According to the CFCA Global Fraud Loss Survey 2025, expected losses from telecom fraud will reach $41.82 billion in 2025. A significant portion of these losses is driven by International Revenue Share Fraud (IRSF). This is forcing operators to modernize their voice network architecture, as traditional routing methods no longer provide adequate security.
Why legacy SIP routing fails to stop fraud
Classic SIP routing relies on static tables and trust in plaintext sender identification headers. Attackers exploit this vulnerability to spoof numbers and generate calls to premium-rate destinations. Attempts to resolve this issue through synchronous queries to external anti-fraud platforms lead to a critical increase in Post Dial Delay.
Cryptographic protection under the RFC 8224 standard
To combat caller ID spoofing, cryptographic signatures are used. The RFC 8224 standard defines the Identity header in the SIP protocol to transmit signed call information. This mechanism forms the foundation of STIR/SHAKEN technology, which operates as follows:
- Authentication: the originating network verifies the subscriber's right to use the number.
- Signature: a cryptographic signature is generated using the operator's private key.
- Verification: the terminating softswitch verifies the signature using the sender's public key.
Architectural transition to Open Digital Architecture
Integrating cryptographic verifications into legacy BSS/OSS systems reduces network reliability. An effective solution is transitioning to the Open Digital Architecture (ODA) by TM Forum. This approach involves decoupling functions into independent services: a routing core, asynchronous verification, and billing modules.
To maintain softswitch performance, the following tools are implemented:
- Asynchronous validation via microservices.
- Local caching of public keys from other operators.
- Hybrid routing based on verification status.
An example of this approach in action is the DooxSwitch VoIP platform, which supports modern authentication standards and dynamic traffic management in line with ODA requirements.
The effect on the market
The projected $41.82 billion in telecom fraud losses threatens the financial stability of operators and erodes user trust in voice communications. For the industry, relying on outdated routing means absorbing massive costs from International Revenue Share Fraud (IRSF) and suffering from degraded service quality due to Post Dial Delay. Transitioning to modern cryptographic standards is no longer optional but a necessity for business survival.
How to prepare
To secure telecom networks and prevent fraud, operators should take the following steps:
- Adopt the RFC 8224 standard (STIR/SHAKEN) to authenticate caller identities using cryptographic signatures.
- Transition from legacy BSS/OSS to Open Digital Architecture (ODA) to decouple routing from verification.
- Implement asynchronous validation, local key caching, and hybrid routing to maintain softswitch performance.
- Deploy modern VoIP platforms like DooxSwitch that support dynamic traffic management and modern authentication standards.
Prepared by a Software Ukraine member. Original publication.