active SIM Box Detection Solution

Name

Date

Testing is our Competence © 2014 Keynote SIGOS GmbH

2

The Impact of SIM Boxes on your Network

Our Full Service SIM Box Detection Solution

Testing Scenarios

Advanced SIM Box Detection

The SIM Box Threat

The Next Step: Terminator

Other Interconnect Fraud Solutions

Agenda


3

SIM Box operators (fraudsters) exploit the price difference between termination rate and cheapest on-net rate:

SIM Box intercepts call and sets up a new on-net call

CLI becomes CLI of SIM Box SIM Card

Carrier 1 Carrier 2

The SIM Box Scenario

Fraudster

The mobile operator suffers a direct revenue loss of 0,08 EUR/minute

SIM Box

@ 0,11 € 0,04 €

0,12 €

Your network

0,14 € 0,13 €


4

Financial Impact of SIM Boxes

Interconnect revenue losses (example):

Cost of sales for SIM Cards generating financial losses:

Other Costs involved:

Unnecessary investments in radio network e.g. antenna upgrade +50.000 EUR

Indirect revenue losses due to quality issues

Incoming international minutes per day 1.000.000

Percentage SIM Box bypass 10 %

SIM Box minutes per day 100.000

Net loss per minute 0,08 EUR

Net loss per month 240.000 EUR

Fabrication cost 1 SIM 1 EUR

Provisioning, distribution, ... 1 EUR

Average # SIMs used per month 10.000

Net loss per month 20.000 EUR


5

Impact on Quality of Service

Inbound roamers not reachable

Congestion

Incorrect statistics on international traffic

False Answer

Call setup time

Voice Quality

Call success rate

Pick-ups and call back

NO Voicemail retrieval

Interconnect

Overall decrease in customer satisfaction

Your network Other Quality Problems to impact revenue

No or wrong CLI decreasing voice revenue

Bad Call Quality

SIM Box


6

SIM Box Promotion Example

Promoting unlimited usage

Free calls

International calls at local rate

Using advertisement via

Facebook, flyer etc.

Examples of previously, international available advertisement


7



Testing Scenarios


The SIM Box Threat



Agenda


8

Fully Managed Service & Central Fraud Detection Platform

Unique Detection Methodology & Service

International calls to your network

From the largest amount of routes

To existing infrastructure equipped with your (CLIR Override) SIM Cards

Automated result processing

Analyzing every outgoing test call, any incoming CLI and received test traffic

Determining bypass based on customer’s numbering plan

Determining quality problems and other interconnect and fraud information

Normal Transit

SIM Box

Your network


9

Customized Flexible Testing

Unique Scan & Shoot methodology: Testing via the largest variety of routes

VoIP, Carriers, Calling Cards, Mobile and Fixed coverage

Your test calls are used in the most efficient way possible

Scan & analysis of traffic routes

Increase of extra SIM Box Detection tests on bypass-affected routes

Your interconnect and fraud consultant follows the results on a continuous basis

Ensuring highest possible detection rate

Continuous Scanning of Routes

Shoot Bypass Route Shoot Bypass Route Shoot Bypass Route


10

Unparalleled Global Coverage

Individual routes subject to outages and linked to roadmap. Numbers stated are subject to changes.

8 Carrier Platforms 750+ Mobile Networks 200+ SIM Pool SIMs 100+ Fixed Line 200+ Calling Cards 50+ VoIP Accounts


11

Our Carrier Platforms

Connection to 8 international Carrier Platforms providing access to both Top carrier routes Focus on grey routing

Our team of fraud experts screen on a daily basis Carrier exchanges Internet blogs to identify possible grey routing

Prefixes

Probe at B-side

Carrier Platforms

Carrier Switch

Your network

Central Fraud Detection Platform

Local Unit at A-side

Local Unit at B-side

PRI/SIP

91

92

93

94

N

Carrier

Carrier Small

Carrier


12

Specialized technology to avoid detection by Fraudsters, Continuous investments in new countermeasures:

