Fraud monitoring system

Abstract

In order to detect fraudulent or potentially fraudulent usage of a telecommunications network, each call connected by way of one of the digital main switching units of the network ( 3 a to 3 c ) has an associated billing record transferred to a fraud management system ( 4 ). The fraud management system compares the origin and destination of the call with a known usage pattern for the originator and, if other indications are that the call is of a fraudulent nature, and the call deviates from the known usage pattern an alarm can be forwarded to an operator. The user profile used to determine normal calling behaviour is updated over a period of time in respect of calls determined as not fraudulent. An initial user profile may be generated from historic billing records.

1 . A method of automatically detecting fraudulent calls in a telecommunications network, the method comprising the steps of: 
 determining the origination of the calls;    determining whether the call is likely to be a fraudulent call using a predetermined pattern of previous or expected calls specific to the origination.    
     
     
         2 . A method according to  claim 1  including the step of receiving a call record containing information on the call, wherein the step of determining the origination of the call uses the call record.  
     
     
         3 . A method according to  claim 1  or  claim 2  wherein the call is determined to be a fraudulent call if it lies significantly outside the predetermined pattern of calls.  
     
     
         4 . A method according to any preceding claim including the step of adaptively modifying the predetermined pattern of calls to update the pattern to accommodate changes in calling behaviour of the origination.  
     
     
         5 . A method according to  claim 4  wherein the adaptive modification of the predetermined pattern of calls is a weighted averaging operation which is weighted to favour the most recent calls.  
     
     
         6 . A method according to  claim 4  or  claim 5  wherein calls determined to be fraudulent are used for adaptively modifying the predetermined pattern of calls once they have been investigated and cleared.  
     
     
         7 . A method according to any preceding claim wherein the origination is determined as at least one of the set comprising a user or group identification code, a node or group of nodes in the telecommunications network, and a geographical location.  
     
     
         8 . A method according to any preceding claim including the step of determining the destination of the call, wherein said predetermined pattern of calls includes information on the call destination.  
     
     
         9 . A method according to  claim 8  wherein the call destination information in said predetermined pattern of calls comprises information identifying a node or group of nodes in the telecommunications network and/or a geographical location.  
     
     
         10 . A method according to any preceding claim including the step of determining the time and/or day or date of the call, wherein the predetermined pattern of calls includes information on at least one of the set of the time of day of the calls, the day or date of the calls, and the frequency of calls made.  
     
     
         11 . A method according to any preceding claim including the step of determining the duration of the call, wherein said predetermined pattern of calls includes information on the duration of calls.  
     
     
         12 . A method according to  claim 2  wherein the call record is received and used in the determination as the call is made.  
     
     
         13 . A method according to any preceding claim including the steps of receiving an input code from the origination, validating the input code, and receiving pattern update data from the origination and updating said predetermined pattern of calls if the input code is valid.  
     
     
         14 . A method according to any preceding claim wherein a pattern of calls from the origination for a current time period is compared with a pattern of calls for a previous time period in order to determine whether there is likely to be fraudulent activity.  
     
     
         15 . Apparatus for automatically detecting fraudulent calls in a telecommunications network, the apparatus comprising: 
 determining means for determining the origination of the call;    storage means for storing data for a pattern of previous or expected calls specific to origination; and    fraud detecting means for determining whether the call is likely to be a fraudulent call using the determined origination of the call and the stored pattern of calls specific to the origination.    
     
     
         16 . Apparatus according to  claim 15  wherein said determining means includes means for receiving a call record containing information on the call, and the fraud detecting means is adapted to use the call record information in the determination.  
     
     
         17 . Apparatus according to  claim 15  or  claim 16  wherein said fraud detecting means is operative to determine that a call is fraudulent if it lies significantly outside the predetermined pattern of calls.  
     
     
         18 . Apparatus according to any one of  claims 15  to  17  including adaptive means for adaptively modifying the predetermined pattern of calls to update the pattern to accommodate changes in calling behaviour of the origination.  
     
     
         19 . Apparatus according to  claim 18  wherein said adaptive means is operative to carry out a weighted averaging operation wherein the most recent calls are given the highest weighting in the adaption process.  
     
     
         20 . Apparatus according to  claim 18  or  claim 19  wherein said adaptive means is operative to use calls determined to be fraudulent in the adaptive process once the calls have been investigated and cleared.  
     
     
         21 . Apparatus according to any one of  claims 15  to  20  wherein said determining means is operative to determine the origination as at least one of the set comprising a user or group identification code, a node or group of nodes in the telecommunications network, and a geographical location.  
     
     
         22 . Apparatus according to any one of  claims 15  to  21  including means for determining the destination of the call, wherein said storage means is adapted to store said predetermined pattern of calls which includes information on the call destination.  
     
     
         23 . Apparatus according to  claim 22  wherein said storage means is adapted to store the information on the call destination which comprises information identifying a node or group of nodes in the telecommunications network and/or a geographical location.  
     
     
         24 . Apparatus according to any one of  claims 15  to  23  including means for determining the time and/or day or date of the call, wherein said storage means is adapted to store said predetermined pattern of calls which includes information on at least one of the set of the time of day of the calls, the day or date of the calls, and the frequency of the calls.  
     
     
         25 . Apparatus according to any one of  claims 15  to  24  including means for determining the duration of the call, wherein said storage means is adapted to store said information on said predetermined pattern of calls which includes information on the duration of calls.  
     
     
         26 . Apparatus according to  claim 16  wherein said means for receiving the call record is operative to receive the call record as the call is made and said fraud detecting means is operative to determine whether the call is likely to be a fraudulent call as the call is made.  
     
