User authentication based on SS7 call forwarding detection
A user authentication system that analyzes call forwarding information obtained from telecommunication networks, such as through the use of Signaling System No. 7 (“SS7”) protocols, to detect the possibility of fraud. In response to a request to access a network-accessible service, the system performs an initial authentication of provided user account credentials. The system then obtains a telecommunication subscriber identifier that is associated with the user account. Prior to performing additional device-based user authentication, the system obtains call forwarding information for the user. The obtained call forwarding information is then evaluated for potentially fraudulent call forwarding configurations. For example, call forwarding to certain call forwarding numbers, or the use of different call forwarding types, may be indicative of fraud intended to undermine further user authentication.
1. A computer-implemented method of registering a user with a network-accessible service, the method comprising:
receiving a request from a user to register with a network-accessible service;
identifying a mobile telephone number associated with the request;
obtaining a subscriber identifier associated with the mobile telephone number;
transmitting, to a telecommunication network, a query of call forwarding services associated with the subscriber identifier;
receiving, from the telecommunication network, a query response that comprises forwarding information associated with the subscriber identifier;
evaluating the received forwarding information to detect conditions indicative of fraud; and
when a condition indicative of fraud is not detected, registering the user with the network-accessible service by:
transmitting a verification code to a mobile communication device associated with the mobile telephone number;
receiving a response code from the user; and
creating a user account with the network-accessible service when the verification code and the response code match, wherein the user account includes the mobile telephone number.
2. The method of claim 1 , wherein the request from the user includes the mobile telephone number.
3. The method of claim 1 , wherein the subscriber identifier is an international mobile subscriber identity (IMSI).
4. The method of claim 3 , wherein the IMSI is obtained by querying the telecommunication network.
5. The method of claim 3 , wherein the IMSI is obtained from the mobile communication device via an application installed on the mobile communication device.
6. The method of claim 1 , wherein the forwarding information describes whether incoming communications to the mobile telephone number are being forwarded to a forwarding number.
7. The method of claim 6 , wherein at least one of the incoming communications is a voice call.
8. The method of claim 6 , wherein at least one of the incoming communications is a short message service (SMS) message.
9. The method of claim 1 , wherein the transmitted query of call forwarding services is an InterrogateSS request.
10. The method of claim 1 , wherein a fraud condition is detected when at least one incoming communication to the mobile telephone number is being forwarded to a forwarding number.
11. The method of claim 1 , wherein a fraud condition is detected when at least one incoming communication to the mobile telephone number is being forwarded to a forwarding number having a country code different from a country code of the mobile telephone number.
12. The method of claim 1 , the method further comprising:
maintaining data reflecting call forwarding configurations, wherein each call forwarding configuration comprises a call forwarding type and a call forwarding number; and
wherein detecting a fraud condition is further based on comparing the forwarding information to the maintained call forwarding configurations.
13. The method of claim 12 , wherein at least one of the maintained call forwarding configurations further comprises a fraud status indicating whether the corresponding call forwarding configuration is a known fraudulent or known trusted configuration.
14. The method of claim 12 , wherein the data further comprises at least one entry indicating a known fraudulent telecommunication provider.
15. A non-transitory computer readable medium containing instructions configured to cause one or more processors to perform a method of registering a user with a network-accessible service, the method comprising:
receiving a request from a user to register with a network-accessible service;
identifying a mobile telephone number associated with the request;
obtaining a subscriber identifier associated with the mobile telephone number;
transmitting, to a telecommunication network, a query of call forwarding services associated with the subscriber identifier;
receiving, from the telecommunication network, a query response that comprises forwarding information associated with the subscriber identifier;
evaluating the received forwarding information to determine whether at least one incoming communication to the mobile telephone number is being forwarded to a forwarding number; and
when no incoming communications to the mobile telephone number are indicated as being forwarded to a forwarding number, registering the user with the network-accessible service.
16. The non-transitory computer readable medium of claim 15 , wherein the subscriber identifier is an international mobile subscriber identity (IMSI), and wherein the IMSI is obtained by querying the telecommunication network.
17. The non-transitory computer readable medium of claim 15 , wherein the transmitted query of call forwarding services is an InterrogateSS request.
18. The non-transitory computer readable medium of claim 15 , the method further comprising:
maintaining data reflecting call forwarding configurations, wherein each call forwarding configuration comprise a call forwarding type and a call forwarding number; and
wherein detecting a fraud condition is further based on comparing the forwarding information to the maintained call forwarding configurations.
19. The non-transitory computer readable medium of claim 18 , wherein at least one of the maintained call forwarding configurations further comprises a fraud status indicating whether the corresponding call forwarding configuration is a known fraudulent or known trusted configuration.
20. The non-transitory computer readable medium of claim 18 , wherein the data further comprises at least one entry indicating a known fraudulent telecommunication provider.