Using communications records to detect unauthorized use of telecommunication services
View Patent ↗Subject matter described herein is directed to detecting fraud in a telecommunications environment. Communication records of a mobile device include attributes that describe communication instances of the device. For example, communication records might include a start time or end time of voice calls initiated by a mobile device. The attributes are analyzed, such as by calculating call-gap durations, to determine if any thresholds are violated. Threshold violations suggest fraudulent use and prompt an unauthorized-use response.
1. Non-transitory computer-readable media storing computer-executable instructions that, when executed, perform a method of detecting mobile-device-account fraud, the method comprising:
receiving communication records describing a set of communication instances of a mobile device, wherein each communication record includes a respective time instant;
calculating an average instance-gap duration between consecutive communication instances in the set of communication instances, wherein an instance-gap duration includes a duration of time that passes between a time instant of a communication instance and a subsequent time instant of a consecutive ensuing communication instance; and
prompting an unauthorized-use response based on the average instance-gap duration being below an instance-gap threshold, wherein the instance-gap threshold is determined by calculating a multi-user average instance-gap duration that averages instance-gap durations across a plurality of users and wherein the instance-gap threshold is a number of standard deviations below the multi-user average instance-gap duration.
2. The computer-readable media of claim 1 , wherein the set of communication instances includes outgoing voice calls initiated by the mobile device.
3. The computer-readable media of claim 2 , wherein outgoing voice calls of the set include international outgoing calls initiated by the mobile device.
4. The computer-readable media of claim 2 , wherein voice calls of the set include outgoing voice calls to one or more suspicious area codes, which historically are called when mobile-device-account fraud is being perpetuated.
5. The computer-readable media of claim 1 , wherein the unauthorized-use response includes deeming the mobile device a call-shop mobile device that is used to perpetuate the mobile-device-account fraud.
6. The computer-readable media of claim 1 , wherein an unauthorized-use response includes flagging an account associated with the mobile device.
7. The computer-readable media of claim 1 , wherein an unauthorized-use response includes terminating services provided to the mobile device.
8. Non-transitory computer-readable media storing computer-executable instructions that, when executed, perform a method of detecting mobile-device-account fraud, the method comprising:
receiving communication records describing a set of communication instances of a mobile device, wherein the each communication record includes a respective time instant;
calculating a set of instance-gap durations, wherein an instance-gap duration includes a duration of time that passes between an end time of a communication instance and a start time of a consecutive ensuing communication instance;
determining that a portion of the set of instance-gap durations includes durations that are below an instance-gap threshold, wherein the instance-gap threshold is determined by calculating a multi-user average instance-gap duration that averages instance-gap durations across a plurality of users and wherein the instance-gap threshold is a number of standard deviations below the multi-user average instance-gap duration; and
prompting an unauthorized-use response when the portion exceeds a portion threshold.
9. The computer-readable media of claim 8 further comprising, calculating a set of average-instance-gap durations.
10. The computer-readable media of claim 9 , wherein determining that the portion includes durations below the instance-gap threshold includes determining that a portion of the set of average instance-gap durations includes average-instance-gap durations below the instance-gap threshold.
11. The computer-readable media of claim 10 , wherein the unauthorized-use response is prompted when the portion of the set of average instance-gap durations exceeds the portion threshold.
12. The computer-readable media of claim 8 , wherein the unauthorized-use response includes deeming the mobile device a call-shop mobile device that is used to perpetuate the mobile-device-account fraud.
13. Non-transitory computer-readable media storing computer-executable instructions that, when executed, perform a method of detecting mobile-device-account fraud, the method comprising:
receiving communication records describing a set of outgoing voice calls of a mobile device, wherein each communication record includes a respective call-start time and a respective call-end time;
using the communication records to calculate an average call-gap duration of the set, wherein a call-gap duration includes a duration of time that passes between an end time of a voice call and a start time of a consecutive ensuing voice call; and
prompting an unauthorized-use response based on the average being below a call-gap threshold, wherein the call-gap threshold is determined by calculating a multi-user average call-gap duration that averages call-gap durations across a plurality of users and wherein the call-gap threshold is a number of standard deviations below the multi-user average call-clap duration.
14. The computer-readable media of claim 13 , wherein the average is a simple average.
15. The computer-readable media of claim 14 , wherein the unauthorized-use response includes deeming the mobile device a call-shop mobile device that is used to perpetuate the mobile-device-account fraud.
16. The computer-readable media of claim 14 , wherein the unauthorized-use response includes flagging an account associated with the mobile device.
17. The computer-readable media of claim 13 , wherein the average is a moving average.