Of the three sets of global analysis, the category of home countries struck by ... South Africa, South Korea and China d
Understanding the Global Threat of Mobile Fraud, Part 2 The Communications Fraud Control Association (CFCA) periodically conducts a survey of communications fraud around the world, and the latest survey revealed that fraud now amounts to 1.7 percent of annual revenue in the communications industry. One area in particular in the survey that was identified as being specifically vulnerable to fraud was roaming. To shed more light on this roaming fraud, Syniverse launched a report series this year to explore roaming fraud trends using Syniverse’s fraud protection database, which collects fraud data originating from over 180 countries.* The findings below represent the second part in this series and provide further insight on fraud alerts from the period of Nov. 1, 2015, to Oct. 31, 2016. These findings include an interim analysis of our first report period, covering July 1, 2015, to June 30, 2016, to enable a comparison. Additionally, in this second installment of the report series, the data has been updated with the addition of sections including the top 10 countries struck by fraud, a regional overview of where fraud originates, and an analysis of countries with high-incident rates.
How Fraud Alerts Vary through the Year The data uncovered how fraud attacks differ for each month of the year.
Monthly Volumes for 2013, 2014 and 2015 2500
2013
2014
2015
Although seasonal trends may be expected to be seen during each year, the seasonal variance is limited since the data represents all regions of the world.
2000
1500
The implication of this finding is that sustained levels of vigilance are required through all 12 months of the year.
1000
500
n
b
Ja
Fe
ril
ch
ar
M
ay
Ap
M
ly
ne
Ju
Ju
ct
p
g
Se
Au
O
c
v
De
No
When Fraudsters Strike The data revealed that the peak time for fraud alerts is on weekends.
Daily Volumes for 2013, 2014 and 2015 4000 2013
2014
2015
3500
Annual data confirms the trend in the first report: fraud attacks vary across weekdays but peak on weekends. (In certain parts of the world, the weekend is considered to start on Friday.)
3000 2500 2000 1500
y
da
on
M
y
da
es
Tu
W
y
da
es
n ed
y
da
us
r Th
ay
id
Fr
ay
rd
tu
Sa
ay
nd
Su
*All the numbers have been aggregated to ensure anonymity and protect the data privacy of Syniverse customers. Data is based on the Syniverse Roaming Fraud Service.
Analysis of Top 10 Fraud Locations Roaming appeals to fraudsters because of the multiple locations involved. These serve to both camouflage fraud incidents and extend the duration of fraud incidents by exploiting the time lag involved with the exchange of records between operators. To shed light on this, in this section we rank the countries according to number of fraud cases based on the following: The home country or origin of the SIM card; the originating country from which the calls originate with those SIMs; and the terminating country in which the fraud calls terminate. (In the graphs below, the colored bars represent fraud alerts for our latest report, covering Nov. 1, 2015, to Oct. 31, 2016; and the gray bars represent fraud alerts for our interim analysis, covering July 1, 2015, to June 30, 2016. The ranking from the interim analysis is indicated in parentheses. “NR” means “not ranked.”)
Top 10 Home Countries Struck by Fraud (Home Public Mobile Networks) Top Countries by Percent of Case Volume 30% 25% 20% 15% 10% 5% 0%
) ) ) ) ) ) ) 1) 3) 2) (5 (4 a (7 (8 NR NR NR il ( .K. ( co ( n li an ai ica ( rea( gola na ( U exi p st stra i i r S o M An Ch an Au Af h K h gh ut ut Af So So
az
Br
Of the three sets of global analysis, the category of home countries struck by fraud is the least consistent. Only seven of the top 10 countries for the year ending in October 2016 (blue bars) remain the same since our previous analysis, which was for the year ending June 2016 (gray bars). South Africa, South Korea and China did not appear previously, and together they account for over 6 percent of volume. Although this is a relatively low volume, it does imply that it is ill-advised to always concentrate on the usual suspects. Fraudsters will deliberately alter the pattern of their activity to continue their operations.
Top 10 Countries Where Fraud Originates (Visited Public Mobile Networks) Top Countries by Percent of Case Volume 12% 10% 8% 6% 4% 2% 0%
S.
U.
(1)
) ) ) ) ) ) R) (10) (6) (7 (3 (2 (4 (9 NR (N ia ru rg il an ce ( taly a ss az d I st Pe bou i n a Br Ru en Fra m an e m C x k Lu Tur
in
a Sp
The U.S. and Spain have consistently appeared in the top 10, and for this reason we cover them in more detail in the high-incident countries section of this report. In total, they represent almost 20 percent of originating volumes. In fact, nine of the top 10 are unchanged, which suggests that these are locations at which fraudsters find it especially appealing to originate calls.