A-Number rotation B-Number rotation and virtual number management Answer to Seizure Ratio countermeasures SIM Box Gun Human behaviour calling

Countermeasures to Conceal Tests

@

Call Generating for Fraud Detection

+32456789563 +32564978567 +32458798422

…… +32456848128

CLIRO SIM

LU with Customer SIMs Customer Switch

+500 MSISDN = “virtual numbers”


13

Your single point of contact: Interconnect and Fraud consultant

Your partner, speaking your language for: Specific questions Tailor-made analysis Fraud Detection expertise

Regular Reporting: Available in English French and Spanish

World Class Service Delivery


14

Advanced Reporting Tools

Monthly report and conference call

Your dedicated interconnect and fraud consultant is taking you through the results in scheduled briefings

End of Year reporting with year to date evolutions

Optional – tailored to your needs

Instant Alarming with detected SIM Boxes

Instant alarms via e-mail or FTP

Near Real-time Notifications with detected SIM Boxes

Every 5-15 minutes via e-mail or FTP

Online Portal

Real-time reporting on Mobile and PC devices

Automated Email Reports with graphs and tables

Daily, Weekly and Monthly

Interconnect QoS and False Answer Supervison


15

Automated E-mail Reports

Daily Report

Conclusive content with charts

and tables including:

Previous Day Overview

Top 10 Bypass Routes

Lifespan and Hits per every unique SIM Box detected


16

Automated E-mail Reports

Weekly/Monthly Reports

Period Overview Daily Bypass Trend

Test Validity Daily Trend

Hits vs Unique Daily Trends

Top 15 Bypass Routes

Hourly Bypass Trend

Lifespan and Hits per every unique SIM Box detected


17

Real-time Reporting via Online Portal

Customer Reports Accessible from Web

Dedicated Customer login

24/7/365 access to all tests, data and KPIs

Real-time charts and graphs on used calling-routes, bypass information and other relevant information Current day results


18

Best-in-Best SIM Box Detection

Features Meucci SIGOS SIGOS-Meucci Best-in-Best

Best competitor

Hardware & Technology + +++ +++ ++

Carrier routes +++ + +++ +

Calling cards ++ + +++ ++

VoIP accounts ++ + +++ ++

Mobile coverage (Roaming) - +++ +++ +

Mobile coverage (SIM Pool) +++ - +++ +

Fixed lines & Carrier Select ++ + +++ +

Online Portal + +++ +++ ++

Fast Notifications/Alarms ++ +++ +++ ++

Countermeasures ++ + +++ +

False Positive Detection ++ ++ +++ +

Service & Consultancy Levels +++ + +++ ++

Much more features benefit from Best-in-Best integration: scheduling efficiency and performance, monthly report accuracy, supported languages...


19

Summary

Advanced Technology: Full Global Coverage

Including VoIP, Fixed Line, Mobile, Calling Cards, Carriers, etc.

Fastest SIM Box Detection

Patented and the markets leading solution - fastest and most reliable detection

100% SIM Box Assurance Patented technology & method with advanced false positive avoidance

Solution Roadmap and Track Record Global range of customers and continuous technology development along all areas of Fraud Detection

Advanced Service Delivery: Tailored Reporting

Automated e-mail reporting and Fraud Detection conference calls

Specialized Consultants

Single point of contact to your specialized fraud and interconnect consultant – speaking your language

24/7/365 Real-time Portal Access All data accessible at any time including KPIs, test call information, used technology etc.

