BYE delay fraud

While working on fraud detection and prevention for a number of VoIP providers, I came across a rarely detected, yet creative type of fraud. It is called BYE delay fraud.

Let's see what a regular SIP message exchange looks like when we have four VoIP carriers in chain:


What is shown above is a typical (yet somewhat simplified) view of SIP traffic exchange within a chain of four carriers. The messages are chronologically sorted so that the first message appears on the top of the diagram and the last message at the bottom. There are two significant moments for this call:
t0 - time when the call is answered: the moment we consider the starting time when measuring the duration of the call
t1 - time when the call has ended (hangup by callee): the moment we consider the ending time when measuring the duration of the call

So if we say that
t0 = 3sec
t1 = 45sec
The duration of the call is 45-3 = 42sec.

Since the OK and BYE messages are forwarded between all four providers almost instantly (meaning t0 and t1 are practically the same for all providers), every provider will consider the call duration was 42sec and charge the previous (originating) provider in the chain accordingly.

Let's analyze the diagram:


  1. Our customer initiates a call (by sending SIP INVITE message to us)
  2. We route the call to our vendor (by sending SIP INVITE to our vendor)
  3. Our vendor routes the call to a vendor of his own (also sending INVITE)
  4. Vendor's vendor replies with SIP 180 RINGING
  5. Our vendor sends us the same message (180 RINGING)
  6. We send our customer 180 RINGING, so now the caller hears ringing tone, waiting for the called party to answer
  7. At t0 time (which is practically the same for all parties) the call is considered established
  8. The call is in progress
  9. At t1 time, the callee hangs up, and the BYE message gets it's way to the customer.
  10. All four providers make a record of the call with duration of 42 seconds.
  11. For this call, every provider charges the previous provider in chain (the originator). The cost is calculated like (duration X price_per_minute)


So this is an example of a regular situation. Everybody is happy, every provider made some money on that call, no fraudulent activities here.

Now, let's assume our vendor gets nasty and wants to extract some extra money by charging us (you) more than he should. What he can do is setup a specially designed SIP routing device (or reconfigure it's own softswitch if possible), so that the BYE message is not transferred to the previous provider instantly! Let's take a look how would the previously shown SIP message exchange diagram look like in that case:


Now we have three significant moments to consider:

t0 - time when the call is answered: the moment we consider the starting time when measuring the duration of the call
t1 - time when the call has ended because the callee hung up - in this scenario the BYE message at time t1 is visible only to our vendor and our vendor's vendor
t2 - time when the caller has hung up - in this scenario the BYE message at t2 is visible only to our customer, by us and by our vendor

So if we say that
t0 = 3sec
t1 = 45sec
t2 = 59sec

Before we calculate the duration of the call, let's analyze what happened here. The call started at t0, all providers are aware of that. The call is terminated by the callee at t1, but since our nasty vendor did not forward the BYE message, our softswitch (and also our customer's one) consider the call still active! The caller does not hear anything (or in some more advanced cases of such type of fraud gets a playback of some message luring him to keep the line open as long as possible). At t2, the caller realizes that something is wrong and hangs up. Customer sends us BYE, we forward the BYE message to out vendor.

To make it more clear I'll list all the events like i did in the non-fraud scenario:

  1. Our customer initiates a call (by sending SIP INVITE message to us)
  2. We route the call to our vendor (by sending SIP INVITE to our vendor)
  3. Our vendor routes the call to a vendor of his own (also sending INVITE)
  4. Vendor's vendor replies with SIP 180 RINGING
  5. Our vendor sends us the same message (180 RINGING)
  6. We send our customer 180 RINGING, so now the caller hears ringing tone, waiting for the called party to answer
  7. At t0 time (which is practically the same for all parties) the call is considered established
  8. The call is in progress
  9. At t1 time, the callee hangs up, and the BYE message gets to our vendor.
  10. Our vendor does not forward BYE message to us, leaving our softswitch thinking that the call is still active
  11. Not knowing that the call has ended, we don't send BYE to our customer either
  12. At t2 time the caller hangs up, and our customer sends us BYE, which we instantly forward to our vendor
  13. The duration of the call now differs for different providers!
  14. For this call, every provider charges the previous provider in chain (the originator). The cost is calculated like (duration X price_per_minute)
Now, let's calculate the duration of the call as seen from each provider:

