Toll Fraud Prevention and STIRSHAKEN Agenda 1 About

Toll Fraud Prevention and STIR/SHAKEN

Agenda 1. About Trans. Nexus 2. Toll fraud prevention 3. A brief history of robocall legislation 4. STIR/SHAKEN overview 5. Robocall prevention 6. Questions and answers

• Software for the telecommunications industry since 1997 • Solutions for • • • Toll fraud prevention Robocall prevention TDo. S protection STIR/SHAKEN Jurisdictional least cost routing Analytics and reporting

Toll fraud prevention

What does it cost you? Data: CFCA 2017 Fraud Loss Survey % Revenue Loss 4. 0% 3. 5% 3. 0% 23. 3% 2. 5% 2. 0% 1. 5% 1. 0% 0. 5% 0. 0% 2008 2011 2013 2015 Proprietary and Confidential 2017 % Var Estimated Global Revenues $2. 30 Trillion (USD) +2. 2% Estimated Global Fraud Loss $29. 2 Billion (USD) -23. 3% % Loss* 1. 27% -0. 4%

How does it happen? Data: CFCA 2017 Fraud Loss Survey Top Fraud Methods: § $2. 03 B – Subscription Fraud (Identity) § $1. 94 B – PBX Hacking § $1. 94 B – IP PBX Hacking § $1. 93 B – Subscription Fraud (Application) § $1. 75 B – Subscription Fraud (Credit Muling/Proxy) § $1. 66 B – Abuse of Service Terms & Conditions § $1. 66 B – Account Take Over § $1. 47 B – Internal Fraud / Employee Theft § $1. 38 B – Phishing / Pharming Fraud Type – is how they use the service or network to generate revenue from the attack Fraud Method – is how they access the network or service to enable revenue gain from the attack Top Fraud Types*: § $6. 10 B – International Revenue Share Fraud (IRSF) § $4. 27 B – Interconnect Bypass (e. g. SIM Box) § $3. 26 B – Arbitrage § $3. 02 B – Theft / Stolen Goods § $2. 39 B – Premium Rate Service § $2. 10 B – Device / Hardware Reselling § $1. 35 B – Domestic Revenue Share (DRSF) § $1. 30 B – Wholesale Fraud Proprietary and Confidential

Where is the risk? Data: CFCA 2017 Fraud Loss Survey Top 10 Countries where Fraud Terminates 8% 8% 7% 6% 5% 5% 4% 4% 3% 3% 3% 2% 1% Proprietary and Confidential ze er H ia Bo sn ria ge Al a go vin ia al m So ca ai m Ja ad sia Ch gd Ki n Un ite d Tu ni om ia an hu Lit tv ia La Cu ba 0%

Too Close to Home? Data: NANP Destinations Largest Risk $ 250, 000. 00 $ 200, 000. 00 $ 150, 000. 00 $ 100, 000. 00 $ 50, 000. 00 $ Apr-19 Apr-19 May-19 Jun-19 Domestic Caribbean Proprietary and Confidential Jun-19 International Jun-19 Carib & Intl Jul-19 Jul-19

The Layers of Fraud Management Proactive Destination Blocking • If your customer base doesn’t need to call, block it • Many carriers are changing to not allow international for end users by default, it must be requested • Know your definition of international, NANPA destinations are a large issue and most International blocks will not stop this. Reactive ANI Monitoring/Blocking • Block calling number when thresholds are triggered/fraud is alerted. • Inteliquent Example: Blocks all International (allows US 50/Canada/Puerto Rico): Reactive Trunk Group Monitoring/Blocking • Same as ANI, if you have a customer with a PRI/Dedicated connection and they have a large issue, block at the higher level so the impact doesn’t continue to grow. • Inteliquent Example: If 5 ANIs alert for blocking in a 3 hour period trunk group will automatically be blocked for all International (allows US 50/Canada/Puerto Rico) Based on customer spend, credit limits, etc. implement blocks or work with Realtime Dollar Thresholds Customizable options to customer needs: Proprietary and Confidential them when thresholds are reached to prevent large impact and disputes. Inteliquent Example: Thresholds are in place for all of our customers to stop international traffic at set dollar amount. When breached the system doesn’t allow calls. • Inteliquent Examples of some extras: • Channel & CPS Limits • Maximum Destination Rate • White Listing • Alerting/Reporting • Customized CDR Rules

A brief history of robocall legislation

A brief history of robocall legislation FCC authorizes limited blocking Do-Not-Call Act 2000 2010 2005 Truth In Caller ID Act Canadian CRTC 2018 -32 2015 Robocall Strike Force PA selected in U. S. FCC allows blocking by default 2020 FCC chairman Pai calls for SHAKEN/STIR without delay

“I’ve been clear that I expect major voice service providers to implement SHAKEN/STIR by the end of 2019… I’ve also made clear that if this deadline is not met, the FCC will act to ensure that SHAKEN/STIR is implemented. ” -- Ajit Pai, FCC Chairman (June 11, 2019)

