Secure messaging framework for preventing SIM swap fraud
A telecommunications system is configured to prevent Subscriber Identity Module (SIM) swap scams. The system includes multiple network nodes and a database. When a SIM change occurs for a given phone number, a messaging process is triggered between the network nodes that temporarily sets a flag in the database associated with that phone number. While the flag is set in the database, messages for the phone number are not delivered in a normal manner. Instead, the messages are analyzed by the network for the presence of secure information, such as one-time passwords (OTPs). If a message is determined to be secure by the network, then delivery of the message is blocked, thereby preventing a fraudster from performing SIM swap fraud using the message.
1 . A telecommunications system configured to prevent delivery of a message containing a one-time password (OTP) based on results of an analysis taken in response to an indication of a flag, the telecommunications system comprising:
a database configured to store a flag associated with an identification number of a user device,
wherein the flag is associated with a subscriber identity module (SIM) change associated with the identification number, and
wherein the flag, when set, expires after a predetermined amount of time;
a first network node including a processor and a memory storing instructions, execution of which by the processor causes the first network node to:
detect the SIM change associated with the identification number, and
in response to a determination that the SIM change is associated with a risk score that exceeds a lower threshold value and does not exceed an upper threshold value, trigger a procedure that causes the flag to be set in the database; and
a second network node including a processor and a memory storing instructions, execution of which by the processor causes the second network node to:
receive a first text message associated with the identification number configured for delivery to the user device;
send, to the database and in response to receiving the first text message, a request for an indication of the flag associated with the identification number;
based on the indication that the flag has been set, cause an analysis of text of the first text message to determine if the first text message includes an OTP;
based on a first indication that the first text message includes an OTP, block delivery of the first text message to the user device,
wherein the first indication is determined based on the analysis of text of the first text message;
receive, at the second network node, a second text message associated with the identification number configured for delivery to the user device;
based on a second indication that the second text message does not include an OTP, deliver the second text message to the user device;
receive, from a user, a message to clear the flag in the database; and
send, to the database, a request to clear the flag,
wherein the request causes the flag to be cleared before completion of the predetermined amount of time.
2 . The system of claim 1 , wherein, in addition to the first text message being blocked, the network node is further caused to:
deliver, to the user device, a replacement text message that indicates the first text message has been blocked.
3 . The system of claim 1 , wherein the predetermined amount of time is determined based on a risk score associated with the SIM change, and wherein the predetermined amount of time is about 1 to 4 hours, 4 to 6 hours, 6 to 12 hours, 12 to 24 hours, 24 to 36 hours, or 36 to 48 hours.
4 . The system of claim 1 , wherein the network node includes a short message service center (SMSC), and wherein the network node is further caused to:
receive the first indication that the first text message includes the OTP from another network node.
5 . The system of claim 1 , further comprising:
a service delivery gateway (SDG) configured to receive application to person (A2P) messages, wherein the first text message is received at the network node from the SDG.
6 . The system of claim 1 , further comprising:
a second network node configured to:
detect the SIM change associated with the identification number, and
in response to a determination that the SIM change is associated with a risk score that exceeds a threshold value, trigger a procedure that causes the flag to be set in the database.
7 . The system of claim 6 , further comprising:
a third network node configured to determine the risk score based on contextual information associated with the SIM change,
wherein the second network node is configured to receive an indication of the risk score from the third network node.
8 . The system of claim 1 , wherein the first indication that the first text message includes the OTP is determined based on an analysis of text of the first text message using an artificial intelligence model.
9 . A computer-readable storage medium, excluding transitory signals and carrying instructions, which, when executed by at least one data processor of a system, cause the system to:
set, in a database, a flag associated with an identification number of a user device,
wherein the flag is associated with a subscriber identity module (SIM) swap associated with the identification number,
wherein the flag, when set, expires after a predetermined amount of time,
wherein setting the flag comprises:
determining a risk score associated with the SIM swap associated with the identification number, and
setting the flag in response to a determination that the risk score exceeds a lower threshold value and does not exceed an upper threshold value;
receive, at a network node, a text message associated with the identification number;
send, from the network node and in response to receiving the text message, a request for an indication of the flag associated with the identification number;
receive, at the network node, the indication that the flag is set in the database;
classify the text message as secure, wherein the classification is based on an analysis of text of the text message; and
based on an indication that the text message is classified as secure, block delivery of the text message to the user device;
receive, from a user, a message to clear the flag in the database; and
clear the flag in the database,
wherein the flag is cleared before completion of the predetermined amount of time.
10 . The computer-readable storage medium of claim 9 , wherein the text message includes a one-time password (OTP) associated with a multi-factor authentication process.
11 . The computer-readable storage medium of claim 9 , wherein, in addition to the text message being blocked, the system is further caused to:
deliver, to the user device, a replacement text message that indicates the text message has been blocked.
12 . The computer-readable storage medium of claim 9 , wherein the predetermined amount of time is determined in as a function of a risk score associated with the SIM swap.
13 . The computer-readable storage medium of claim 9 , wherein the network node includes a short message service center (SMSC), and wherein the network node is further caused to:
receive the indication that the text message is classified as secure from another network node.
14 . The computer-readable storage medium of claim 9 , wherein the text message is a short message service (SMS) message, and wherein the SMS message is associated with a short code or a 10-digit long code.
15 . The computer-readable storage medium of claim 9 , wherein the text message is received at the network node from a service delivery gateway (SDG) configured to receive application to peer (A2P) messaging.
16 . The computer-readable storage medium of claim 9 , wherein the classification of the text message as secure is based on an analysis of text of the text message using an artificial intelligence model.
17 . A telecommunications apparatus comprising:
at least one hardware processor; and
at least one non-transitory memory storing instructions, which, when executed by the at least one hardware processor, causes the apparatus to:
receive a text message from a gateway configured to receive application-to-person (A2P) messaging, the text message associated with a destination number;
send, to a database and in response to receiving the text message, a request for an indication that a flag is set in the database,
wherein the flag is associated with a subscriber identity module (SIM) swap associated with the destination number,
wherein the flag, when set, expires after a predetermined amount of time,
wherein the setting the flag in the database comprises:
determining a risk score associated with the SIM swap associated with the destination number, and
setting the flag in response to a determination that the risk score exceeds a lower threshold and does not exceed an upper threshold;
receive the indication that the flag is set in the database;
determine the text message includes a one-time password (OTP),
wherein the determination comprises analyzing text of the text message;
based on determining the text message includes the OTP, deliver a replacement text message different from the text message to a device associated with the destination number, without delivering the text message to the destination number,
receive, from a user, a message to clear the flag in the database; and
clear the flag in the database,
wherein the flag is cleared before completion of the predetermined amount of time.
18 . The apparatus of claim 17 , wherein the destination number is a Mobile Subscriber Integrated Services Digital Network (MSISDN) number.
19 . The apparatus of claim 17 , wherein the database is configured to remove the flag after a predetermined period of time has expired.
20 . The apparatus of claim 17 , wherein the determination that the text message includes the OTP comprises analyzing text of the text message using an artificial intelligence model.