Fraud and revenue leak: IRSF, Wangiri, sim-box

Three ways to see it

1. 1

   Telecom fraud comes in three big families that matter for Pakistani operators. International Revenue Share Fraud, IRSF, where fraudsters generate calls to premium-rate numbers and split revenue with corrupt route owners. Wangiri, Japanese for one and cut, where missed-call bait drives subscribers to call back. Sim-box or interconnect bypass, where international calls are landed locally to dodge international termination rates and PTA's regulated tariff. Each family has a distinct signature in the Call Detail Records.

2. 2

   Way one to think about it: fraud is a velocity problem disguised as a volume problem. A single fraudulent call is invisible. A thousand fraudulent calls in 30 minutes from the same destination prefix is the entire signal. Real-time aggregation of CDRs by destination, originator pattern, duration distribution, and time-of-day curves separates real bursts of human calling from coordinated machine bursts. Batch processing once a day catches yesterday's loss after the money has left.

3. 3

   Way two: sim-box detection is a battle of patterns. A sim-box is a hardware appliance with hundreds of SIM slots that lands international calls as if they were local. The signature is unnatural: each SIM on the box places almost only outbound voice calls, almost never sends SMS to friends, almost never moves geographically, almost never recharges manually, and the call durations cluster oddly. Test calls from outside Pakistan that ring suspect numbers and confirm bypass close the loop. Without test-call generation, model-only detection misses the cleverer boxes.

The why-tree

Try this with Claude

AI-edge prompt: 'I lead fraud and revenue assurance at a Pakistani mobile operator. Design a real-time fraud detection pipeline that ingests CDRs at 50,000 records per second, flags IRSF, Wangiri, and sim-box patterns within 60 seconds, and supports manual review of medium-confidence cases. Cover the feature set per fraud type, the data exchange standard with peer operators under PTA coordination, and the false-positive budget I should commit to in writing.'