STIR/SHAKEN overview

STIR/SHAKEN doesn’t prevent robocalls. It prevents caller ID spoofing so you can answer more calls you want while avoiding spam robocalls. STIR/SHAKEN call flow Certificate repository Calling party Authentication service Verification service Originating telephone service provider Terminating telephone service provider SIP network Called party

Certificate infrastructure Certificate Authority Certificate repository Key management service Originating telephone service provider

Triangle of trust Governance Authority Policies Policy Administrator iconectiv Telephone Service Providers Certificate Authorities

SIP INVITE with Identity header INVITE sip: 18001234567@example. com: 5060 SIP/2. 0 Via: SIP/2. 0/UDP example. com: 5060 From: "Alice" <sip: 14045266060@5. 6. 7. 8: 5060>; tag=123456789 To: "Bob" <sip: 18001234567@1. 2. 3. 4: 5060> Call-ID: 1 -12345@5. 6. 7. 8 CSeq: 1 INVITE Max-Forwards: 70 Identity: ey. Jhb. Gci. Oi. Ai. RVMy. NTYi. LCJwc. HQi. Oi. Aic 2 hha 2 Vu. Iiwid. Hlw. Ijog. In. Bhc 3 Nwb 3 J 0 Iiwie. DV 1 Ijog. Imh 0 d. HBz. Oi 8 v. Y 2 Vyd. Glma. WNhd. GVz. Lm. Ns. ZWFya. XAu. Y 29 t. L 2 Ix. NWQ 3 Y 2 M 5 LTBm. Mj. Yt. NDZj. Mi 04 M 2 Vh. LWEz. ZTYz. YTg y. ZWMz. YS 83 Y 2 M 0 ZGI 2 OTVk. MTNl. ZGFk. YTRk. MWY 5 ODYx. Yjli. ODBm. ZS 5 jcn. Qif. Q. ey. Jhd. HRlc 3 Qi. Oi. Ai. QSIs. I m. Rlc 3 Qi. Oi. B 7 In. Ru. Ijog. Wy. Ix. NDA 0 NTI 2 Nj. A 2 MCJdf. Swia. WF 0 Ijog. MTU 0 ODg 1 OTk 4 Miwib 3 Jp. Zy. I 6 IHsid. G 4 i Oi. Ai. MTgw. MDEy. Mz. Q 1 Njcif. Swib 3 Jp. Z 2 lk. Ijog. Ij. Nh. NDdj. YTIz. LWQ 3 YWIt. NDQ 2 Yi 04 Mj. Fk. LTMz. ZDVk. ZWVk. Y m. Vk. NCJ 9. S_vqkg. Ck 88 ee 9 rtk 89 P 6 a 6 ru 0 nc. Df. Srdb 1 Gy. K_m. Jj-10 hs. LWd. MF 7 e. Cj. DYARLR 7 EZSZwiu 0 fd 4 H_QD_9 Z 5 U 2 bg; info=<https: //certificates. clearip. com/b 15 d 7 cc 9 -0 f 26 -46 c 2 -83 ea-a 3 e 63 a 82 ec 3 a/7 cc 4 db 695 d 13 edada 4 d 1 f 9861 b 9 b 80 fe. crt>alg=ES 256; ppt=shaken

Decoded Identity token "header": "alg": "ES 256" "typ": "passport" "ppt": "shaken" "x 5 u": https: //certificates. clearip. com/4 a 8 eb 5 -461 b. crt "payload": "attest": "A" Attestation level "dest": { "tn": [ "14695858065" ] } Called number "iat": 1529071382 Timestamp "orig": { "tn": "12013776051" } Calling number "origid": "4 aec 94 e 2 -508 c-4 c 1 c-907 b-3737 bac 0 a 80 e" Origination identifier

Out-of-Band STIR/SHAKEN Certificate repository Call Placement Service Calling party Authentication service Verification service Originating telephone service provider Terminating telephone service provider Network Called party

Rich Call Data • Additional information about the caller that can be displayed to the called party, such as: • Display name • Hyperlinks to related info, e. g. , image of the caller or company logo • Flexible set of caller information, e. g. , address, email, birthday, etc. • Similar to enhanced CNAM • Except done at origination instead of termination • Cryptographically secure • Gives source party greater control over info presented

Robocall prevention

Robocall prevention methods work well with SHAKEN Dynamic fraud analysis Reputation service Shield database Blacklisting CAPTCHA

Nuisance call detection methods • Manual blacklisting • On-net calls from external networks • By OCN (correctly handles number porting) • By DID • Invalid calling numbers • High risk calling numbers • Calling numbers with poor reputation • Real time traffic analysis • STIR/SHAKEN verification

Nuisance call treatment options per subscriber • Report only • Block • Send to voicemail • Send to CAPTCHA gateway • Send to a honeypot • Modify caller display name (CNAM) Can be configured for each subscriber

Questions and answers • Get started now! • Contact us • transnexus. com • info@transnexus. com • 1 -404 -526 -6060