FAS, CLI manipulation and fraud detection

Fraud in wholesale VoIP rarely looks dramatic. It hides inside normal-looking traffic: calls that seem answered but never were, caller IDs that quietly change, or a sudden burst of calls to an expensive destination in the middle of the night. This lesson covers the three areas a wholesale NOC deals with most: False Answer Supervision (FAS), CLI manipulation, and traffic-pumping or hacking fraud.

Part 1 – False Answer Supervision (FAS)

What it is

In SIP, a 200 OK to the INVITE means “the called party answered” and starts billing. With FAS, some network in the chain sends that answer signal even though nobody really answered. The caller might keep hearing ringing, hear silence, or hear a recording, while every second is billed.

Typical patterns

• Early answer: 200 OK arrives with no 180/183 before it, or unusually soon after the INVITE.
• Ringback after answer: the audio after 200 OK still sounds like a ringing tone.
• Recorded or repeated audio: the same clip appears on calls to different numbers.
• Duration patterns: many answered calls ending at similar short durations, or calls answered for numbers that are known to be unreachable.
• KPI pattern: ASR noticeably higher than other vendors for the same destination, combined with low or oddly uniform ACD.

How to detect it

1. Signalling checks on every call: presence and order of 18x before 200, and time from INVITE to answer.
2. Audio checks: detect ringback tones after answer, long silence, and identical audio across different calls.
3. Statistical checks per route: ASR and ACD compared with other vendors for the same destination, and call-duration distribution.
4. Controlled test calls to numbers whose behaviour you know.

Summarise each route with a simple verdict — for example CLEAN, MIXED or FAS — and always store the reason and example calls. The blog article What is FAS? explains these steps in more detail.

How to respond

• Reduce or stop traffic on the affected route for that destination.
• Send the vendor specific examples: Call-IDs, times, numbers (masked if needed), SIP traces and recordings.
• Follow the dispute process in your interconnect agreement.
• Re-test before restoring traffic.

Part 2 – CLI manipulation

On a CLI route, the caller’s number should reach the destination unchanged. Problems include:

• CLI replacement: the vendor (or someone further down) swaps your caller ID for a different number, often because the call is being sent over a cheaper, non-CLI path.
• CLI removal: the number is hidden or not delivered.
• Format changes: the number arrives in a different format, which may stop the recipient’s phone matching it to a contact.

Detecting CLI changes

• Make regular test calls to handsets you control at the destination and compare the displayed number with the one you sent.
• Where you have visibility of the far end, compare the caller-ID headers in SIP (From, P-Asserted-Identity) at each hop.
• Use tools that flag CLI/ANI changes automatically on live traffic.
• Watch customer complaints that recipients do not recognise the caller.

Also make sure your traffic is clean: only pass caller IDs your customers are entitled to use, and follow the caller-ID rules of each destination. Many regulators have specific requirements.

Part 3 – Traffic pumping and hacked accounts

Another common loss comes from fraudulent traffic: compromised PBXs or customer accounts used to send large volumes of calls to expensive destinations, often at night or at weekends when fewer people are watching. The fraudster profits from revenue share on those destinations; the carrier that cannot collect payment is left with the vendor bill.

Warning signs

• A sudden spike in calls from one customer, especially to destinations they do not normally call.
• Many simultaneous calls to sequential numbers in one range.
• Traffic outside the customer’s normal working hours.
• New or unusual source IP addresses on a customer’s account.
• Many short calls, or many calls of very similar duration.

Controls that limit damage

• Concurrent-call and spending limits on every customer account.
• Prepaid billing for new customers.
• Blocking or requiring approval for high-risk destinations a customer has not asked for.
• Alerts on spend or call volume compared with the customer’s normal pattern.
• Strict IP whitelists and strong credentials (see Lesson 10).

Building a fraud-aware routine

1. Review fraud and FAS alerts at the start of every shift.
2. Check the top destinations and customers by spend compared with the previous day.
3. Investigate any new destination with sudden volume.
4. Keep a log of incidents, the evidence gathered and the action taken.
5. Review limits on customer accounts periodically.

VoxInspector automates FAS verdicts with reasons, keeps a suspect number list with recording playback, and flags CLI/ANI changes on live traffic.

Examples in this course use invented names (Vendor X, Customer Y, Country Z) and documentation IP ranges. Menu names and options differ between softswitch versions; always check your own system and vendor documentation.