Mobile phone takeover protection system and method

1. A method for preventing fraudulent use of a Mobile Subscriber Integrated Services Digital Network Number (MSISDN) of a mobile phone terminal in a wireless network, comprising the steps of:

associating an International Mobile Subscriber Identity (IMSI) with a respective MSISDN for the mobile phone terminal;

storing the associated IMSI and MSISDN; and

upon receipt of a network request from the mobile phone terminal for a secure resource;

extracting the MSISDN from the network request;

constructing a Mobile Application Part (MAP) message request to the wireless network for the extracted MSISDN;

obtaining the IMSI currently associated with the MSISDN in the wireless network in reply to the MAP request;

comparing the obtained IMSI with the stored IMSI for the extracted MSISDN;

upon a condition that the obtained IMSI matches the stored IMSI for the extracted MSISDN, validating the network request; and

upon a condition that the obtained IMSI does not match the stored IMSI for the extracted MSISDN, sending a message to said mobile phone terminal and authenticating the unmatched IMSI using an identifier associated with said mobile phone terminal, and replacing the stored IMSI with the authenticated unmatched IMSI.

2. The method of claim 1 , wherein the associating step comprises the further steps of performing a MAP message request on a communicated MSISDN and obtaining the IMSI currently associated with the communicated MSISDN in reply.

3. The method of claim 1 , wherein the associating step comprises the further steps of performing a MAP message request on a communicated MSISDN and obtaining the IMSI currently associated with the communicated MSISDN in reply and the associating step comprises the further step of receiving a communicated batch file storing at least a plurality of MSISDN.

4. The method of claim 1 , wherein the step of storing comprises the further steps of date—stamping and time—stamping the associated IMSI and MSISDN.

5. The method of claim 1 , wherein the associating step comprises the further step of associating a provider of secure resources with the associated IMSI and MSISDN.

6. The method of claim 1 , comprising the further step of generating an alarm if the obtained IMSI does not match the stored IMSI for the extracted MSISDN.

7. The method of claim 1 , comprising the step of generating an alarm if the obtained IMSI does not match the stored IMSI for the extracted MSISDN; and automatically notifying the provider if the obtained IMSI does not match the stored IMSI for the extracted MSISDN.

8. The method of any claim 1 , comprising the further step of obtaining position data of the mobile phone terminal from positioning means thereof.

9. The method of claim 1 , wherein the step of validating further comprises automatically communicating the requested secure resource to the mobile phone terminal.

10. The method of claim 1 , wherein the network request from the mobile phone terminal for a secure resource is selected from the group comprising a phone call, a Short-Message-Service (SMS) message, a near-field, routed wireless electronic transaction, data request from software running on a mobile phone terminal or a stand-alone secure resource, for example, but not limited to, accessing an online banking portal or accessing a secure remote server.

11. The method of claim 1 wherein the method identifies that the current IMSI is different to a trusted stored MSI stored within the service, the method comprises the steps of storing the current IMSI as well as the time the query was performed such that when another query is performed the current IMSI matches the suspect IMSI from the last query check and if a sufficient length of time has passed between the two IMSI checks a determination can be made that the suspect IMSI comprises a legitimate IMSI change.

12. The method of claim 1 comprising the step of generating a first and a second one time passwords and temporarily stored, wherein in response to a query, if the current IMSI matches a trusted IMSI stored in the service then the service will send the first one time password to the mobile phone terminal enabling one level of access to the secure resource or if the current IMSI does not match the trusted IMSI stored in the service, then the service will send the second one time password to the mobile phone terminal enabling a second level of access to the secure resource.

13. The method of claim 1 wherein the MAP message request comprises a Mobile Application Part (MAP) Send Routing Information (SRI) request.

14. A system for preventing fraudulent use of a Mobile Subscriber Integrated Services Digital Network Number (MSISDN) of a mobile phone terminal in a network, comprising:

means for associating an International Mobile Subscriber Identity (IMSI) with a respective MSISDN for the mobile phone terminal;

storage means the associated IMSI and MSISDN; and

network means adapted to receive a network request from the mobile phone terminal for a secure resource;

validating means adapted to extract the MSISDN from the network request;

construct a Mobile Application Part (MAP) message request to the wireless network for the extracted MSISDN; obtain the IMSI currently associated with the MSISDN in the wireless network in reply to the MAP request; compare the obtained IMSI with the stored IMSI for the extracted MSISDN;

upon a condition that the obtained IMSI matches the stored IMSI for the extracted MSISDN, validate the network request; and

upon a condition that the obtained IMSI does not match the stored IMSI for the extracted MSISDN, sending a message to said mobile phone terminal and authenticating the unmatched IMSI using an identifier associated with said mobile phone terminal, and replacing the stored IMSI with the authenticated unmatched IMSI.

