UC SIM Box Detection1

SIM Box Detection
A Best-in-Best Active SIM Box Detection Solution
Name
Date
Keynote SIGOS GmbH

Klingenhofstrasse 50d
90411 Nuremberg
Germany
www.keynote-sigos.com
Agenda
The Impact of SIM Boxes on your Network

Our Full Service SIM Box Detection Solution
Testing Scenarios
Advanced SIM Box Detection
The SIM Box Threat
The Next Step: Terminator

Other Interconnect Fraud Solutions
Testing is our Competence
2014 Keynote SIGOS GmbH
The SIM Box Scenario

SIM Box operators (fraudsters) exploit the price difference between termination rate and
cheapest on-net rate:
Your network
0,12
Carrier 1
0,14
Carrier 2
0,13
0,11
SIM Box
Fraudster
0,04
SIM Box intercepts call and sets up a new on-net call

CLI becomes CLI of SIM Box SIM Card
The mobile operator suffers a direct revenue loss of 0,08 EUR/minute

3
Financial Impact of SIM Boxes

Interconnect revenue losses (example):
Incoming international minutes per day
1.000.000
Percentage SIM Box bypass
10 %
SIM Box minutes per day
100.000
Net loss per minute
0,08 EUR
Net loss per month
240.000 EUR
Cost of sales for SIM Cards generating financial losses:

Fabrication cost 1 SIM
1 EUR
Provisioning, distribution, ...
1 EUR
Average # SIMs used per month

Net loss per month
10.000
20.000 EUR
Other Costs involved:
Unnecessary investments in radio network e.g. antenna upgrade +50.000 EUR

Indirect revenue losses due to quality issues
Impact on Quality of Service

No or wrong CLI
decreasing voice revenue
NO
Bad Call Quality

Call setup time
Pick-ups and call back
Voice Quality
Voicemail retrieval
Call success rate
Your network
Other Quality Problems to impact revenue
Interconnect
Inbound roamers not reachable

Congestion
Incorrect statistics on international traffic
False Answer
SIM Box
Overall decrease in customer satisfaction

5
SIM Box Promotion Example
Promoting unlimited usage

Free calls
International calls at local rate
Using advertisement via
Facebook, flyer etc.
Examples of previously, international available advertisement
Agenda

Testing Scenarios
The SIM Box Threat

Unique Detection Methodology & Service

Your network
Normal Transit
SIM Box
Fully Managed Service & Central Fraud Detection Platform
International calls to your network
From the largest amount of routes

To existing infrastructure equipped with your (CLIR Override) SIM Cards
Automated result processing
Analyzing every outgoing test call, any incoming CLI and received test traffic
Determining bypass based on customers numbering plan

Determining quality problems and other interconnect and fraud information
Customized Flexible Testing

Unique Scan & Shoot methodology: Testing via the largest variety of routes
VoIP, Carriers, Calling Cards, Mobile and Fixed coverage

Your test calls are used in the most efficient way possible
Scan & analysis of traffic routes

Increase of extra SIM Box Detection tests on bypass-affected routes
Continuous Scanning of Routes
Shoot Bypass Route
Shoot Bypass Route
Shoot Bypass Route
Your interconnect and fraud consultant follows the results on a continuous basis
Ensuring highest possible detection rate
Unparalleled Global Coverage
8 Carrier Platforms
750+ Mobile Networks
200+ SIM Pool SIMs
100+ Fixed Line
200+ Calling Cards
50+ VoIP Accounts
Individual routes subject to outages and linked to roadmap. Numbers stated are subject to changes.
10
Our Carrier Platforms

Local Unit at A-side
91
Carrier
92
Your network
Small
Carrier
93
PRI/SIP
Carrier
Switch
Carrier Platforms
94
Carrier
Probe at
B-side
Local Unit
at B-side
Prefixes
Central Fraud Detection Platform
Connection to 8 international Carrier Platforms providing access to both
Top carrier routes

Focus on grey routing
Our team of fraud experts screen on a daily basis
Carrier exchanges
Internet blogs to identify possible grey routing
11
Countermeasures to Conceal Tests

Specialized technology to avoid detection by Fraudsters,
Continuous investments in new countermeasures:
A-Number rotation
B-Number rotation and virtual number management
Answer to Seizure Ratio countermeasures
SIM Box Gun
Human behaviour calling
Call Generating for Fraud Detection
Customer Switch
LU with Customer SIMs
+32456789563
+32564978567
+32458798422
+32456848128
CLIRO SIM
+500 MSISDN = virtual numbers
12
World Class Service Delivery
Your single point of contact:

