IRSF (international revenue share fraud)
In IRSF, a fraudster gets numbers in a high-cost destination and shares in the termination revenue. They then generate as many calls as they can to those numbers, often through a hacked phone system or a compromised account. The victim pays the carrier for the traffic, and the fraudster is paid from it.
It often happens at night, at weekends and on public holidays, when nobody is watching. The bill arrives weeks later.
Wangiri (one ring and cut)
Wangiri is Japanese for one ring and cut. The fraudster calls many numbers and hangs up after a ring so that a missed call is left. People who call back reach a premium-rate number and are charged. For an operator, the signs are many very short calls from one source to many numbers, followed by callbacks to the same destination.
SMS pumping (artificial inflation of traffic)
Here, bots trigger one-time-password or notification messages on a sign-up page to numbers the fraudster controls. Each message earns revenue for the fraudster through the message route. The sender pays for messages nobody wanted.
A tell-tale sign is a low conversion rate. Many codes are sent but few are ever used, and the destinations are concentrated in a few countries or number ranges.
How they compare
| Scheme | Who pays | Early signal | First control |
|---|---|---|---|
| IRSF | The account owner or the operator carrying the call | Sudden calls to high-cost destinations, often out of hours | Destination limits and per-account spend caps |
| Wangiri | People who call back, and the operator's reputation | Bursts of one-ring calls from one source to many numbers | Detect and block the source, warn customers |
| SMS pumping | The business sending the messages | Many messages, very few codes used, concentrated destinations | Rate limits per number and per source, and conversion monitoring |
Controls that work
- Spend caps and velocity limits per account, per trunk and per destination, so one fault cannot run all weekend.
- Destination rules. Block or ask for approval before traffic goes to destinations you do not serve.
- Time-of-day rules. Watch harder, or limit more, when nobody is on duty.
- Callback-loop detection. A number that is called back by many people soon after a burst of one-ring calls is a warning.
- Delivery and conversion checks for messages. Low conversion by destination is the clearest signal of pumping.
- One-click response with an audit trail. Block, allow or quarantine, record who did it and why, and keep the evidence for disputes.
- A person in the loop. Scores should explain themselves so a person can confirm or dismiss them.
Why the invoice is too late
A carrier invoice, a CDR report or a month-end reconciliation shows fraud after the money has gone. The aim is to see it in the live traffic, act within seconds, and then use the CDRs to prove what happened.
How SSONE covers these schemes
Fraud Protection watches voice CDRs, SMS delivery reports, BYOC channels and rate anomalies. It has live fraud signals with severity and confidence, a destination heatmap, IRSF and Wangiri patterns with callback-loop detection, SMS-pumping detection with per-sender scoring, SIM-box detection, a revenue-leak guard, BYOC abuse detection and AI risk scoring tuned on your own traffic, with a human review step. Responses are one click (block, allow, quarantine), audited, and linked to Alert Manager so the right group is emailed.