     
         27 . Apparatus according to any one of  claims 15  to  26  including means for receiving an input code from the origination, means for validating the input code, and means for receiving pattern update data from the origination and for updating said predetermined pattern of calls if the input code is valid.  
     
     
         28 . A method according to any one of  claims 15  to  27  including current storage means for storing a pattern of calls from the origination for a current time period, wherein said storage means stores a pattern of calls for a previous time period, and said fraud detection means is adapted to compare the pattern for the current time period with the pattern for the previous time period in order to determine whether there is likely to be fraudulent activity.  
     
     
         29 . A method of controlling calls over a telecommunications network, the method comprising the steps of: 
 determining the origination of a call, and    determining whether the call is to be allowed or disallowed using a predetermined pattern of calls specific to the origination.    
     
     
         30 . A method according to  claim 29  including the step of receiving a call record containing information on the call, wherein the step of determining whether the call is to be allowed or disallowed uses the call record in the determination.  
     
     
         31 . A method according to  claim 29  or  claim 30  wherein the call is determined to be disallowed if it lies significantly outside the predetermined pattern of calls.  
     
     
         32 . A method according to any one of  claims 29  to  31  including the step of adaptively modifying the predetermined pattern of calls to update the pattern to accommodate changes in calling behaviour of the origination.  
     
     
         33 . A method according to  claim 32  wherein the adaptive modification of the predetermined pattern of calls is a weighted averaging operation which is weighted to favour the most recent calls.  
     
     
         34 . A method according to any one of  claims 29  to  33  wherein the origination is determined as at least one of the set comprising a user or group identification code, a node or group of nodes in the telecommunications network, and a geographical location.  
     
     
         35 . A method according to any one of  claims 29  to  34  including the step of determining the destination of the call, wherein said predetermined pattern of calls includes information on the call destination.  
     
     
         36 . A method according to  claim 35  wherein the call destination information in said predetermined pattern of calls comprises information identifying a node or group of nodes in the telecommunications network and/or a geographical location.  
     
     
         37 . A method according to any one of  claims 29  to  36  including the step of determining the time and/or day or date of the call, wherein the predetermined pattern of calls includes information on at least one of the set of the time of day of the calls, the day or date of the calls, and the frequency of calls made.  
     
     
         38 . A method according to any one of  claims 29  to  37  including the steps of receiving an input code from the origination, validating the input code, and receiving pattern update data from the origination and updating said predetermined pattern of calls if the input code is valid.  
     
     
         39 . Apparatus for controlling calls over a telecommunications network, the apparatus comprising: 
 determining means for determining the origination of a call;    storage means for storing data for a pattern of calls specific to origination;    allowance determining means for determining whether the call is to be allowed or disallowed using the determined origination of the call and the stored pattern of calls specific to the origination; and    control means for controlling the call in accordance with the determination.    
     
     
         40 . Apparatus according to  claim 39  wherein said determining means includes means for receiving a call record containing information on the call, and the allowance determining means is adapted to use the call record information in the determination.  
     
     
         41 . Apparatus according to  claim 39  or  claim 40  wherein said allowance determining means is adapted to determine that a call is to be disallowed if it lies significantly outside the stored pattern of calls specific to the origination.  
     
     
         42 . Apparatus according to any one of  claims 39  to  41  including adaptive means for adaptively modifying the stored pattern of calls specific to the origination to update the pattern to accommodate changes in calling behaviour of the origination.  
     
     
         43 . Apparatus according to  claim 42  wherein said adaptive means is operative to carry out a weighted averaging operation wherein the most recent calls are given the highest weighting in the adaption process.  
     
     
         44 . Apparatus according to any one of  claims 39  to  43  wherein said determining means is operative to determine the origination as at least one of the set comprising a user or group identification code, a node or group of nodes in the telecommunications network, and a geographical location.  
     
     
         45 . Apparatus according to any one of  claims 39  to  44  including means for determining the destination of the call, wherein said storage means is adapted to store said pattern of calls which includes information on the call destination.  
     
     
         46 . Apparatus according to  claim 45  wherein said storage means is adapted to store the information on the call destination which comprises information identifying a node or group of nodes in the telecommunications network and/or a geographical location.  
     
     
         47 . Apparatus according to any one of  claims 39  to  46  including means for determining the time and/or day or date of the call, wherein said storage means is adapted to store said pattern of calls which includes information on at least one of the set of the time of day of the calls, the day or date of the calls, and the frequency of the calls.  
     
     
         48 . Apparatus according to any one of  claims 39  to  47  including means for receiving an input code from the origination, means for validating the input code, and means for receiving pattern update data from the origination and for updating said pattern of calls if the input code is valid.  
     
     
         49 . A method of controlling access to a telecommunications network, the method comprising the steps of: 
 determining the origination of calls over the telecommunications network over a current period of time;    comparing a pattern of calls from an origination for the current period of time with an allowed pattern of calls; and    controlling access to the telecommunications network for originations based on the result of the comparison.    
     
     
         50 . Apparatus for controlling access to a telecommunications network, the apparatus comprising: 
 first storage means for storing patterns of allowed calls for originations;    determining means for determining the origination of calls over the telecommunications network over a current period of time;    second storage means for storing patterns of calls from originations over the current period of time;    comparing means for comparing the stored patterns of calls from originations over the current period of time with the stored patterns of allowed calls; and    control means for controlling access to the telecommunications network for the originations based on the result of the comparison.