Technical information

Detecting Toll Fraud
Issue 7 June 2001
4-53
Review CDR/SMDR records for the following symptoms of abuse:
 Short holding times on one trunk group
 Patterns of authorization code usage (same code used simultaneously or
high activity)
 Calls to international locations not normal for your business
 Calls to suspicious destinations
 High numbers of “ineffective call attempts” indicating attempts at entering
invalid barrier codes or authorization codes
 Numerous calls to the same number
 Undefined account codes
For DEFINITY G1 and System 75:
 To display the Features-Related System Parameters screen, use the
change system-parameters feature (G1 and System 75 only) or the
change-system parameters cdr feature (G3 only).
 Administer the appropriate format to collect the most information. The
format depends on the capabilities of your CDR analyzing/recording
device.
 Use change trunk-group to display the Trunk Group screen.
 Enter y in the SMDR/CDR Reports field.
For DEFINITY G2:
 Use PROC275 WORD1 FIELD14 to turn on CDR for incoming calls.
 Use PROC101 WORD1 FIELD8 to specify the trunk groups. Account code
entry can be required for CDR (see ‘‘Require Account Codes’’ on page
4-45 for details).
Traffic Measurements and Performance
By tracking traffic measurements on the trunk groups, you can watch for
unexplained increases in call volume, particularly during off-peak hours. Review
the traffic measurements for the following symptoms of abuse:
 Unusually high peg counts (number of times accessed) on trunk groups
 A series of short or long holding times that may indicate repeated attempts
to enter the system and/or success in doing so
 High volume on WCR patterns used for 0 + and 011 + calls
 Busiest hour for trunk group being inconsistent with business hours
 Drastic changes in switch occupancy profile compared to a typical 24-hour
period