Stop interconnect, usage, dealer and insider loss while the traffic is still running.
True Guard Vision evaluates every event your network already produces — voice, SMS, data, roaming, rated charges, subscriptions, dealer and employee actions — against the rules and hotlists your fraud team owns, and returns an explainable decision in the same request.
Why mobile fraud needs event-time decisions
The network carries the call in seconds. The cost appears later — in TAP files, interconnect invoices, unpaid bills, and month-end commissions. Fraud that understands that lag wins unless detection runs on the traffic itself.
Decision Tempo
Rules see the call, SMS, or adjustment as it arrives
Per-Actor Memory
MSISDN, B-number, IMEI, dealer, employee
List Updates
IRSF ranges and hotlists effective immediately
Beyond Totals
International share, distinct ratios, velocity
20 patterns in 6 families
The starter catalog your analysts extend. Thresholds are tuned with your team during the POC — your lists, your segments, your policy.
Subscription & Identity
Blacklist re-entry, one identity with many lines, never-pay first-bill default, SIM-swap followed by monetization.
At activation + first usageToll & Termination
International revenue-share pumping, domestic premium abuse, PBX hacking, artificial traffic inflation.
Minutes to hoursCallback, Resale & Spam
Wangiri missed-call lures, international resale and call selling, SMS spam and grey-route abuse.
Current hourBypass & Roaming
SIM-box gateways, CLI refiling fingerprints, roaming overrun and bill shock for the control desk.
Hourly; bypass via correlatorDealer & Distribution
Collection bursts and same-card abuse, fictitious activation and churn-and-reactivate, handset subsidy abuse.
Minutes to dailyInternal, Device & Prepaid
Insider adjustments, test-line abuse, one device with many lines, recharge and voucher abuse.
Current hourYour network stays. Your policy moves faster.
Mediation, rating, CRM, and the switch stay. Barring and hotlining stay in your control systems — we hand them a decision they can act on.
Events, not file formats
Twelve stable events cover voice, SMS, data, roaming, interconnect, rated usage, adjustments, top-ups, subscriptions, dealer and employee actions. A new vendor means a mapping, not a new rulebook.
Actors investigators use
MSISDN, A/B-number, IMSI, IMEI, national ID, dealer, employee, trunk. One event updates several actors at once.
What IT provides
- Normalized events over HTTPS with named fields
- Reference lists you already keep
- Payment or credit-limit attributes where in scope
- A decision consumer — queue first, control APIs when ready
Named phase-2 items
Bypass and CLI-mismatch need a join of interconnect and terminating legs. Year-scale baselines arrive as nightly profile writes. Both are scoped openly — never hidden assumptions.
A 4–6 week proof on your cases
Judged on your closed IRSF, wangiri, and SIM-box cases — not on vendor demo data.
Week 1 · Events
Agree 3–5 events and fields — typically voice, SMS, rated usage plus one of roaming, dealer, or adjustments — and connect starter lists.
Weeks 2–3 · Rules
Load starter rules with your thresholds. Replay confirmed cases. Tune segments and exclusions with your analysts.
Weeks 3–5 · Live queue
Run alongside the current system. Track recall, time-to-detect, and false-positive reasons daily.
Minimum data checklist
- Voice CDR with A/B-number, duration, direction, cell
- SMS CDR with sender and destination
- Rated usage with charge, tariff, tenure
- One of roaming, dealer, or adjustment feeds
- IRSF, hot-number, test-line, and exclusion lists