Abstract: Subscriber identity module (SIM) swap scam detection include receiving wireless network data based on passive monitoring of a wireless network; identifying a subscriber identity module, SIM, card change in user equipment, UE, based on changes in identifiers in the wireless network data; identifying a commercial user communication with the UE after the SIM card change; and detecting potentially fraudulent activity for the UE based on a combination of the SIM card change, the commercial user communication, and a time period therebetween. The steps can further include providing an alert of the potentially fraudulent activity identifying the commercial user communication as a possible SIM swap scam.

Abstract: The invention concerns a method and system for determining a mobile network operator identifier in relation to a mobile device subscriber number and a telecommunications network event, the telecommunications network event comprising a call set-up initiated by a first mobile device having an associated first mobile device subscriber number to connect to a second mobile device having a second mobile device subscriber number, the call set-up comprising sending a request to a portability server, the portability server sending a response formatted according to a predetermined format depending on a type of cellular technology. The determination comprises analyzing the response and extracting an identifier of the mobile network operator associated to the second mobile device subscriber number, and storing, in a dedicated storing structure, an association between the mobile network operator identifier and the second mobile device subscriber number of the second mobile device.

Abstract: Systems and methods include obtaining monitored traffic from an S1 interface; detecting a Secondary Radio Access Technology (RAT) Data Usage Report (DUR) in the monitored traffic; determining whether the Secondary RAT DUR relates to a 5G Non-Standard Architecture (NSA), and, if so, determining an address of a gNodeB in the Secondary RAT DUR; and storing the address of the gNodeB in a database. The systems and methods can include, for a call, updating a Call Detail Record (CDR) to reflect one of 5G NSA and 4G based on whether an address in the CDR is in the database.

Abstract: Subscriber identity module (SIM) swap scam detection include receiving wireless network data based on passive monitoring of a wireless network; identifying a subscriber identity module, SIM, card change in user equipment, UE, based on changes in identifiers in the wireless network data; identifying a commercial user communication with the UE after the SIM card change; and detecting potentially fraudulent activity for the UE based on a combination of the SIM card change, the commercial user communication, and a time period therebetween. The steps can further include providing an alert of the potentially fraudulent activity identifying the commercial user communication as a possible SIM swap scam.

Abstract: Systems and methods include obtaining monitored traffic from an S1 interface; detecting a Secondary Radio Access Technology (RAT) Data Usage Report (DUR) in the monitored traffic; determining whether the Secondary RAT DUR relates to a 5G Non-Standard Architecture (NSA), and, if so, determining an address of a gNodeB in the Secondary RAT DUR; and storing the address of the gNodeB in a database. The systems and methods can include, for a call, updating a Call Detail Record (CDR) to reflect one of 5G NSA and 4G based on whether an address in the CDR is in the database.