International revenue share fraud (IRSF) is when fraudsters generate large volumes of calls to high cost international numbers whose termination revenue they share in, usually through hacked phone systems or stolen accounts. The carrier or business that originated the calls is left with the bill, so the defence is fast detection, spending limits and clear contract terms.
How IRSF works, in short
Every international call pays a termination rate to the networks that complete it. Some number ranges, often in small or remote destinations or satellite and premium services, carry high rates. In IRSF, someone obtains numbers in such ranges through a party willing to share the revenue, then pushes traffic to them from a source they do not pay for: a compromised PBX, a stolen SIP account, a SIM card, or a customer account on a platform. The calls are real and billable, so every carrier in the chain is owed money, while the end customer refuses or is unable to pay.
IRSF is consistently ranked among the costliest telecom fraud types in industry surveys such as those of the Communications Fraud Control Association (CFCA). It is often combined with PBX hacking and Wangiri callbacks.
Warning signs
- Calls to destinations the account has never called, especially at night, weekends or holidays.
- Many calls to consecutive or closely related numbers in the same range.
- Short test calls to a few numbers, followed hours later by a surge of long calls.
- Many simultaneous calls from one extension or account, often near the channel limit.
- Calls with long, uniform durations and no human pattern.
- Destinations listed as high risk in industry hot lists or in your own history.
Detection
Fraud happens in hours, so monthly reports are too slow. Analyse CDRs in near real time, ideally every few minutes, and alert on:
| Check | Example rule |
|---|---|
| Spend per account per hour | Alert when an account spends a multiple of its normal hourly amount |
| New destination | Flag first calls to a country or range the account has never used |
| High risk ranges | Hold or block calls to ranges on your risk list until reviewed |
| Concurrency | Alert when simultaneous calls exceed the account's normal peak |
| Off hours | Tighter limits outside the customer's business hours |
The data you need is described in monitoring route quality with CDRs. Commercial fraud management systems and shared industry intelligence on abused ranges add to your own rules; neither replaces looking at your own traffic.
Prevention
- Credit and spend limits: prepaid balances or daily caps per customer and per destination limit the damage. See prepaid vs postpaid terms.
- Destination controls: open only the countries each customer needs; block or require approval for high risk ranges.
- Concurrency and CPS caps per account, set close to real needs.
- Secure endpoints: strong SIP credentials, IP authentication, and the steps in the toll fraud guide.
- Know your customer: verify new accounts before giving them international access, as covered in KYC between carriers.
Contract clauses that matter
When fraud happens, the question is who pays. Wholesale agreements usually make the party that originated the traffic liable, but good contracts also cover:
- the right to block traffic immediately when fraud is suspected, without penalty;
- a duty to notify the other party quickly, with time limits;
- whether payment for traffic identified as fraudulent can be withheld or disputed, and how upstream carriers are notified so payment to the fraudulent range can be stopped along the chain;
- a shared definition of fraudulent traffic and the evidence required.
See the carrier interconnect agreement checklist for the full list of terms.
Rates far above normal on a destination in a rate deck are a useful hint of where risk sits. VoIPMatcher sources and manages wholesale VoIP termination with its carriers; tell us which destinations you need and we keep the route limited to them. Request a VoIP route.
Frequently asked questions
What is IRSF in telecom?
IRSF stands for international revenue share fraud. Fraudsters push calls to high cost international number ranges from systems or accounts they do not pay for, such as hacked PBXs or stolen SIP credentials, and share the termination revenue with whoever controls those ranges. The originating business or carrier is left with the bill.
Which destinations are most affected by IRSF?
Ranges with high termination rates are the usual targets: some small or remote countries, satellite services and premium rate numbers. The abused ranges change often, so industry hot lists and your own history are more useful than a fixed country list. Block high risk ranges by default and open them only when a customer needs them.
How is IRSF different from Wangiri?
In IRSF the fraudster generates the calls to high cost numbers, usually from a compromised system. In Wangiri the fraudster places missed calls so that victims call back the high cost numbers themselves. Both end in revenue shared from expensive international ranges, and Wangiri callbacks are one of the ways IRSF traffic is created.
Can IRSF happen on SMS?
Yes. The SMS version is usually called SMS pumping or artificially inflated traffic: bots trigger OTP or sign-up messages to number ranges whose termination revenue is shared with the fraudster. The defences are similar in spirit: country allow lists, rate limits, spend caps and monitoring the share of codes that are actually verified.
Can you recover money lost to IRSF?
Sometimes, if you act fast. Inform your provider in writing at once and share the CDRs, because carriers can occasionally stop payment for fraudulent traffic along the chain when they are told early. Recovery depends on contracts and timing, so spend limits and destination controls are far more reliable than hoping for a refund.
Need a route?
Send the destination, route type and target rate. We reply with what we can deliver.