Global losses from telecom fraud in 2025 reached $41.82 billion according to CFCA. This forces operators to rethink their voice routing architecture, moving away from basic trust in IP addresses to integrating SIP routing, mobile number portability (MNP) databases, and billing into a single security perimeter.
Anatomy of a SIP call and route optimization
Call processing in the carrier core via a Session Border Controller (SBC) or SIP proxy consists of several stages: number normalization to the E.164 standard, source authentication, Least Cost Routing (LCR) lookup, and SIP header modification.
To minimize costs, operators implement Least Cost Routing (LCR). However, the availability of mobile number portability (MNP) complicates this process. Direct queries to external MNP databases during call setup increase Post Dial Delay (PDD). To address this, modern platforms use local caching and high-performance in-memory databases, enabling calculations in milliseconds.
Cryptographic protection and the RFC 8224 standard
Caller ID spoofing is the foundation of International Revenue Share Fraud (IRSF) schemes. According to ENISA, the use of legacy signaling protocols like SS7 and Diameter remains a major attack vector, with up to 53.7% of international traffic in some regions passing through unsecured interconnects.
To combat number spoofing, the IETF developed the RFC 8224 standard (the technological foundation of the STIR/SHAKEN framework). It involves the following steps:
- The originating operator generates a digital token (PASSporT) signed with a private key.
- The token is transmitted in the SIP INVITE request via the Identity header.
- The terminating operator validates the signature using a public key.
Billing integration and transition to cloud architecture
Post-factum Call Detail Record (CDR) analysis does not prevent financial losses. Modern infrastructure requires real-time integration of the signaling core with BSS/OSS systems. This allows for the immediate blocking of anomalies, such as when a single account generates more than 27.7% of concurrent calls to atypical destinations.
To build such high-load systems and rapidly deploy microservices, specialized platforms are used, such as the low-code platform UnityBase (co-developed by the Intecracy Group technology alliance). Its commercial Enterprise and Defence editions support industrial DBMSs, providing the response times required for telecom environments.
Legacy infrastructure modernization is achieved by transitioning to a cloud-native architecture. Containerization provides horizontal scaling and geographic redundancy without interrupting active sessions.
The effect on the market
The massive scale of telecom fraud threatens carrier profitability and network integrity. Relying on legacy SS7 and Diameter protocols exposes over half of international traffic to spoofing and IRSF. Without real-time billing integration and modernized routing, operators face direct financial losses and increased post-dial delays that degrade user experience.
How to respond
- Optimize routing: Use local caching and in-memory databases for MNP queries to prevent Post Dial Delay.
- Deploy cryptographic validation: Implement the RFC 8224 standard to sign and verify caller identities using digital tokens.
- Enable real-time blocking: Integrate the signaling core with BSS/OSS systems to immediately block traffic anomalies.
- Modernize the core: Transition to cloud-native, containerized architectures using high-performance platforms like UnityBase to ensure horizontal scaling and geographic redundancy.
Prepared by a Software Ukraine member. Original publication.