International premium rate number market

The presence of many premium rate number service providers competing with attractive payouts and easy terms makes the business model for IRSF fraud lucrative and easy to implement.

International Reveune Sharing Fraud ecosystem

International Revenue Sharing Fraud (IRSF), also known as traffic pumping fraud, telecom fraud or toll fraud, totals billions of dollars each year. The critical financial incentive driving this criminal activity is the payout fraudsters receive from generating bogus phone calls to international premium rate numbers.

This white paper explains the flow of dollars from the telecom fraud victim, through the network of telephone carriers, to the premium rate number provider and finally to the fraudster. More importantly, this study of 121 international premium rate number providers reveals a robust and competitive global market of premium rate number suppliers.

What Is International Revenue Sharing Fraud (IRSF)?

IRSF fraud is perpetrated by using someone else’s phone service to make unauthorized calls to a high cost telephone number, typically an international premium rate number. The victim receives a huge telephone bill for the unauthorized calls and the fraudster collects a payout from the company that owns the premium rate number.

The Communications Fraud Control Association claims that traffic pumping fraud costs victims an estimated $4.73 billion each year worldwide.¹ The victims range from individuals who have his or her cell phone stolen while traveling, to small and large businesses. Small businesses that typically have poorly secured phone systems are a common target for IRSF fraud. Here are three examples that illustrate how dangerous IRSF can be for small businesses:

Foreman Seeley Fountain, a seven-person architectural firm located in Atlanta, GA, received a bill for $166,000 in charges resulting from a hack of their four analog telephone lines. Based on the company’s regular calling pattern, it would have taken approximately 35 years to use $166,000 of telephone service.²
A small doctor’s office located in Maryland became victims of telephony fraud after their automated voicemail system was hacked to place a large number of calls to high cost destinations. The attack occurred when the office was closed over the weekend and resulted in a $2 million phone bill.³
A ReMax real estate office in St. Petersburg, Florida received a $600,000 phone bill when their AT&T phone system was hacked to generate over 2,000 international long distance calls to Somalia, Guinea, and Azerbaijan. The fraudulent calls took place on a Saturday when only one employee was in the office.⁴

How IRSF works

The following diagram describes the IRSF call flow and the money flow. This example illustrates the common PBX hacking fraud attack, but IRSF call flows can be perpetrated in many other ways. The money flows, however, are the same in all attacks.

IRSF call flow

A fraudster hacks into an enterprise’s vulnerable PBX.
The fraudster then uses the enterprise’s PBX to make calls to premium rate numbers. The victim has the financial liability for these fraudulent calls and is obligated to pay its service provider.
The service provider completes the international call to its wholesale international carrier. The service provider is obligated to pay the wholesale carrier for the calls. Once the call is handed off to an international carrier, it is likely that the call will traverse multiple carriers before being delivered to the premium rate number provider. Each carrier collects a share of the revenue and the premium rate number provider receives a fee for completing the call.
In the final step, the premium rate service provider shares part of its revenue with the fraudster who generated the calls. Fraudsters receive a revenue share (kickback) for calls they make to premium rate numbers. For more information on IRSF and descriptions on different types of telecom fraud schemes, download the TransNexus Telecom Fraud Guide whitepaper.

Survey description

The goal of this study was to gain a better understanding about premium rate number providers. Who are they? What is their business profile? Over the past year, TransNexus contacted 121 premium rate number service providers to gather information about who they are, the services and number ranges they provide, and the payout rates they offer.

Generic profile of premium rate service providers

From the survey data collected, a common profile emerges for the typical premium rate service provider. The typical provider appears very small, perhaps, just a few employees. The market is fluid, with multiple providers disappearing and new providers emerging during the months of this study. Many firms appear to be virtual firms with no disclosed location or telephone contact, only communication by anonymous email accounts such as Gmail. Competition among premium rate number service providers appears high. As a commodity service, the primary differences between service providers are the payout rate and how quickly and conveniently funds are remitted.

Geographic distribution of premium rate service providers

Premium rate number providers can be located anywhere. However, the UK, is clearly the global leader. It is home to 43% of the 74 providers that disclose their location. After the US, which has the second highest concentration of firms, the geographic dispersion of firms is widespread among European countries (large and small) and a diverse collection of developing countries. The most telling statistic is that 39% of all firms surveyed do not openly disclose their location.

