Telecom fraud
Serve the subscriber. Not the account thief.
SIM swaps without proper ID, numbers ported out without the PIN, and financed phones shipped to drop addresses, often through one rogue agent. Omnareth checks every swap, port-out and device order against the account before it happens, and recognizes the agent or address behind it across accounts.
| # | Event | Decision |
|---|---|---|
| 1 | Genuine SIM swap in store with photo ID | ALLOW |
| 2 | SIM swap after "security questions" only, by a rogue agent | DENY SIM_SWAP_WEAK_AUTH |
| 3 | Port-out without the PIN, same agent ▲ Repeat offender case; agent watched |
DENY PORT_NOT_AUTHORIZED |
| 4 | Five financed phones shipped to a drop address, same agent ▲ One agent across three accounts: case opened |
DENY UNVERIFIED_ADDRESS · DEVICE_LIMIT · WATCHLIST_MATCH · REPEAT_OFFENDER · AGENT_HOPPING |
| 5 | The genuine customer ports out two days after a SIM swap | FLAG RECENT_SIM_SWAP |
| 6 | Device order on a suspended account | DENY ACCOUNT_NOT_ACTIVE |
| – | Analyst confirms the agent case ▲ Agent blocked everywhere |
analyst · state |
| – | A store manager verifies the drop address | analyst · state |
| 7 | The agent orders again to the now "verified" address | DENY WATCHLIST_BLOCK · REPEAT_OFFENDER · AGENT_HOPPING |
| 8 | Genuine upgrade to the customer's own address | ALLOW |
How it fits
A check before the number moves
A SIM swap hands over a customer's calls, texts and one-time passcodes. The ring behind it reuses agents, drop addresses and port destinations. Your system sends each request to Omnareth and acts only on what it allows.
The account
Status, whether a SIM swap just happened, the addresses verified for the account and how many devices it may finance.
Swaps, ports and orders
A SIM swap needs the PIN or photo ID, a port-out needs the port PIN, and financed devices ship only to a verified address, within the limit.
One agent, many accounts
Omnareth holds the agent, drop address and port destination responsible, never the customers, and recognizes them across accounts.
Reference rules
11 rules, ready to adapt
Authorization checks fail closed, and every rule names who it holds responsible when it fires.
| Threat | What Omnareth checks | Rule code | Decision |
|---|---|---|---|
| Account Not Active | Suspended or closed accounts cannot swap SIMs, port out or order devices. | ACCOUNT_NOT_ACTIVE | DENY |
| Devices Over Limit | An order may not finance more devices than the account allows. | DEVICE_LIMIT | DENY |
| Device Shipped to Unverified Address | Financed devices ship only to an address verified for the account. | UNVERIFIED_ADDRESS | DENY |
| Port-Out Soon After SIM Swap | Flag a port-out within 72 hours of a SIM swap. | RECENT_SIM_SWAP | FLAG |
| Port-Out Not Authorized | A number may be ported out only with the correct port-out PIN. | PORT_NOT_AUTHORIZED | DENY |
| SIM Swap Without Strong Authentication | A SIM swap needs the account PIN or photo ID checked in person. | SIM_SWAP_WEAK_AUTH | DENY |
| Agent or Address Across Accounts | Flag an agent, port destination or address implicated in denials on two or more other accounts in 24 hours. | AGENT_HOPPING | FLAG |
| SIM Reuse | A SIM card belongs to one account; seen on another, it is likely in a fraudster's hands. | SIM_REUSE | FLAG |
| Repeat Offender | Flag events involving an identity implicated in two or more denied events in the last 30 days. | REPEAT_OFFENDER | FLAG |
| Blocked Identity | Identities blocked on the fraud watchlist may not take part in any subscriber event. | WATCHLIST_BLOCK | DENY |
| Watched Identity | Identities under watch may proceed only with a flag for review. | WATCHLIST_MATCH | FLAG |
The insider case
Address verified. Still not shipped.
After the analyst confirms the case, a store manager verifies the drop address on the account. The agent's next order passes every account check. Omnareth refuses it on the watchlist, and the audit record shows the block it acted on.
Victims are not suspects
Only the identities a rule implicates are held responsible. Genuine customers named in a fraud attempt are never counted against.
Policy as rules
Your checks run on every request, with the reason and a remediation step recorded.
For auditors and regulators
Every refused request is sealed with what was known at the time, and verifiable later.
Adapt the model
The Subscriber model, its rules and its fraud identifiers are plain JSON you can change.
Pilot program
Put telecom fraud prevention to work in 90 days
One lane, facility or process, in shadow mode, with results measured against criteria we agree with you. Qualified companies and organizations can apply.