Fraud detection based on call attempt velocity on terminating number

Abstract

A method of identifying fraud in a telecommunications system, the method including receiving data related to a current call placed from an originating ANI to a terminating ANI, where the received data includes the terminating ANI and a billing number used to place the call. Billing numbers for prior calls to the terminating ANI, if any, and corresponding indicia of the times of the calls are retrieved. A determination is made of whether the number of billing numbers used for the current and prior calls to the terminating ANI over a prior period of time falling within a time interval satisfies a threshold. If the threshold is satisfied, a fraud alert is generated.

1 . (canceled) 
     
     
         2 . A method comprising:
 determining, for a predetermined time interval, a number of different billing numbers used for a current call associated with a terminating number;   determining, for the predetermined time interval, a number of prior calls placed to the terminating number; and   generating an alert to indicate a fraud based on the determined number of different billing numbers and the determined number of prior calls.   
     
     
         3 . A method according to  claim 2 , further comprising:
 initiating blocking of calls subsequent to the current call to the terminating number.   
     
     
         4 . A method according to  claim 2 , further comprising:
 storing threshold values and corresponding time interval values for the terminating number, wherein the threshold values relate to the number of different billing numbers and the number of prior calls for the respective predetermined time intervals;   retrieving one of the threshold values for the terminating number; and   determining whether the retrieved threshold value is satisfied to generate the alert.   
     
     
         5 . A method according to  claim 4 , further comprising:
 correlating one or more of the threshold values to one or more factors that include either type of originating number the current call is made from, type of billing product used for the current call, timing information for the current call, or a combination thereof.   
     
     
         6 . A method according to  claim 5 , further comprising:
 determining whether the terminating number is in a look-up table; and   retrieving a default one of the threshold values and a default one of the time intervals if the terminating number is not in a look-up table.   
     
     
         7 . A method according to  claim 5 , further comprising:
 selecting one or more of the threshold values to apply based on the one or more factors.   
     
     
         8 . A method according to  claim 2 , wherein the billing numbers are associated with a credit card, a calling card, pre-paid phone card, or a phone number for a third party call. 
     
     
         9 . A method according to  claim 2 , wherein the terminating number is specified as an automatic number indicator. 
     
     
         10 . A method according to  claim 2 , wherein the billing numbers are associated with a credit card, a calling card, pre-paid phone card, or a phone number for a third party call. 
     
     
         11 . An apparatus comprising:
 at least one processor; and   at least one memory including computer program code for one or more programs,   the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following,
 determine, for a predetermined time interval, a number of different billing numbers used for a current call associated with a terminating number, 
 determine, for the predetermined time interval, a number of prior calls placed to the terminating number, and 
 generate an alert to indicate a fraud based on the determined number of different billing numbers and the determined number of prior calls. 
   
     
     
         12 . An apparatus according to  claim 11 , wherein the apparatus is further caused to:
 initiate blocking of calls subsequent to the current call to the terminating number.   
     
     
         13 . An apparatus according to  claim 11 , wherein the apparatus is further caused to:
 store threshold values and corresponding time interval values for the terminating number, wherein the threshold values relate to the number of different billing numbers and the number of prior calls for the respective predetermined time intervals;   retrieve one of the threshold values for the terminating number; and   determine whether the retrieved threshold value is satisfied to generate the alert.   
     
     
         14 . An apparatus according to  claim 13 , wherein the apparatus is further caused to:
 correlate one or more of the threshold values to one or more factors that include either type of originating number the current call is made from, type of billing product used for the current call, timing information for the current call, or a combination thereof.   
     
     
         15 . An apparatus according to  claim 14 , wherein the apparatus is further caused to:
 determine whether the terminating number is in a look-up table; and   retrieve a default one of the threshold values and a default one of the time intervals if the terminating number is not in a look-up table.   
     
     
         16 . An apparatus according to  claim 14 , wherein the apparatus is further caused to:
 select one or more of the threshold values to apply based on the one or more factors.   
     
     
         17 . An apparatus according to  claim 11 , wherein the billing numbers are associated with a credit card, a calling card, pre-paid phone card, or a phone number for a third party call. 
     
     
         18 . An apparatus according to  claim 11 , wherein the terminating number is specified as an automatic number indicator. 
     
     
         19 . An apparatus according to  claim 11 , wherein the billing numbers are associated with a credit card, a calling card, pre-paid phone card, or a phone number for a third party call. 
     
     
         20 . A system comprising:
 a fraud control platform configured to determine, for a predetermined time interval, a number of different billing numbers used for a current call associated with a terminating number,   wherein the fraud control platform is further configured to determine, for the predetermined time interval, a number of prior calls placed to the terminating number, and to generate an alert to indicate a fraud based on the determined number of different billing numbers and the determined number of prior calls.   
     
     
         21 . A system according to  claim 20 , further comprising:
 a blocking database configured to store threshold values and corresponding time interval values for the terminating number, wherein the threshold values relate to the number of different billing numbers and the number of prior calls for the respective predetermined time intervals.