Top 10 Countries Where Fraud Terminates Top Countries by Percent of Case Volume 25% 20% 15% 10% 5% 0%
ba
Cu
(1)
sia
T
i un
)
(2
m
So
ia
al
)
(5
via
t La
)
) ) ) ) ) ) (3 (10 (6 (9 (8 o(7 sia ria Iran had ong tan s e i C C an g Al gh Af
(4
s Ru
Cuba consistently appears in the top 10 and is widely reported as a hotspot for fraud termination because of the higher cost of calls terminating in Cuba. It is covered in more detail in the high-incident countries section of this report. Preventing all fraud terminating in Cuba would be a significant benefit to operators. Destinations for termination exhibit the most constant pattern, with the top 10 remaining the same. These top 10 countries account for almost half of all fraud termination volumes.
Where Fraud Originates: A Regional Analysis In this section of the report, we analyze regional variations in the top 10 countries from which fraud is originating.
Home Country (HPMN)
Africa The majority of fraud originating through African HPMNs occurs within Africa itself.
Originating Country (VPMN) 20% 15% 10%
A notable exception to this is Brazil, which uniquely appears as an originating country for African-based SIMs.
5% 0%
The only incidence of Cuba appearing as an originating country is in association with African HPMNs.
il
az
Br
t
yp
Eg
l t da go uba and bon ga as l an Co ene Con C er Ga Ug ory S itz Iv Sw
a
bi
m
Za
60%
North America Over 50 percent of the volume associated with the U.S. suggests that fraudsters may exploit the national roaming that is prevalent in this country to perpetrate roaming fraud, but without having to cross an international border.
50% 40% 30% 20% 10% 0%
As with Africa and Cuba, this region has a tie to a unique originating country, Pakistan.
South America Most of the data for the region relates to Brazil, Colombia, Ecuador, Paraguay, Chile, Argentina and Peru.
S.
U.
Lu
15% 10% 5% 0%
ru
Pe
. y a o sia ly ivia ep bi ua ium ic l . R lom rag elg Mex Rus Bo m a o B o P C D
g
ur
bo
Ita
m
xe
Lu
Despite its high position as an originating country, Spain was not ranked in many other regional summaries, and it is ranked second as an originating source with subscribers visiting from Asia.
m xe
20%
Brazil and Colombia share their borders with Peru and contribute uniquely to the high proportion of fraud originating there. Accordingly, it seems that camouflaging fraud in the roaming context, without having to travel too far, regularly attracts perpetrators.
Asia
. r y a n g an ep Ital orea ige ai ur t ric N Sp K bo akis Af m. R h h t t P o u u D So So
da
na
Ca
35% 30% 25% 20% 15% 10% 5% 0%
an
ist
m
rk
Tu
en
n
ai
Sp
. ia ar ce A.E rea tan ina ce at ee an Ch Q U. h Ko jikis Fr Gr t Ta u o S
ss
Ru
25%
Europe
20%
The findings for Europe show a surprising mix of destinations, both representative of and contrary to general travel patterns in the region.
10%
Unsurprisingly, Spain ranks as number one and accounts for a large amount of fraud within Europe.
15%
5% 0%
n
ai
Sp
ce
an
Fr
So
h ut
e a a a o o g d pi re ur ec cc ng ric an Ko thio bo Af zerl Gre oro Co h m t E M t i e u x Sw So Lu
Analysis of High-Incident Countries Over the course of this report series, the U.S. and Spain have ranked highly as countries where fraud originates, and Cuba as a destination where fraud terminates. The following charts look at the makeup of traffic driving fraud in these locations.
Home Country
Originating Country
Terminating Country
United States: Originating Fraud Incidents
Just under 80 percent of SIMs involved with fraud originating in the U.S. are from Mexico. Almost 75 percent of the traffic originating through these SIMs terminates in Cuba. 80%
100% 80%
60%
60% 40% 40% 20%
20% 0%
Mexico
Brazil
Dom. Rep.
U.K.
0%
Australia
Cuba
Somalia
Sudan
Chile
U.S.
Spain: Originating Fraud Incidents
The majority (57 percent) of fraud in Spain is perpetrated by SIM cards from the U.K. There is a high incidence of fraud associated with visitors from the U.K. in Spain. However, the U.K. frequently gets listed as a source of fraud because of the way in which some U.K. number ranges are used. 80%
10%
60% 40%
5%
20% 0%
0% U.K.
South Korea
Australia
China
Algeria
Switzerland
Morocco
Ecuador
Belarus
Equat. Guinea
Cuba: Terminating Fraud Incidents
A large amount of the fraudulent traffic coming into Cuba originates from Mexican SIMs in the U.S. 50%
40%
40%
30%
30% 20%
20%
10%
10% 0% Mexico
Brazil
U.K.
Poland
Australia
0%
U.S.
Canada
Peru
Ethiopia
Dom. Rep.
For more information, please visit www.syniverse.com/products-services/mobile-protection.
