On the tracks of fraudsters
With nearly 100 deployments in 50 countries, FraudBuster has a unique vision of the trends and techniques in fraud. You can bet our Analysts have stories to tell! This is the story of the stolen SIMcards.
Change in usage profile
Earlier this year, the FraudBuster Analysts observed a trend where a large number of SIMs had experienced a sudden change of behavior before being detected as SIMBoxes. This trend was noted on different networks in 3 different countries over the same period of time.
From a “normal” usage profile (standard call dispersion and duration ratios, SMS usage, geographical mobility), the SIMs would suddenly make more calls, stop sending SMS and stay in the same location (single BTS usage) … Very suspicious profiles, to say the least!
False positives?
However, those detections were initially disputed by our customers. They argued the detected SIMs belonged to genuine subscribers, with credible evidence! Were these all False Positive detections?
As this specific profile represented up to 30% of FraudBuster’s daily detections, it was hard to believe so many genuine faithful subscribers would collectively and radically change their behavior. Our Analysts were urged to challenge their own detection rules… only to confirm that they were indeed SIMboxes.
Further KYC investigations by our customers revealed that the detected SIMs had actually changed hands, with their subscribers claiming (but not too soon) that their phones and SIMs had been stolen…
Conclusion
While it does happen that some stolen SIMs end up doing fraud (SIMbox, but also IRSF), it was later concluded that fraudsters have actually created a market for second-hand SIMs. It’s clear that “older” SIMs with an established human behavior history have a good value for fraudsters. It gives them an edge on antifraud by scrambling the usage profile of their SIMboxes and will increase detection times.
FraudBuster has since updated the detection logic to include these profiles with a sudden change of behavior. Our Analysts can now replicate it to all of our customers for better protection.