Signals

Mobile phone verification is still one of the largest and most deployed solutions for second-factor authentication. A significant amount of traffic on a single mobile network can be artificially generated, leading to increased costs, and, in some cases, fraudsters are distributing artificial traffic among brands to avoid brand detection.

Signals is a product that combats artificially generated traffic, known as SMS pumping fraud. It is using various methods to detect artificial traffic like the behavior of phone numbers, ranges, phone number types, etc.

Some of the patterns we are monitoring:

• Number of received messages per phone number - if a specific phone number received more traffic than expected
• Number of received messages per phone number range
• Number of errors per prone number range - similar to above, ranges with a lot of specific errors are considered suspicious

For each message sent, Signals is calculating the risk score. The risk score is a number from 0 to 100 where 0 represents a number of high trust and no suspicious behavior detected, and 100 is highly suspicious.

Signals automatically block certain destinations or ranges detected as high risk. This option can be enabled on the account level with a predefined threshold. Each destination will be blocked until the score drops below the defined threshold. Blocked traffic will not be charged nor it will count into monthly volumes.
Clients have the flexibility to instruct Infobip to configure the thresholds differently for each country or network, enabling them to choose between more aggressive or conservative approaches to fraud prevention.

• Blocking is SMS message delivery blocking to a destination that meets Signals score blocking thresholds (e.g., each score above 90).
• Event is an anomaly detected with various analyses with individual contributions to the risk score. It could be positive (trust) or negative (risk).
• Risk score is a numeric risk representation associated with the destination number which is calculated by summing all events.
• Interaction is each attempt to send traffic toward a certain destination.
• Regular traffic represents all interactions that were not detected as fraud (based on defined thresholds) and are charged.