Interconnect and Fraud consultant
Your partner, speaking your language for:

Specific questions
Tailor-made analysis
Fraud Detection expertise
Regular Reporting:
Available in English
French and
Spanish
13
Advanced Reporting Tools

Monthly report and conference call
Your dedicated interconnect and fraud consultant

is taking you through the results in scheduled briefings
End of Year reporting with year to date evolutions
Optional tailored to your needs
Instant Alarming with detected SIM Boxes
Near Real-time Notifications with detected SIM Boxes
Real-time reporting on Mobile and PC devices
Automated Email Reports with graphs and tables
Every 5-15 minutes via e-mail or FTP
Online Portal
Instant alarms via e-mail or FTP
Daily, Weekly and Monthly
Interconnect QoS and False Answer Supervison
14
Automated E-mail Reports

Daily Report
Conclusive content with charts

and tables including:
Previous Day Overview
Top 10 Bypass Routes
Lifespan and Hits per every

unique SIM Box detected
15
Automated E-mail Reports

Weekly/Monthly Reports
Daily Bypass Trend
Period Overview
Hits vs Unique Daily Trends
Test Validity Daily Trend
Lifespan and Hits per every unique SIM Box detected
Hourly Bypass Trend
Top 15 Bypass Routes
16
Real-time Reporting via Online Portal

Customer Reports Accessible from Web
Dedicated Customer login

24/7/365 access to all tests, data and KPIs
Real-time charts and graphs on used calling-routes, bypass information
and other relevant information
Current day results

17
Best-in-Best SIM Box Detection

Features
Meucci
SIGOS
+++
+++
++
Carrier routes
+++
+++
Calling cards
++
+++
++
VoIP accounts
++
+++
++
Mobile coverage (Roaming)
+++
+++
Mobile coverage (SIM Pool)
+++
+++
Fixed lines & Carrier Select
++
+++
Online Portal
+++
+++
++
Fast Notifications/Alarms
++
+++
+++
++
Countermeasures
++
+++
False Positive Detection
++
++
+++
Service & Consultancy Levels
+++
+++
++
Hardware & Technology
SIGOS-Meucci Best competitor

Best-in-Best
Much more features benefit from Best-in-Best integration: scheduling efficiency and performance, monthly report accuracy, supported languages...
18
Summary
Advanced Technology:
Advanced Service Delivery:
Full Global Coverage
Tailored Reporting
Including VoIP, Fixed Line, Mobile, Calling Cards,

Carriers, etc.
Fastest SIM Box Detection

Patented and the markets leading solution fastest and most reliable detection
100% SIM Box Assurance

Patented technology & method with advanced false
positive avoidance
Solution Roadmap and Track Record

Global range of customers and continuous
technology development along all areas of Fraud
Detection
Automated e-mail reporting and Fraud Detection

conference calls
Specialized Consultants
Single point of contact to your specialized fraud and
interconnect consultant speaking your language
24/7/365 Real-time Portal Access

All data accessible at any time including KPIs, test call
information, used technology etc.
Experts in Fraud Detection

Market leading since over 10 years serving customers
worldwide
19
Agenda

Testing Scenarios
The SIM Box Threat

20
On-Net SIM Box

SIM Box operators (fraudsters) exploit the price difference between termination rate and
cheapest on-net rate:
Your network
0,12
Carrier 1
0,14
Carrier 2
0,13
0,11
SIM Box
Fraudster
0,04
SIM Box intercepts call and sets up a new on-net call

CLI becomes CLI of SIM Box SIM Card
The mobile operator suffers a direct revenue loss of 0,08 EUR/minute

21
Off-Net SIM Box
SIM Box makes a call from your network to a competitors network
Net loss for each call transiting through your network

Competitor network
0,12
Carrier
0,14
Carrier
2
Your network
0,11
0,08
0,10
SIM Box
SIM Box
Fraudster
The terminating network
Has interconnect revenue losses if national and international termination rate are
different
Experiences quality issues

22
Test Call Detection Off-Net

Your network
Normal Transit
SIM Box
Fraudster
Competitor SIM
with Call Forward
Managed Service & Central Platform
Test calls to SIM Cards of the other networks
If SIM Box in the path: the SIM Box CLI will be present
SIM Cards of the other networks are forwarded to your network
CLI Restriction Override SIM shows CLI

CLI analysis reveals bypass type
23
Other Operator SIM Box and Leaky PBX
Fraudster uses SIMs or PBX from a competitors network to terminate calls

towards your network
Your network
Interconnect
Carrier
0,14
Carrier
2
0,12
Competitor network
0,11
0,08
0,10
SIM Box or Leaky PBX

