Abstract: In order to detect fraudulent or potentially fraudulent usage of a telecommunications network, each call connected by way of one of the digital main switching units of the network (3a to 3c) has an associated billing record transferred to a fraud management system (4). The fraud management system compares the origin and destination of the call with a known usage pattern for the originator and, if other indications are that the call is of a fraudulent nature, and the call deviates from the known usage pattern an alarm can be forwarded to an operator. The user profile used to determine normal calling behaviour is updated over a period of time in respect of calls determined as not fraudulent. An initial user profile may be generated from historic billing records.

Abstract: In order to detect fraudulent or potentially fraudulent usage of a telecommunications network, each call connected by way of one of the digital main switching units of the network (3a to 3c) has an associated billing record transferred to a fraud management system (4). The fraud management system compares the origin and destination of the call with a known usage pattern for the originator and, if other indications are that the call is of a fraudulent nature, and the call deviates from the known usage pattern an alarm can be forwarded to an operator. The user profile used to determine normal calling behaviour is updated over a period of time in respect of calls determined as not fraudulent. An initial user profile may be generated from historic billing records.

Abstract: Communication patterns over a network can be monitored by initially associating a mark with one or more entities in the communication network. Communications between each marked entity and at least one further entity can then be detected and a mark can be associated with each entity that communicates with each marked entity.