Experts in Fraud Detection Market leading since over 10 years serving customers worldwide


20



Testing Scenarios


The SIM Box Threat



Agenda


21

SIM Box operators (fraudsters) exploit the price difference between termination rate and cheapest on-net rate:

SIM Box intercepts call and sets up a new on-net call

CLI becomes CLI of SIM Box SIM Card

Carrier 1 Carrier 2

On-Net SIM Box

Fraudster

The mobile operator suffers a direct revenue loss of 0,08 EUR/minute

SIM Box

@ 0,11 € 0,04 €

0,12 €

Your network

0,14 € 0,13 €


22

SIM Box makes a call from your network to a competitor’s network

Net loss for each call transiting through your network

The terminating network

Has interconnect revenue losses if national and international termination rate are

different

Experiences quality issues

Off-Net SIM Box

SIM Box Fraudster SIM Box

Carrier 2

Carrier

@ 0,11 € 0,10 €

0,12 €

0,08 €

Competitor network

Your network

0,14 €


23

Test Call Detection Off-Net

Test calls to SIM Cards of the other networks

If SIM Box in the path: the SIM Box CLI will be present

SIM Cards of the other networks are forwarded to your network

CLI Restriction Override SIM shows CLI

CLI analysis reveals bypass type

Managed Service & Central Platform

Fraudster

Normal Transit

SIM Box

Your network

Competitor SIM with Call Forward


24

Carrier

Other Operator SIM Box and Leaky PBX

Fraudster uses SIMs or PBX from a competitor’s network to terminate calls

towards your network

Interconnect revenue loss if international and national termination rates are different

Important quality issues

Impacting customer satisfaction and revenue

Competitor network

SIM Box

0,14 €

SIM Box or Leaky PBX

Carrier 2

@ 0,11 € 0,10 €

0,12 €

0,08 €

Your network

Fraudster

Interconnect


25

Carrier

International termination rate larger national termination

Competing network (fixed or mobile) receives international call

Competing network terminates on your network through local trunk

Refiling

Competitor network

Carrier 2

0,07 €

0,09 €

0,08 €

Your network Normal routing

International Termination

National Termination

Bypass Transit through other domestic operator


26



Testing Scenarios


The SIM Box Threat



Agenda


27

Essential cooperation between the customer and Keynote SIGOS:

To ensure fast deactivation

To reduce the bypass problem fast and efficiently!

Example: The credit of a prepaid SIM Card of 5 EUR is used in less than 30 minutes, deactivation after 30 minutes is profitable for fraudster

Fast Deactivation – Crucial for fast results!

Our Solutions’ experts help you solve the bypass problem fast and efficiently


28

SIM Box Detection as an Insurance

Example data from a customer: SIM Boxes will return if not monitored!


29

Underlying Technology

Ghent & Nuremberg Service Delivery Teams

SIM Multiplexer Central Unit

Customer Web access Local Unit Local Unit

Local Unit (LU)

Virtual SIM Card Transfer

LAN / WAN


30

Our Technology – 10 Years Expertise

Most experienced SIM Box Detection company on the market Market leader in Fraud Detection, QoS and Roaming

Customer base of over 410 Network Operators worldwide, 150 within SBD

Experience in detection of SIM Boxes worldwide is used to

Improve internal systems

Improve countermeasures

Coach Interconnect & Fraud Consultants

Leading expertise within GSMA and other standardisation bodies Editor of 6 interworking documents of which:

Editor of IN.02 describing the use of SIM Boxes

Editor of IN.18 defining Interconnect KPIs and including our definitions for e.g. False Answer, Early Answer, Late Disconnect

Internationally certified and patented technology


31

Your Partner in Legal Support

Creating CDRs

SIM Box Gun feature allows creation of CDRs for calls terminated via a SIM Box

Providing additional evidence in legal cases

Certified Solutions Methodology

Certified via external audit of IBBT

We can provide upon request

Additional consultancy in legal cases

Full support in court

CDR record of test calls


32

Fraudsters use their own “FMS” to avoid detection:

CDR pattern detection to flag test calls

Blacklisting A- or B-Numbers

In case of detection the test calls are blocked or re-routed

Solution Countermeasures:

Human behaviour calling features

Virtual numbering

Other methodes to prevent detection of the test calls by SIM Box operators

The Need for Countermeasures


33

B-Number Rotation

Test calls are set-up towards multiple MSISDN (“virtual numbers”)