SIM Box
Fraudster
Interconnect revenue loss if international and national termination rates are different
Important quality issues
Impacting customer satisfaction and revenue

24
Refiling
International termination rate larger national termination
Competing network (fixed or mobile) receives international call
Competing network terminates on your network through local trunk

International
Termination
Normal routing
Carrier
Your network
0,09
Carrier
2
Competitor network
0,08
National
Termination
0,07
Bypass Transit through

other domestic operator
25
Agenda

Testing Scenarios
The SIM Box Threat

26
Fast Deactivation Crucial for fast results!

Essential cooperation between the customer and Keynote SIGOS:
To ensure fast deactivation

To reduce the bypass problem fast
and efficiently!
Example:
The credit of a prepaid SIM Card
of 5 EUR is used in less than 30
minutes,
deactivation after 30 minutes is
profitable for fraudster
Our Solutions experts help you solve the bypass problem fast and efficiently
27
SIM Box Detection as an Insurance

Example data from a customer: SIM Boxes will return if not monitored!
28
Underlying Technology
SIM Multiplexer
Ghent & Nuremberg

Service Delivery Teams
Central Unit
Virtual SIM
Card Transfer
Local Unit (LU)
LAN / WAN
Local Unit
Customer Web access

Local Unit
29
Our Technology 10 Years Expertise

Most experienced SIM Box Detection company on the market
Market leader in Fraud Detection, QoS and Roaming

Customer base of over 410 Network Operators worldwide, 150 within SBD
Experience in detection of SIM Boxes worldwide is used to
Improve internal systems
Improve countermeasures
Coach Interconnect & Fraud Consultants
Leading expertise within GSMA and other standardisation bodies
Editor of 6 interworking documents of which:

Editor of IN.02 describing the use of SIM Boxes
Editor of IN.18 defining Interconnect KPIs and including
our definitions for e.g. False Answer, Early Answer, Late Disconnect
Internationally certified and patented technology
30
Your Partner in Legal Support

Creating CDRs
SIM Box Gun feature allows creation of CDRs for calls terminated via a SIM Box
Providing additional evidence in legal cases
Certified Solutions Methodology
Certified via external audit of IBBT
We can provide upon request
Additional consultancy in legal cases
Full support in court
CDR record of test calls
31
The Need for Countermeasures

Fraudsters use their own FMS to
avoid detection:
CDR pattern detection to flag test calls

Blacklisting A- or B-Numbers
In case of detection the test calls are blocked
or re-routed
Solution Countermeasures:
Human behaviour calling features

Virtual numbering
Other methodes to prevent detection of the
test calls by SIM Box operators
32
B-Number Rotation
Call Generating Platform
Customer Switch
LU with Customer SIMs
+32456789563
+32564978567
+32458798422
+32456848128
CLIRO SIM
(1 MSISDN = main number)
+500 MSISDN = virtual numbers
Test calls are set-up towards multiple MSISDN (virtual numbers)
Calls terminate on CLIRO SIMs in destination probe (main numbers)
Flexibility with virtual numbers
Do not need to be CLIRO

Do not need to exist physically, can be created in the HLR
33
False Positive Avoidance

False positive
External Party calls by mistake test number at the B-side

Timestamps of A-side do not match timestamps on B-side
False positive checks on
Timestamps
Error codes
Customized rules
DTMF
Other
Third Party
A-side
Originating
Dial
12:15:26
B-side
Terminating
Ring
12:15:28
Dial
12:15:30
Busy / Ring
False positive!
Central Platform
34
DTMF to avoid False Positives

Implementation of DTMF as additional False Positive Avoidance tool
SIM Box Gun picks up if CLI matches customers numbering plan

DTMF is transmitted between A and B
If DTMF received correctly: 100% sure no interfering call!
A-side
Originating
B-side
Terminating
Dial
Ring
SIM Box!?
Ring
Connect
Connect
Send DTMF
DTMF
DTMF
SIM Box!!!
Central Platform
35
Agenda

Testing Scenarios
The SIM Box Threat

36
The easy way to become a SIM Boxer

Easy selling of SIM Boxes to the market
Trading websites like RouteTrader
Forums like VoipTermination.com
Catchy business cases
Instant returns
Low price equipment
Second hand available on eBay
Low price internet connection
Examples of internet blogs and trades
37
Trading Sites and Blogs used by SIM Boxers

