Fraud & revenue assurance (SS-38)

Fraud & revenue assurance — the depth.

The loss-prevention office inside the network. A telecom FMS ingests CDR-shaped events into SIM-box/bypass, IRSF, Wangiri, CLI-spoofing and subscription-anomaly detectors that raise cases in one pipeline. VoxGuard screens A2P/SMS for traffic pumping, spam, smishing/phishing, velocity bursts, sequential-MSISDN sweeps and malicious content; the VoxGuard ACM voice plane detects call-masking gateways by caller/IP convergence and profiles SDHF (short-duration-high-frequency) SIM-box behaviour. Findings flow through a real-time scoring path and a guard-railed action pipeline — block/throttle/hold, reversible, with dual-control on high-impact actions — plus a usage-to-cash revenue-assurance rollup that surfaces leakage as recoverable cases.

Every capability maps to a real method + path.

VoxGuard — A2P messaging screening

Screen an A2P message for pumping, spam, smishing, velocity and content threats; tune thresholds and keyword/premium lists per tenant; list findings and the messaging-plane RA leakage.

POST/api/v1/voxguard/screen
GET/api/v1/voxguard/config
POST/api/v1/voxguard/config
GET/api/v1/voxguard/findings
GET/api/v1/voxguard/leakage

ACM — voice anti-call-masking

Ingest a call event through the ACM detectors; read per-B-number call-masking threat assessments (caller/IP convergence), list SDHF SIM-box suspects with severity bands, and set the caller-threshold + SDHF config.

POST/api/v1/acm/calls
GET/api/v1/acm/threats
GET/api/v1/acm/sdhf
GET/api/v1/acm/config
POST/api/v1/acm/config

Telecom FMS & scoring

Ingest CDR-shaped usage into the telecom fraud detectors, set hot-destination + threshold config, and score events on the real-time hot path against rules with a spend ceiling and streaming detectors.

POST/api/v1/telecom/cdr
GET/api/v1/telecom/config
POST/api/v1/telecom/config
POST/api/v1/score
POST/api/v1/rules
PUT/api/v1/ceiling
POST/api/v1/detectors
POST/api/v1/signals
POST/api/v1/decisions/{id}/confirm

Guard-railed actions & revenue assurance

Raise reversible actions (block/throttle/hold/freeze); high-impact actions are held for a different approver (dual-control); actions can be reversed or disposed. RA reconciles usage-to-cash and opens recoveries; telecom leakage rolls up by fraud type.

POST/api/v1/actions
POST/api/v1/actions/{id}/approve
POST/api/v1/actions/{id}/reverse
POST/api/v1/actions/{id}/dispose
POST/api/v1/ra/reconcile
POST/api/v1/ra/{id}/recovery
GET/api/v1/telecom/leakage

An IRSF burst, scored and throttled

A sudden spike of calls to a premium range is scored, a throttle raised, and — being high-impact — held for a second approver.

1IngestPOST/api/v1/telecom/cdrThe softswitch feeds call events; the SIM-box/IRSF detectors light up.

2ScorePOST/api/v1/scoreThe hot path scores 0.92 with factors: IRSF premium range, velocity.

3ActPOST/api/v1/actionsA throttle action is raised against the carrier route; enforced at SS-40.

4ApprovePOST/api/v1/actions/{id}/approveHigh-impact: a different human must approve — self-approval is refused.

5RecoverGET/api/v1/telecom/leakageThe RA rollup books the prevented spend and any confirmed leakage as cases.

Where it sits in the platform.

SS-38 screens on the same plane that carries traffic: SS-40 voice and SS-18 messaging feed it events; it decides, and the control points (SS-40 routing, SS-18 send) enforce. A freeze signals SS-50 wallets over the SS-03 bus. Every action is audit-chained (ADR-0014), idempotent (ADR-0039) and tenant-scoped (ADR-0019); dual-control is enforced on high-impact.

Depends on

SS-40 voice (call events)SS-18 messaging (A2P events)SS-36 CDR facts

Feeds

SS-40 routing (enforce)SS-50 wallets (freeze)SS-45 service-desk (case)