Calls terminate on CLIRO SIMs in destination probe (“main numbers”)

Flexibility with virtual numbers

Do not need to be CLIRO

Do not need to exist physically, can be created in the HLR

+500 MSISDN = “virtual numbers”

@

Call Generating Platform

+32456789563 +32564978567 +32458798422

…… +32456848128 CLIRO SIM

(1 MSISDN = “main number”)

LU with Customer SIMs Customer Switch


34

False positive

External Party calls “by mistake” test number at the B-side

Timestamps of A-side do not match timestamps on B-side

False positive checks on

Timestamps

Error codes

Customized rules

DTMF

Other

False Positive Avoidance

Central Platform

False positive!

Dial 12:15:26

Ring 12:15:28 Dial

12:15:30

Busy / Ring

A-side Originating

B-side Terminating

Third Party


35

DTMF to avoid False Positives

Implementation of DTMF as additional False Positive Avoidance tool

SIM Box Gun picks up if CLI matches customer’s numbering plan

DTMF is transmitted between A and B

If DTMF received correctly: 100% sure – no interfering call!

Central Platform

SIM Box!!!

Ring

A-side Originating

B-side Terminating

SIM Box!?

Send DTMF

DTMF

Ring Dial

Connect

Connect

DTMF


36



Testing Scenarios


The SIM Box Threat



Agenda


37

Easy selling of SIM Boxes to the market

Trading websites like RouteTrader

Forums like VoipTermination.com

Catchy business cases

Instant returns

Low price equipment

Second hand available on eBay

Low price internet connection

“The easy way to become a SIM Boxer”

Examples of internet blogs and trades


38

Trading Sites and Blogs used by SIM Boxers

Specialized Trading Sites & Carrier Exchanges Web Forum / Blogs

Examples: RouteTrade New York Telecom Exchange Minutetrades

Examples: Voiptermination.com Calltermination.com DirectInterconnect.com


39

Fraud Tips found on the Internet...

Screenshot taken from Internet Forum 2012


40

Specialized Equipment used by SIM Boxers

SIM Box equipment and specialized bypass solutions examples

2N

Portech

VoIPDango

Teles

Quescom

Demanding advanced SIM Box countermeasures


41



Testing Scenarios


The SIM Box Threat



Agenda


42

Best Practice in SIM Box Fight

Resources, Teams, Skills, Training, …

Test Call Solution Fast 100% sure Proof Off-Net

CDR Database All customers All calls

Operator Practices User identification Sales channels Internal Fraud …


43

STEP 1

Active SIM Box Detection

Super fast SIM Box Detection

100% sure SIM Boxes

STEP 2

Profiling of SIM Boxes

and creation of detection rules

STEP 3

Fastest and most efficient

extrapolation with combined methodes

Upcoming: Bypass Terminator

PR

OFILIN

G

1+1 = 3

SIM Box


44

Proven Evidence

Automated SIM Box Deactivation

Integrated Bypass Detection - Outlook SB

D P

latf

orm

Tes

t C

all G

ener

atio

n

CD

Rs

and

oth

er D

ata

SIM Box Terminator

Data Extrapolation

Rules

Fraud Detection Operator Investigations SIM Deactivation

Network Operator Fraud Team

Alerts to investigate Deactivation

Proven Evidence


Customized Flex Testing

Mimic Subscriber Testing

Test Capacity Booster

Proven Evidence



45



Testing Scenarios


The SIM Box Threat



Agenda


46

Other SIGOS Fraud Solutions

Get in touch with us for more information on other Fraud Solutions

Interconnect Assurance Beyond SIM Boxes: refiling, leaky PBX, ghost trunks, internal fraud...

SMS Fraud Detecting abnormal SMSc termination

Consultancy & Training Services From the worlds’ best experts in Interconnect Fraud


47

Bellevue 5/601 (UCO Tower) 9050 Ghent

Belgium Tel : +32 9 239 02 11

Documents

UC SIM Box Detection1