Customer: t2 - t0 = 59-3 = 56 sec
We: t2 - t0 = 59-3 = 56 sec
Our vendor: t1 - t0 - 45-3 = 42 sec
Vendor's vendor: t1 - t0 - 45-3 = 42 sec

See the point? For a single call, not all providers in the chain are charged for the same duration! Actually, our nasty vendor charged us 14 seconds more than it should have! What's more, our vendor gets charged for only 42 seconds, so all the added value from the 14 seconds he keeps for himself, because his vendor (vendor's vendor) considers the call duration also 42 seconds!

Who is at the greatest loss here? We are obviously not, because we got charged 56 seconds from our vendor, and we charge our customer 56 seconds. We (as a link in the chain) are actually profiting from this, not even knowing what's going on. The one who pays the additional 14 seconds is the poor guy at the very beginning of the chain, probably some retail end-user.

This kind of fraud is extremely hard to detect, and what's more concerning, there is actually no interest by any provider in the chain to fight this kind of fraud because everyone profits from it.
The only ones who, I can imagine, could have interest in fighting BYE delay fraud are actually end-users, retail customers, especially call centers.

If you are running a call center or are a large retail customer, I would recommend periodic testing to ensure that you don't fall victim for this kind of fraud.

Comments

Post a Comment

Popular posts from this blog

Starting a VoIP wholesale business

Starting a VoIP wholesale (or retail for that matter) business can be a demanding endeavour. At first it seems straight-forward: you buy (or rent) a softswitch, organize your NOC (Network Operation Center), connect your equipment to your partners and you are ready to start routing voice traffic buying at one price and sell it at a higher price, achieving profit. Seems simple and, at the end, it is. However, I'd like to share with you my knowledge to give you an impression what starting and running such a business implies. As soon as you start putting things together and start to organise and plan your business operations, you realise that the devil is in the details, be it technical, organisational, financial, legal or other. Your effort heavily depends of your prior knowledge of how everything works in the VoIP wholesale realm. A fantastic fact in this business is that not a single operational process is physically bound to any geographic location. You can setup a company in...
Read more

PDD - Pre Dial Delay

PDD, or Pre Dial Delay, is a measure of the time it takes for a Voice over Internet Protocol (VoIP) call to be established after a user initiates the call. It is the time elapsed between when the user dials the phone number and when the first provisioning response is received. A good quality VoIP route should have a PDD of less than five seconds. This means that the call should be connected within five seconds of the user dialing the phone number. The PDD is an important metric for VoIP service providers because it impacts the user experience. If the PDD is too high, it can cause frustration for users who have to wait a long time for their calls to be connected. On the other hand, a low PDD ensures that calls are connected quickly and efficiently, which can improve the overall user experience. There are a number of factors that can affect the PDD of a VoIP route, including the quality of the Internet connection, the hardware and software being used, and the routing of the call through ...
Read more

Setting up a SIP interconnection

When you run a VoIP wholesale business, one of your regular tasks is to setup interconnections with your partners , be it vendors (providing termination services) or customers (originating the voice calls). These interconnections are used to send and receive voice traffic between VoIP companies . Nowadays the interconnections between VoIP carriers are based on the SIP  (Session Initiation Protocol). While I'll not be explaining the SIP internals within this post (I'll do it in a separate post), I'll try to briefly describe what happens in a typical scenario when two VoIP wholesale providers establish a SIP interconnection between their softswitches. So a typical workflow would be like this (in this example our/your company is establishing interconnection with a vendor so that we can send voice traffic to them): Our sales rep closes a deal with a partner (let's call him VoipN), they agree the prices and destinations that VoipN will accept voice traffic to (let'...
Read more