Can this number exist, and how likely is it to be used for fraud?
- caller_id_integrity
- Is this caller ID even possible, or does it sit in an unallocated range?
- reputation_ledger
- Has this exact number, its range or a nearby block been reported?
- ndc_range_risk
- How much fraud has built up against this numbering range?
- range_prediction
- How likely is this range to carry fraud next, before any report arrives?
- premium_tariff
- Is it a premium-rate range?
Where does the session really come from, and is that infrastructure used to hide?
- ip_reputation
- This exact IP has been reported. High on its own.
- Hard anonymisers
- Tor, proxy or bogon traffic, routed to be untraceable. High on its own.
- Evasion infrastructure
- Data centre, cloud or VPN rather than a consumer line. Circumstantial.
- Geography
- Origin on a different continent from your expected corridors. Circumstantial.
Does this subject behave like fraud the network has already seen?
- Infrastructure clustering
- Numbers and IPs working as one network, with a stable cluster_id.
- Velocity
- Bursts of attempts from one number, IP or cluster.
- Impossible travel
- One number appearing from origins no journey could connect.
- Origin spread
- One number arriving from many different networks.
- Account linkage
- Caller ID not matching the account, or a run of failed logins.