The Achilles Heel

Chacha Ramdin had been intrigued by how the Royal family's conversations on mobile phones were monitored and became public entertainment. And surprisingly, these tappings were done using cheap scanners by amateurs or radio-enthusiasts. Not that Chacha had any such juicy conversations to offer to the snoopers, yet he felt relieved that he used a highly-secure digital phone, unlike the analog ones used by the unfortunate Royals and also by a large population in America which has been using analog networks for almost 15 years. All other Indians used digital too, thanks to the GSM chosen by DoT!

Today's cellular bandits have devised many forms of frauds. These cellular frauds can be broadly classified into three categories: technical, subscription, and internal frauds.

TECHNICAL FRAUDS: "Cloning" of phones has been a peculiar problem faced by analog network operators. The cloned phones are programmed illegally with valid combinations of serial and identification numbers to provide access to the network—a process called "rechipping"—which identifies it as a valid subscriber who receives the bills. Fraudsters obtain Electronic Serial Numbers (ESNs) by scanning airwaves because of crude authentication system of analog networks.

GSM prevents cloning by incorporating security aspects right from inception through features like authentication, encryption, and subscriber identity. Here, serial numbers are encrypted making scanning futile and the handsets cannot operate without highly secure Subscriber Identification Module (SIM) smart-cards which are secured against reverse engineering.

SUBSCRIPTION FRAUDS: Though they seem easy to prevent, these are the ones to hit the most to the otherwise secure GSM digital operators as these networks are growing quite fast. In the quest for gaining marketshare rapidly, sometimes the identification and credit checks are not properly carried out for the subscriber who may vanish or churn after enjoying the initial free airtime or running up large bills. Cross-referencing of bad-debt subscriber lists between operators is now being successfully used by some operators in India to deter such practices. "Pre-paid" is another effective solution to prevent temptation of non-payment of the bills.

"Roaming fraud", another type of subscription fraud, is also a serious problem faced by digital networks. With just a SIM card, the subscriber moves to another network—having a roaming agreement with the home network—and runs up huge bills until credit limit is achieved, with no intention to pay. This fraud is indulged in by some of the "call sell" operators in many countries. Some operators have started using deterrent though expensive techniques, others continue to be vulnerable. In some parts of the world, Data Clearing Houses through quick Electronic Data Interchange (EDI) of roaming call records between operators besides generating high usage reports, identification of specific international codes, etc. are playing important roles in the prevention of roaming fraud. Normally call data is advised not to be more than 36 hours old to limit the damage due to this fraud.

INTERNAL FRAUDS: Frauds through collusion of internal staff/dealers, reconnection of returned SIMs, fraudulent identity documents, unauthorized access to Authentication Centre (AuC), misuse of promotional schemes, advance SIM activation, etc. can be quite expensive, if not prevented through proper systems and checks. Such action should cover SIM activation and security administration, HLR and billing reconciliation, audits of various schemes and processes, limited access to AuC, and security of pre-paid cards/coupons. It is essential to implement appropriate security procedures for the entire life-cycle of SIM cards including all data capture and encryption process and the handling and processing of the cards at the personalization centre as well as at the distribution points.

It is important that operators anticipate different forms of frauds possible in their networks and educate their employees/dealers as well as set up procedures to prevent these. A fraud management or prevention system is a must. Organizational weaknesses should be identified before the hackers do. Banks and credit card organizations may be appropriate benchmarks with a variety of red flags built into signal-suspicious transactions.

There is more and more external help becoming available in form of fraud detection packages, fraud management services, credit reference bureaus, etc. GSM MoU Association has set up a Fraud Forum to create fraud awareness and to encourage co-operation among members, promote adoption of preventive solutions like EIR and EDI, co-ordinate with relevant vendors and evaluate solutions, and identify problems and threats. Other similar organizations worth mentioning are GSM MoU Security Group and ETSI SMG 10.

For protection from cloned phones, two popular techniques used are Profiling and RF Fingerprinting. Profilers, using call records from mobile switch, create usage profile of individual subscriber. Different algorithms monitor subscriber usage focusing on call times, location, credit limits, and calling patterns. Any detectable changes indicate likely misuse. It can help prevent subscriber fraud too. For roaming fraud, another algorithm determines if it is possible for a caller to place calls from different places in a given duration. RF Fingerprinting, with the help of additional equipment at each cell site, matches the radio frequency fingerprint of an individual phone with those of good ones in the database to deny access to cloned phones. To avoid prohibitive cost in a large network, one can use such RF equipment selectively in combination with profiling.

Any fraud prevention system, at a given time, is limited by constraints in human knowledge and it may not always be possible to describe a solution to every fraud detection problem. However, some new technologies are reported to overcome such limitations. One such technology, Neural Computing, is based on biological processes of human brain: an intelligent fraud management system able to continuously learn from experience to improve fraud detection mechanism.

One cannot look at every subscriber as a crook, even though almost every crook is
likely to be a subscriber. Different situations may need different deterrent measures including legislative ones. No wonder China, with a large population of analog cellulars, has announced severe penalties of up to a death sentence for criminals involved in phone frauds.

Not that we are any less creative, but most operators tell me that there are no alarming signals yet for Chacha Ramdin to loose his sleep for!

By Niraj K.Gupta, Voice and Data, June 1997.