Voice fraud: Wangiri, IRSF, and what they look like in your CDRs

Voice fraud is not a rare misfortune that happens to other networks. It is a background condition of carrying international traffic, and the difference between operators is not whether they are targeted but how quickly they notice. Two patterns account for a large share of what the industry sees, and both leave recognisable traces in call detail records long before anyone files a complaint. Knowing what those traces look like is most of the defence.

Wangiri: the missed call that wants to be returned

Wangiri means one ring and cut, which describes the method exactly. A very large number of subscribers receive a call that stops ringing almost immediately. Some of them call back out of curiosity. The number they call back is expensive to reach, and the revenue from those return calls is shared with whoever arranged the scheme. Taken one at a time the calls look trivial; taken together they form a shape that is hard to mistake for anything else. The outbound leg is unremarkable — it is the campaign, not the individual call, that gives it away, and that is why looking at traffic one record at a time never finds it.

• →Very short duration on the initial calls, clustered tightly in time rather than spread the way human calling is.
• →A narrow set of calling numbers reaching an unusually broad set of called numbers.
• →A delayed wave of return traffic towards destinations your subscribers rarely call otherwise.
• →Answer behaviour on those return calls that differs sharply from your usual profile for the same destination.

IRSF: revenue extracted from your own traffic

International revenue share fraud works from the other direction. Rather than persuading subscribers to call, it generates the calls directly — from a compromised PBX, a stolen SIM, or an account with weak controls — towards number ranges whose termination is expensive. The party controlling those ranges takes a share of what the call costs you. The signature is a sudden change in an established pattern rather than an unusual absolute figure. A customer who has never called a given region begins calling it steadily. Calls start at hours when that customer is normally quiet. Durations become suspiciously uniform, because the traffic is generated rather than made by people. And volume towards a single destination climbs faster than any legitimate business would ramp, which is the part that turns an anomaly into an emergency.

What actually helps

Detection rules matter, but habits matter more. The operators who lose least are those who look at their traffic often enough to know what normal looks like, and who can act on what they find without a long approval chain. A rule that fires in the middle of the night is only useful if someone is able to block a destination in the middle of the night. Three habits carry most of the benefit: watch destination mix as a shape rather than a total, so that an unusual region stands out even when overall volume looks ordinary; set ceilings per customer and per destination, and treat reaching one as a signal rather than a nuisance to be raised; and review the exceptions weekly, because fraud patterns change faster than rules do.

A last point on responsibility. Fraud rarely respects the boundary between two networks, which means the party who detects it first is often not the party losing money. Partnerships that handle this well agree in advance on how a suspicion is raised, who can block what, and how quickly the other side commits to answer outside working hours. Those three sentences in an agreement are worth more than a detection system nobody is allowed to act on. None of this requires exotic tooling. It requires that someone owns the question and looks at it regularly. When we onboard a partner, traffic profile is part of the conversation from the start — not to constrain the business, but because knowing what your normal looks like is the only reliable way to recognise the moment it stops being normal.