Incoming traffic is routed through a dishonest carrier

Terminates traffic on an inappropriate trunk

Fraudulent carrier

Incoming trunk - MNO, traffic aggregator, international gateway

Changing the CLI- hide the real origin of a call

Tries to avoid detection

Incur charges at a lower rate

use virtually any CLI to refile the calls

A changed, absent CLI

Unusual call records trends

Incoming international trunks

Non-roaming customers

Based on the incoming trunk of the calls

Incorrect and Changed CLI

Matching the test call CDR with the network CDR

high-risk routes

Patterns in customer complaints

Call quality indicators (refiling is often linked to lower call quality)

Social network analysis (call origination and termination patterns)

Validity of A-numbers vs. expectation and national numbering plans

Call trunk, carrier and country analyses

Originating networks/countries, potentially using lower cost carriers

Call records provided by a call originator vs. call records of the same calls being terminated.

Belongs an operator's numbering plan

a short code, partial CLI or other