A fraud management system (FMS) in telecom is software that watches call and message records for patterns of fraud, such as hacked PBXs, revenue share fraud, SIM box bypass and SMS pumping, then alerts analysts or blocks the traffic automatically. It turns raw CDRs into cases that a fraud team can act on within minutes instead of at the end of the billing month.
What is a fraud management system in telecom?
A fraud management system is the operator's central tool for telecom fraud detection. It reads usage data (call detail records, SMS records, signalling events, top-ups and account changes), compares it with rules and with each customer's normal behaviour, and produces alerts. Analysts review the alerts as cases, confirm or dismiss them, and the system learns from the outcome. Mobile operators, wholesale carriers, CPaaS platforms and larger VoIP providers all run some form of FMS.
What fraud does an FMS detect?
An FMS detects fraud types that leave a pattern in usage data. The common ones:
| Fraud type | Typical signal in the data |
|---|---|
| International revenue share fraud | Bursts of calls to high-cost ranges, often at night, long durations |
| PBX hacking and toll fraud | A customer suddenly calling new countries with many parallel channels |
| SIM box bypass | Local SIMs making many outgoing calls, few incoming, fixed locations, no data use |
| Wangiri | Very short calls from one range to many subscribers, followed by callbacks |
| SMS pumping | OTP requests to number ranges with low conversion and rising volume |
| False answer supervision | Calls billed as answered with ringback or silence, unusual ACD on one route |
| Subscription fraud | New accounts with high usage soon after activation and no payment |
How does telecom fraud detection work?
Telecom fraud detection combines three methods, and most systems use all of them:
- Rules and thresholds. Examples: more than 20 minutes to a high-risk range within an hour, more than 10 parallel calls from an account that normally uses 2, or calls outside business hours. Rules are easy to explain and fast, but fraudsters learn to stay below them.
- Profiling. The system builds a normal profile for each account, number or route and flags deviations, such as a sudden change in destinations or spend.
- Machine learning and scoring. Models trained on confirmed cases score each event or account. Scores help rank alerts so analysts look at the riskiest first.
Data sources matter as much as the method. Many systems also use shared hot lists of high-risk number ranges, test-call results for bypass detection, and number intelligence such as HLR lookup.
Real-time vs post-call detection
Speed decides the size of the loss. A hacked PBX can generate thousands in charges within hours, so batch analysis at the end of the day is too slow.
- Post-call (near real time): the FMS reads CDRs as calls end, typically within seconds to minutes. Good enough for most patterns.
- In-call or pre-call: the softswitch, SBC or firewall checks each call before or during setup and can refuse it. Needed for high-risk destinations and long calls that build up cost before a CDR exists.
Operators usually pair the FMS with in-path controls: an SMS firewall for messaging (see SMS firewalls) and switch-level limits for voice.
How to choose a fraud management system
Choose a fraud management system by the traffic you carry and how fast it can act. Questions to ask a vendor:
- Which data feeds does it accept (CDRs from your softswitch, SMPP logs, signalling), and with what delay?
- Can it block automatically, or only alert? Can it push blocks back to your switch through an API?
- Does it include risk lists of high-cost number ranges, and how often are they updated?
- How are rules edited, and can your team tune them without the vendor?
- What is the false positive rate on traffic like yours, and how does case management work?
Smaller providers can start with the controls built into the softswitch and billing platform: credit limits, destination blocking, channel limits and spend alerts, as described in VoIP security best practices. Good CDR monitoring is the foundation either way.
Fraud controls when buying routes
Fraud on a route is a shared problem between buyer and carrier, so agree credit limits, blocked ranges and an alert contact when the route goes live. VoIPMatcher sources VoIP termination and A2P SMS routes from its carriers and manages them for you. Request a voice route and include the limits you want applied.
Frequently asked questions
What does FMS stand for in telecom?
FMS stands for fraud management system. It is software that analyses call and message records, usually in near real time, to spot traffic patterns that point to fraud, such as hacked accounts, revenue share fraud or bypass. It raises alerts, scores cases for analysts and can block numbers or accounts automatically.
What is the difference between an FMS and a firewall?
A signalling or SMS firewall sits in the traffic path and blocks individual calls or messages as they pass, based on rules. An FMS usually works on records after or during the call, looks for patterns across many events and accounts, and manages cases. Many operators use both: the firewall stops known abuse, the FMS finds new patterns.
What is the most common type of telecom fraud?
Industry surveys regularly put subscription and identity fraud, PBX hacking and international revenue share fraud near the top, along with bypass fraud in markets with high international termination rates. The mix differs by operator and region, so a fraud management system is tuned to the traffic the operator actually carries.
Do small VoIP providers need a fraud management system?
They need fraud controls, not necessarily a large FMS product. A small provider can cover most risk with per-account credit limits, destination blocking, channel limits and alerts on unusual spend in its softswitch or billing platform. A dedicated FMS becomes worth it as the number of customers, destinations and traffic grows.
Need a route?
Send the destination, route type and target rate. We reply with what we can deliver.