For the past few years, international revenue share fraud (IRSF) has been a hot topic at Equinox user groups and among telecom carriers in general. IRSF is a type of fraud that pumps traffic to international numbers with no intent to pay (unless arbitrage is possible) or that generates large numbers of calls to the number(s). While IRSF is still a problem, there is a different bane closer to home that is often overlooked. This article explores domestic arbitrage aka domestic traffic pumping and why you should not ignore this form of network abuse/fraud.
What is domestic traffic pumping? Traffic pumping is known by several names including access stimulation, arbitrage, and revenue share fraud. In years past, the most widely seen and discussed traffic pumping was IRSF. However, not all traffic pumping occurs outside the United States. In fact, a new fraud trend emerged in the U.S. several years ago. This trend involves a few local exchange carriers in rural U.S. locales bloating the incoming call volumes to their network(s) with the aim of profiting from the artificially inflated intercarrier compensation fees. This form of network abuse is termed domestic traffic pumping or domestic arbitrage. Some quipped this phenomenon as “corn and porn”.
Why is it (still) a problem? Although domestic traffic pumping is a form of fraud / network abuse, it’s often overlooked as a “real” contender. Perhaps it’s new enough on the fraud scene that it hasn’t garnered the credence it deserves. Or perhaps, folks aren’t sure exactly what to monitor or how to detect it. Even more likely though is that people discount it due to the FCC’s rule titled ‘Updating the Intercarrier Compensation Regime To Eliminate Access Arbitrage’ (Docket 2019-22447). Unfortunately, while that ruling was handed down in late 2019, compliance with its requirements has been delayed. As of this writing, no new compliance date is available. And without any consequences or penalties, there’s no incentive for those engaged in access stimulation to stop. As a result, you simply can't afford to ignore it.
How do I spot it? Domestic traffic pumping typically uses one of your customer’s line numbers and begins with a few short test calls from that number to the rural area (which is outside your customer’s typical calling area)—these first few calls are random durations and less than a minute or not answered. The hacker never even attempts to call internationally. After the ½ dozen or so test calls, an autodialer uses that billing number to repeatedly dial numbers in a range. It is often a small number range, but the calls are long (with increasingly longer durations), all to high cost (by U.S. standards) local destinations. You may very well see calls terminated by the switch because they reached the allowed maximum limits.
What can I do about domestic traffic pumping? First, don’t discount this type of fraud as a contender! We get calls asking for help with IRSF only to see examples of domestic arbitrage going for days simply because no one was looking for it. If in doubt, give us a call. We are happy to schedule an online review your system. Second, make sure your fraud management system/strategy includes checks for these events. Protector includes a standard ‘Domestic Traffic Pumping’ rule designed specifically to detect and alert you to these unwanted incidents. You can use this rule as is or edit it with different conditions. Beyond this rule, Protector’s profiling can alert you to this behavior quickly, as well. For accurate profiling, ensure your system defaults and domestic region thresholds are current and relevant. Next, knowing that hackers are adaptive, you must be vigilant and evaluate these scenarios regularly to fine tune as necessary. And finally, once you detect domestic arbitrage, add these numbers to the Hot List (or ranges of numbers to the Watch List).
