Telecom-fraud detection using device-location information
View Patent ↗Subject matter described herein is directed to detecting unauthorized use, such as by a cloned mobile device, of wireless telecommunication services. Mobile-device locations are analyzed to detect outlying locations, such as locations that lack a call relationship with other locations or that are greater than a threshold distance away from other locations. Outlying locations might be detected when more than one discrete location cluster exists among a plurality of mobile-device locations, the discrete clusters having respective locations that are not related by way of a call and that fail to satisfy a threshold distance. Outlying locations or multiple discrete locations clusters suggest an unauthorized use of a mobile device's account.
1. A method of detecting that a device identifier that identifies a first mobile device has been used by a second mobile device to utilize telecommunication services, the method comprising:
receiving a plurality of mobile-device locations associated with the device identifier, wherein the plurality of mobile-device locations describe locations at which the first mobile device and the second mobile device engaged in a communications instances;
identifying a subset of locations from the plurality of mobile-device locations,
wherein each location in the subset either is related to a another location in the subset by way of a call, satisfies a threshold distance, or a combination thereof, and
wherein the subset of locations forms a geographical grouping;
from among the plurality of mobile-device locations, detecting an outlying mobile-device location that is characterized by either lacking a call relationship with any location in the subset, failing to satisfy the threshold distance, or a combination thereof, wherein the threshold distance comprises an approximate radius of the geographical grouping; and
providing an unauthorized-use response when the outlying mobile-device location is detected based on an inference that the second mobile device is using the device identifier.
2. The method of claim 1 , wherein each communications instance includes facilitating a voice call, exchanging a voicemail message, exchanging a text message, exchanging an instant message, exchanging an email message, or facilitating a data call.
3. The method of claim 1 , wherein each mobile-device location of the plurality includes either a starting location at which a respective mobile device was located when a respective communications instance was initiated or an ending location at which the respective mobile device was located when the respective communications instance was terminated.
4. The method of claim 1 , wherein each location includes a geographical coordinate, a base-station location of a cell, or a centroid of a cell sector.
5. The method of claim 1 , wherein a location is characterized as related to the other location when a communications instance either starts at the location and ends at the other location or starts at the other location and ends at the location.
6. The method of claim 1 , wherein detecting the outlying mobile-device location includes determining that more than one discrete mobile-device-location cluster exists among the plurality of locations.
7. The method of claim 1 , wherein the unauthorized-use response includes flagging the account, sending an alert, suspending services, or a combination thereof.
8. Non-transitory computer-readable media having computer-executable instructions embodied thereon that, when executed, perform a method of detecting that a device identifier that identifies a first mobile device has been used by a second mobile device to utilize telecommunication services, the method comprising:
receiving a plurality of mobile-device locations associated with the device identifier,
wherein the plurality of mobile-device locations indicate locations at which the first mobile device and the second mobile device engaged in communications instances, and
wherein the plurality of mobile-device locations includes a subset of locations, each of which either is related to another location of the subset by way of a call, satisfies a threshold distance, or a combination thereof, the subset of locations forming a geographic grouping;
calculating a radius of the geographic grouping;
from among the plurality of mobile-device locations, detecting an outlying mobile-device location that is characterized by lacking a call relationship with any location in the subset of locations and falling outside the radius that is calculated; and
providing an unauthorized-use response when the outlying mobile-device location is detected based on an inference that the second mobile device is using the device identifier.
9. The computer-readable media of claim 8 , wherein a communications instance includes facilitating a voice call, exchanging a voicemail message, exchanging a text message, exchanging an instant message, exchanging an email message, or facilitating a data call.
10. The computer-readable media of claim 8 ,
wherein the outlying mobile-device location is characterized by being located beyond a threshold distance away from an approximate center of the geographical grouping.
11. The computer-readable media of claim 10 ,
wherein the approximate center is determined by:
(a) representing each location of the geographical grouping as a respective first coordinate and a respective second coordinate;
(b) determining a first-coordinate mean based on all respective first coordinates of the subset; and
(c) determining a second-coordinate mean based on all respective second coordinates of the subset, and
wherein the approximate center is represented by the first-coordinate mean and the second-coordinate mean.
12. The computer-readable media of claim 10 , wherein the threshold distance is equal to the approximate radius of the geographical grouping.
13. The computer-readable media of claim 10 , wherein the threshold distance is equal to a product of an approximate radius of the geographical grouping multiplied by a constant.
14. The computer-readable media of claim 8 , wherein the unauthorized-use response includes flagging the account, sending an alert, suspending services, or a combination thereof.
15. Non-transitory computer-readable media having computer-executable instructions embodied thereon that, when executed, perform a method of detecting that a device identifier that identifies an authorized mobile device has been used by an unauthorized mobile device to utilize telecommunication services, the method comprising:
receiving a plurality of mobile-device locations associated with the device identifier, wherein each mobile-device location describes a given location at which a respective mobile device engaged in a respective communications instance;
determining that two locations from the plurality of mobile-device locations share a first call relationship;
determining that a third location from the plurality of mobile-device locations shares a second call relationship with one of the two locations, wherein the third location shares a third call relationship with another location;
grouping the two locations in a cluster with the third location and the other location;
from among the plurality of mobile-device locations, detecting an outlying mobile-device location that is characterized by either lacking a call relationship with any location of the cluster, failing to satisfy a threshold distance, or a combination thereof; and
providing an unauthorized-use response when the outlying mobile-device location is detected.
16. The computer-readable media of claim 15 , wherein the threshold distance includes a geographical boundary and wherein the location fails to satisfy the threshold distance when the location is outside the geographical boundary.
17. The computer-readable media of claim 15 , wherein the outlying mobile-device location is characterized by being located beyond the threshold distance away from an approximate center of a geographical grouping of the cluster.
18. The computer-readable media of claim 15 , wherein the unauthorized-use response includes flagging the account, sending an alert, suspending services, or a combination thereof.