Fraud Patterns: SIM Swap, IRSF and More

SIM swap and account takeover

A fraudster persuades a shop or contact centre, or abuses an online journey, to move the victim’s number to a SIM they control. They then receive the victim’s one-time passcodes and take over bank, email or social accounts. The operator’s direct loss is small; the customer’s can be large, and the reputational and regulatory impact falls on the operator.

• Signals: a SIM change followed quickly by password resets or a new device IMEI; a change from an unusual channel, store or location; recent change of contact details; many SIM changes by one agent.
• Controls: stronger identity checks for SIM changes; notification to the old SIM and email; cooling-off periods for high-risk changes; exposing SIM-change recency to banks, for example through the GSMA Open Gateway / CAMARA SIM Swap API.

International Revenue Share Fraud (IRSF)

Calls are generated to high-cost international or premium numbers whose termination revenue is shared with the fraudster. They come from stolen or fraudulently opened SIMs, compromised enterprise PBXs or hacked accounts. The operator owes the termination charges to the carrier chain whether or not its own customer ever pays.

Controls: real-time thresholds on international and premium destinations; high-risk number range lists shared through industry bodies; automatic barring of international calls pending verification; limits on simultaneous calls; PBX security guidance for enterprise customers.

Subscription fraud

An account is opened with a false or stolen identity to obtain handsets, services or credit with no intention of paying. It ends in collections, which is why it is often misclassified as bad debt. Chasing it as debt recovers nothing and leaves the pattern in place.

• Signals: identity data that does not match bureau records; several applications from one address, device or IP; high-value handsets on a new account; heavy international or premium use in the first days.
• Controls: identity and document verification at onboarding; credit limits and deposits for new accounts; device-financing caps; closer monitoring until the first bill is paid.

Payment fraud

Stolen card details are used for top-ups, bill payments, online handset purchases or digital content. The loss arrives later as chargebacks, with scheme fees and, if rates stay high, pressure from the card schemes.

• Signals: many cards on one account or many accounts on one card; rapid top-up velocity; card country different from customer and device location; repeated declines followed by a success.
• Controls: strong customer authentication (3-D Secure); velocity limits per card, account and device; device fingerprinting; holding high-value top-ups for review.

Device and SIM fraud

Abuse of the device or SIM itself: cloned or altered IMEIs, stolen handsets reused on the network, and SIM boxes that route international calls through local SIMs to avoid interconnect charges (interconnect bypass).

• Signals: one IMEI active with several SIMs, or in two places at once; IMEIs on stolen-device lists; SIMs that only make outbound calls, never move and never use data or SMS; many SIMs rotating in one device at one location.
• Controls: IMEI blocklisting (national registers and the GSMA Device Registry); test-call generation to detect bypass routes; usage profiling of new SIMs; restricting bulk SIM sales.

Controls for these patterns live in systems the fraud team does not own: identity checks in CRM and retail journeys, barring in the OCS and network, 3-D Secure in the payment gateway, blocklists in the equipment identity register. Each pattern needs an owner in that system who will accept the friction the control adds.

SIM swap is the pattern where the operator’s loss is smallest and its exposure largest. Banks rely on the phone number for one-time passcodes, so the operator’s SIM-change process is part of other companies’ security. Exposing SIM-change recency through an API shifts some of the detection to the bank, but only if the operator’s SIM-change record is complete and current.

Check yourself

• A batch of new postpaid accounts with high-value handsets reaches 90 days unpaid. Collections wants to send them to an agency. What do you check first?Show answerHide

  Whether they are subscription fraud: identity mismatches with bureau data, shared addresses, devices or IPs, and heavy early usage. If so, the agency recovers little and the onboarding control needs fixing.

• A SIM shows only outbound calls, never moves and never uses data or SMS. What is it likely to be, and who loses?Show answerHide

  A SIM in a SIM box routing international calls through local SIMs. The operator loses the interconnect revenue that the bypass avoids.

• The IRSF account is closed and written off. Why has the loss not stopped there?Show answerHide

  The termination charges for the calls already made are owed to the carrier chain whether or not the originating customer ever pays. Closing the account stops new calls; it does not reduce what is owed. Recovery means withholding or disputing payments where agreements allow.