Geographic distribution of premium rate service providers

georgraphic distribution of premium rate service providers

Payout rates per minute

This survey collected 8,642 different payout rates for premium rate numbers in 193 countries. The payout rate varies widely based on three factors: the country being called, the billing period and the waiting period to receive funds after the billing period. The lowest payout rate is $0.00013 for calls to Ireland and the highest is $2.325 for calls to the UK. However, most payout rates are close to the average payout rate of $0.094 per minute. The following histogram shows the distribution of payout rates. 53% of all payout rates are between $0.05 and $0.15. The sample bucket on the far right of the histogram shows the count of all payout rates greater than $0.50. Readers should note that these payout rates are the amount remitted to fraudsters. The amount billed to retail fraud victims will typically be three to five times greater than the payout rates in this study.

Payout rates per minute

Top Destinations for Premium Rate Numbers

This section presents the top destinations (country codes) for IRSF risk. Factors that indicate high risk destinations are high payout rates and a large number of service providers actively selling premium rate numbers.

By average payout

The following list presents the top fifteen destinations in terms of average payout per minute. This list is dominated by satellite service providers. Country code 870 is for maritime services and codes 881 and 882 are for global mobile satellite services.

premium rate destinations by average payout

By highest payout

The range in payout per minute can vary widely by country. The UK, Austria and Estonia standout with very high payouts and contradict the common assumption that IRSF is predominantly a problem with calls to developing countries.

premium rate destinations by highest payout

By number of providers

This list of destinations is rank ordered by the number of service providers offering premium rate number services for each country. The number of service providers promoting premium rate numbers for a specific country may be a better indicator of IRSF risk by destination country code than price alone.

premium rate destinations by number of providers

The following chart plots the number of service providers offering premium rate numbers by call destination versus average payout rate per minute in $USD. Selected countries have been labeled. With the exception of outliers, Dominica and satellite networks, there is an obvious correlation between the average payout rate and the number of providers offering premium rate numbers for a country code. Somalia is the most common destination with thirty-three providers offering premium rate numbers to Somalia country code 252.

number of service providers correlation to average payout

Comparison to 2013 CFCA Survey

In 2013, the Communications Fraud Control Association published a fraud loss survey for the telecommunications industry. The survey reported that 57% of all fraudulent calls were terminated in the ten countries listed below. The 2013 CFCA results are compared to the data collected in this 2015 study.

For example, in the 2013 CFCA study, Latvia was the number one destination for fraud risk. There were more fraud losses for calls to Latvia than any other country. In this study, Latvia is ranked number four in terms of providers offering premium rate numbers. Latvia is ranked twenty-two in terms of the average payout, and fifth when countries are ranked by the highest payout rate.

top fraud destinations

communications fraud control association

Premium rate number products

The majority of premium rate number products are simple. The premium rate number provider offers an Interactive Voice Response (IVR) system that plays a message customized by the subscriber. However, often when a human calls a premium rate number they hear nothing. The reason is most IRSF calls are machine generated. There is no need to play a message for completing fraudulent computer driven telephone calls. Customers can sign up online, obtain a premium rate number and begin pumping traffic to a premium rate number in fifteen minutes. Some sites offer free call generation software and instructions on how to pump traffic to a premium rate number.

Payout terms

Payouts are made in either US Dollars or Euros, however, a few firms pay in British Pounds. Since premium rate number service is a commodity service, providers compete by offering a variety of payment terms. The billing periods vary from one to sixty days. The table at the right shows weekly and monthly billing periods are the most common. Payment remittance after the billing period can range from one to thirty days. Data from this survey revealed that the payout rates for thirty-day billing periods are approximately 51% more than the payout rates for seven-day billing periods. The premium for accepting the longer billing period yields a return of approximately 1.83% per day.

Payout remittance

Premium rate number providers advertise the following methods to remit payments to their customers:

Bank wire
Bitcoin
Credit card transfer
MoneyGram
PayPal
Ria
Skrill
Travelex
Western Union

Conclusions

The results of this study reveal that the eco-system needed to monetize International Revenue Sharing Fraud (IRSF) is thriving. The market for premium rate numbers is highly competitive with premium rate number providers offering similar services with minimal differentiation. Providers compete for customers in three ways: