While working on fraud detection and prevention for a number of VoIP providers, I came across a rarely detected, yet creative type of fraud. It is called BYE delay fraud . Let's see what a regular SIP message exchange looks like when we have four VoIP carriers in chain: What is shown above is a typical (yet somewhat simplified) view of SIP traffic exchange within a chain of four carriers. The messages are chronologically sorted so that the first message appears on the top of the diagram and the last message at the bottom. There are two significant moments for this call: t0 - time when the call is answered: the moment we consider the starting time when measuring the duration of the call t1 - time when the call has ended (hangup by callee): the moment we consider the ending time when measuring the duration of the call So if we say that t0 = 3sec t1 = 45sec The duration of the call is 45-3 = 42sec. Since the OK and BYE messages are forwarded between all four providers ...