Signaling and charging fraud
Manipulating SS7, CAMEL or Diameter messages so calls are redirected or never charged correctly. Because roaming partners trust each other's signaling, a single compromised interconnect is enough.
Research hub
Telecom fraud: how attackers monetise mobile networks
Telecom fraud is the abuse of a mobile network's signaling, charging or subscriber-management systems to steal money, services or identities. Some of it targets operators, through unbilled traffic and revenue-share schemes. Some targets subscribers, through SIM swaps and intercepted one-time passcodes. Either way, it starts in the same places that telecom security research studies.
This hub collects TelcoSec research on telecom fraud techniques, from SS7 and CAMEL signaling fraud to GTP overbilling, SIM swap fraud and state-sponsored billing fraud, with the detection and mitigation guidance in each report.
Types of telecom fraud
SIM swap and account takeover
Moving a victim's number onto an attacker-controlled SIM, through social engineering or insider access, to receive their calls and one-time passcodes and take over bank and crypto accounts.
Data session and overbilling fraud
Hijacking or injecting GTP-C sessions so another subscriber, or the operator, pays for the attacker's mobile data.
Revenue share and interconnect bypass
International Revenue Share Fraud (IRSF) pumps traffic to high-cost numbers whose revenue the fraudster shares. Wangiri one-ring calls trick victims into calling back premium ranges, and SIM boxes bypass interconnect fees on international calls.
State-sponsored billing fraud
Some espionage groups with deep operator access have also run financially motivated fraud against the same networks.
Telecom fraud research reports
- CRITICALSIM Cloning and SIM Swap AttacksTelcoSec SIM cloning and SIM swap attack analysis: physical cloning, SIMjacker remote exploitation, eSIM provisioning risks, and iSIM security architecture.
- HIGHCAMEL InitialDP Call Redirection and Charging FraudTelcoSec CAMEL/CAP exploitation guide: rogue SCP injection via InitialDP for call redirect, covert interception, and CDR charging manipulation.
- CRITICALGTP-C Tunnel Hijacking and IMSI Overbilling FraudHow forged GTP-C Create/Modify Bearer Request messages let GRX/IPX-positioned attackers hijack PDP/EPS tunnels and commit IMSI-attributed billing fraud.
- CRITICALAPT41 (Double Dragon): When State Espionage Meets Telecom Billing FraudAPT41/Double Dragon runs Beijing-directed espionage and for-profit cybercrime from the same toolset — telecom OSS/BSS billing systems are the crossover point.
- CRITICALSS7 MAP SMS Interception via UpdateLocationHow attackers abuse SS7 MAP UpdateLocation to hijack a subscriber's serving MSC/VLR, silently rerouting SMS and OTP/2FA codes to attacker infrastructure.
- CRITICALDiameter Protocol Security AnalysisTelcoSec Diameter protocol security in 4G/LTE roaming networks: DEA/DRA bypass, AVP manipulation, realm spoofing, and signaling firewall evasion techniques.
Detecting and preventing telecom fraud
- Filter signaling at the interconnect: SS7 and Diameter firewalls following GSMA FS.11 and FS.19 block MAP and Diameter messages that should never arrive from a roaming partner.
- Correlate charging records with signaling: CAMEL, GTP and Diameter charging events that do not match the subscriber's location or session state point to manipulation.
- Harden SIM change and number porting: step-up identity checks, cooling-off periods for one-time passcodes after a SIM change, and alerts to the existing SIM.
- Watch for traffic patterns: sudden spikes to premium or high-cost international ranges, short-duration call bursts and unusual roaming usage are the classic revenue-share fraud signatures.
Telecom fraud FAQ
What is telecom fraud?
Telecom fraud is the use of a telecommunications network's services, signaling or billing systems with the intent of not paying for them or of stealing from subscribers. Common forms include SIM swap fraud, signaling and charging fraud, International Revenue Share Fraud (IRSF), Wangiri callback fraud and interconnect bypass using SIM boxes.
How does SIM swap fraud work?
The attacker convinces or bribes the operator into moving the victim's phone number to a SIM card the attacker controls. From then on, calls and SMS, including one-time passcodes, go to the attacker, who uses them to reset passwords and take over financial accounts.
What is signaling fraud?
Signaling fraud abuses the protocols that set up and charge for calls and sessions, such as SS7 MAP, CAMEL, Diameter and GTP. Forged or manipulated messages can redirect calls, suppress charging or bill sessions to the wrong subscriber.
How do operators detect telecom fraud?
Operators combine signaling firewalls at the interconnect (GSMA FS.11 for SS7, FS.19 for Diameter), correlation of charging records against signaling and subscriber location, and traffic analytics that flag spikes to high-cost destinations or abnormal roaming usage.
// STAGE IV ACTIVE VALIDATION
LEARN HOW THE NETWORK IS BILLED AND ABUSED
Fraud lives in signaling and charging. The TelcoSec Academy teaches SS7, SIP and mobile core signaling from the ground up. Telecom Fundamentals is free, no card required.
START FREE [→]
SYSTEMS READY
|
LABS PROVISIONED