Web Forum / Blogs
Specialized Trading Sites & Carrier Exchanges
Examples:
Examples:
RouteTrade
New York Telecom Exchange
Minutetrades
Voiptermination.com
Calltermination.com
DirectInterconnect.com
38
Fraud Tips found on the Internet...
Screenshot taken from Internet Forum 2012
39
Specialized Equipment used by SIM Boxers

SIM Box equipment and specialized bypass solutions examples
2N
Portech
VoIPDango
Teles
Quescom
Demanding
advanced SIM Box
countermeasures
40
Agenda

Testing Scenarios
The SIM Box Threat

41
Best Practice in SIM Box Fight
CDR Database
Test Call Solution
Fast
100% sure
Proof
Off-Net
Operator Practices
All customers
All calls
User identification
Sales channels
Internal Fraud
Resources, Teams, Skills, Training,
42
Upcoming: Bypass Terminator

STEP 1
Active SIM Box Detection
Super fast SIM Box Detection
100% sure SIM Boxes
STEP 3
Fastest and most efficient
extrapolation with combined methodes
PROFILING
STEP 2
Profiling of SIM Boxes
and creation of detection rules
SIM Box
1+1 = 3
43
Integrated Bypass Detection - Outlook

Fraud Detection
SBD Platform Test

Call Generation
Customized
Flex Testing
Mimic Subscriber
Testing
Operator Investigations
SIM Deactivation
Proven Evidence
Automated SIM Box
Deactivation
Test Capacity
Booster
Proven Evidence
Data
Extrapolation
Rules
SIM Box
Terminator
Automated SIM Box

Deactivation
CDRs and other Data
Proven Evidence
Automated SIM Box
Deactivation
Network Operator Fraud Team

Alerts to investigate
Deactivation
44
Agenda

Testing Scenarios
The SIM Box Threat

45
Other SIGOS Fraud Solutions
Get in touch with us for more information on other Fraud Solutions
Interconnect Assurance
SMS Fraud
Beyond SIM Boxes: refiling, leaky PBX, ghost trunks, internal fraud...
Detecting abnormal SMSc termination
Consultancy & Training Services
From the worlds best experts in Interconnect Fraud
46
Bellevue 5/601 (UCO Tower)

9050 Ghent
Belgium
Tel : +32 9 239 02 11
47

UC SIM Box Detection1

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

UC SIM Box Detection1

Uploaded by

Copyright:

Available Formats

SIM Box Detection

A Best-in-Best Active SIM Box Detection Solution

Keynote SIGOS GmbH

The Impact of SIM Boxes on your Network

The Next Step: Terminator

Testing is our Competence

2014 Keynote SIGOS GmbH

The SIM Box Scenario

SIM Box intercepts call and sets up a new on-net call

The mobile operator suffers a direct revenue loss of 0,08 EUR/minute

Testing is our Competence

2014 Keynote SIGOS GmbH

Financial Impact of SIM Boxes

Percentage SIM Box bypass

SIM Box minutes per day

Net loss per minute

Net loss per month

Cost of sales for SIM Cards generating financial losses:

Provisioning, distribution, ...

Average # SIMs used per month

Other Costs involved:

Unnecessary investments in radio network e.g. antenna upgrade +50.000 EUR

Testing is our Competence

2014 Keynote SIGOS GmbH

Impact on Quality of Service

Bad Call Quality

Pick-ups and call back

Call success rate

Other Quality Problems to impact revenue

Inbound roamers not reachable

Overall decrease in customer satisfaction

Testing is our Competence

2014 Keynote SIGOS GmbH

SIM Box Promotion Example

Promoting unlimited usage

Examples of previously, international available advertisement

Testing is our Competence

2014 Keynote SIGOS GmbH

The Impact of SIM Boxes on your Network

The Next Step: Terminator

Testing is our Competence

2014 Keynote SIGOS GmbH

Unique Detection Methodology & Service

International calls to your network

From the largest amount of routes

Automated result processing

Determining bypass based on customers numbering plan

Testing is our Competence

2014 Keynote SIGOS GmbH

Customized Flexible Testing

VoIP, Carriers, Calling Cards, Mobile and Fixed coverage

Scan & analysis of traffic routes

Continuous Scanning of Routes

Shoot Bypass Route

Shoot Bypass Route

Shoot Bypass Route

Testing is our Competence

2014 Keynote SIGOS GmbH

Unparalleled Global Coverage

Testing is our Competence

2014 Keynote SIGOS GmbH

Our Carrier Platforms

Central Fraud Detection Platform

Connection to 8 international Carrier Platforms providing access to both