15. The system of claim 14 , wherein the associating means and the storage means comprises at least one database and the validating means comprises a mobile network interrogator data processing module, stored and processed by a server operably connected to the wireless network.

16. The system of claim 14 , wherein the associating means and the storage means comprises at least one database and the validating means comprises a mobile network interrogator data processing module, stored and processed by a server operably connected to the wireless network and the mobile network interrogator data processing module is adapted to perform a MAP SRI (or similar, for example MAP-SEND-IMSI or other appropriate MAP query) on a communicated MSISDN and to obtain the IMSI currently associated with the communicated MSISDN in reply.

17. The system of claim 14 , wherein the associating means and the storage means comprises at least one database and the validating means comprises a mobile network interrogator data processing module, stored and processed by a server operably connected to the wireless network and the associating means further comprises a batch interface server data processing module adapted to receive a communicated batch file storing at least a plurality of MSISDN.

18. A set of instructions recorded on a non-transient data carrying medium which, when read from the medium and processed by a data processing terminal having networking means and configured as, or connected to, a wireless network gateway, configures the terminal to prevent fraudulent use of a Mobile Subscriber Integrated Services Digital Network Number (MSISDN) of a mobile phone terminal in a wireless network, by performing the data processing steps of:

associating an International Mobile Subscriber Identity (IMSI) with a respective MSISDN for the mobile phone terminal;

storing the associated IMSI and MSISDN; and

upon receipt of a network request from the mobile phone terminal for a secure resource;

extracting the MSISDN from the network request;

constructing a Mobile Application Part (MAP) message request to the wireless network for the extracted MSISDN;

obtaining the IMSI currently associated with the MSISDN in the wireless network in reply to the MAP request;

comparing the obtained IMSI with the stored IMSI for the extracted MSISDN;

upon a condition that the obtained IMSI matches the stored IMSI for the extracted MSISDN, validating the network request; and

upon a condition that the obtained IMSI does not match the stored IMSI for the extracted MSISDN sending a message to said mobile phone terminal and authenticating the unmatched IMSI using an identifier associated with said mobile phone terminal, and replacing the stored IMSI with the authenticated unmatched IMSI.

19. A method for preventing fraudulent use of a Mobile Subscriber Integrated Services Digital Network Number (MSISDN) of a mobile phone terminal in a wireless network, comprising the steps of:

associating an Integrated Circuit Card Identifier (ICCID) with a respective MSISDN for the mobile phone terminal;

storing the associated ICCID and MSISDN; and

upon receipt of a network request from the mobile phone terminal for a secure resource;

extracting the MSISDN from the network request;

constructing a Mobile a message request to the wireless network for the extracted MSISDN;

obtaining the ICCID currently associated with the MSISDN in the wireless network in reply to the message request;

comparing the obtained ICCID with the stored ICCID for the extracted MSISDN;

upon a condition that the obtained ICCID matches the stored ICCID for the extracted MSISDN, validating the network request, and

upon a condition that the obtained ICCID does not match the stored ICCID for the extracted MSISDN sending a message to said mobile phone terminal and authenticating the unmatched ICCID using an identifier associated with said mobile phone terminal; and replacing the stored ICCID with the authenticated unmatched ICCID.

20. A system for preventing fraudulent use of a Mobile Subscriber Integrated Services Digital Network Number (MSISDN) of a mobile phone terminal in a network, comprising:

means for associating an Integrated Circuit Card Identifier (ICCID) with a respective MSISDN for the mobile phone terminal;

storage means the associated ICCID and MSISDN;

network means adapted to receive a network request from the mobile phone terminal for a secure resource;

validating means adapted to extract the MSISDN from the network request;

construct a message request to the wireless network for the extracted MSISDN; obtain the ICCID currently associated with the MSISDN in the wireless network in reply to the message request; compare the obtained ICCID with the stored ICCID for the extracted MSISDN;

upon a condition that the obtained ICCID matches the stored ICCID for the extracted MSISDN, validate the network request; and

upon a condition that the obtained ICCID does not match the stored ICCID for the extracted MSISDN sending a message to said mobile phone terminal and authenticating the unmatched ICCID using an identifier associated with said mobile phone terminal; and replacing the stored ICCID with the authenticated unmatched ICCID.