Abstract: The disclosed technology is directed towards detecting suspected malicious activity involving mobile devices and subscriber identity module (SIM) cards, including discerning benign SIM swap events from likely malicious SIM swap events. In one example, call detail records, radio access network events and billing events are collected and analyzed to detect subscriber identity module swap events between mobile devices. Based on the collected data and related data sources SIM swap events are classified as benign or suspected malicious classifications. Malicious classifications can result in information representative of the suspected as malicious classification being output, e.g., as a type of fraudulent activity. A confidence level can be associated with classification output data, including for types of fraudulent activities and types of benign activities.

Abstract: The disclosed technology is directed towards detecting improbable speeds of a mobile device, which can indicate fraudulent activity with respect to the mobile device. Radio access network events and call detail records are processed to determine when a mobile device “travel jumps” between locations at improbable speeds. Events corresponding to handovers between adjacent cells are filtered out. For events corresponding to changed cell towers that are non-adjacent, further processing is performed to determine the speed of the mobile device travel between the cells. A first speed threshold is selected based on possible air travel (a cell near an airport) or a second non-air travel speed threshold is selected. If the speed of the mobile device exceeds the selected speed threshold, a travel jump is determined. Exceptions can be made for gaps in connectivity due to topography (known inconsistent reception areas) and for a mobile device shutting down and restarting.

Abstract: The disclosed technology is directed towards detecting improbable speeds of a mobile device, which can indicate fraudulent activity with respect to the mobile device. Radio access network events and call detail records are processed to determine when a mobile device “travel jumps” between locations at improbable speeds. Events corresponding to handovers between adjacent cells are filtered out. For events corresponding to changed cell towers that are non-adjacent, further processing is performed to determine the speed of the mobile device travel between the cells. A first speed threshold is selected based on possible air travel (a cell near an airport) or a second non-air travel speed threshold is selected. If the speed of the mobile device exceeds the selected speed threshold, a travel jump is determined. Exceptions can be made for gaps in connectivity due to topography (known inconsistent reception areas) and for a mobile device shutting down and restarting.

Abstract: The disclosed technology is directed towards detecting suspected malicious activity involving mobile devices and subscriber identity module (SIM) cards, including discerning benign SIM swap events from likely malicious SIM swap events. In one example, call detail records, radio access network events and billing events are collected and analyzed to detect subscriber identity module swap events between mobile devices. Based on the collected data and related data sources SIM swap events are classified as benign or suspected malicious classifications. Malicious classifications can result in information representative of the suspected as malicious classification being output, e.g., as a type of fraudulent activity. A confidence level can be associated with classification output data, including for types of fraudulent activities and types of benign activities.

Abstract: The disclosed technology is directed towards detecting improbable speeds of a mobile device, which can indicate fraudulent activity with respect to the mobile device. Radio access network events and call detail records are processed to determine when a mobile device “travel jumps” between locations at improbable speeds. Events corresponding to handovers between adjacent cells are filtered out. For events corresponding to changed cell towers that are non-adjacent, further processing is performed to determine the speed of the mobile device travel between the cells. A first speed threshold is selected based on possible air travel (a cell near an airport) or a second non-air travel speed threshold is selected. If the speed of the mobile device exceeds the selected speed threshold, a travel jump is determined. Exceptions can be made for gaps in connectivity due to topography (known inconsistent reception areas) and for a mobile device shutting down and restarting.

Abstract: The disclosed technology is directed towards detecting suspected malicious activity involving mobile devices and subscriber identity module (SIM) cards, including discerning benign SIM swap events from likely malicious SIM swap events. In one example, call detail records, radio access network events and billing events are collected and analyzed to detect subscriber identity module swap events between mobile devices. Based on the collected data and related data sources SIM swap events are classified as benign or suspected malicious classifications. Malicious classifications can result in information representative of the suspected as malicious classification being output, e.g., as a type of fraudulent activity. A confidence level can be associated with classification output data, including for types of fraudulent activities and types of benign activities.

Abstract: The disclosed technology is directed towards detecting improbable speeds of a mobile device, which can indicate fraudulent activity with respect to the mobile device. Radio access network events and call detail records are processed to determine when a mobile device “travel jumps” between locations at improbable speeds. Events corresponding to handovers between adjacent cells are filtered out. For events corresponding to changed cell towers that are non-adjacent, further processing is performed to determine the speed of the mobile device travel between the cells. A first speed threshold is selected based on possible air travel (a cell near an airport) or a second non-air travel speed threshold is selected. If the speed of the mobile device exceeds the selected speed threshold, a travel jump is determined. Exceptions can be made for gaps in connectivity due to topography (known inconsistent reception areas) and for a mobile device shutting down and restarting.

Abstract: The disclosed technology is directed towards detecting suspected malicious activity involving mobile devices and subscriber identity module (SIM) cards, including discerning benign SIM swap events from likely malicious SIM swap events. In one example, call detail records, radio access network events and billing events are collected and analyzed to detect subscriber identity module swap events between mobile devices. Based on the collected data and related data sources SIM swap events are classified as benign or suspected malicious classifications. Malicious classifications can result in information representative of the suspected as malicious classification being output, e.g., as a type of fraudulent activity. A confidence level can be associated with classification output data, including for types of fraudulent activities and types of benign activities.

Abstract: The disclosed technology is directed towards detecting improbable speeds of a mobile device, which can indicate fraudulent activity with respect to the mobile device. Radio access network events and call detail records are processed to determine when a mobile device “travel jumps” between locations at improbable speeds. Events corresponding to handovers between adjacent cells are filtered out. For events corresponding to changed cell towers that are non-adjacent, further processing is performed to determine the speed of the mobile device travel between the cells. A first speed threshold is selected based on possible air travel (a cell near an airport) or a second non-air travel speed threshold is selected. If the speed of the mobile device exceeds the selected speed threshold, a travel jump is determined. Exceptions can be made for gaps in connectivity due to topography (known inconsistent reception areas) and for a mobile device shutting down and restarting.