Network Data Fraud Control

With more than 78% of zero-rating fraud going undetected, and the estimated cost of a single mass-action viral fraud event reaching $80,000 USD, it is time to reconsider your fraud prevention strategy for data access.

Advanced encrypted traffic classification, real-time all-IP flow analysis, and flexible anomaly detection rules allow operators to build customized fraud profiles tailored to their services. Zero-rating services are a popular target for fraudsters—whether by protocol (e.g., DNS access) or by SNI (Service Name Indication). Fraudulent traffic can disguise other data transfers, using multiple techniques to bypass charging detection and access data for free—representing both a fraud and a security risk for MNOs and ISPs.

By combining application, connection, internet, and network data with subscriber information, mobile operators gain deeper, context-driven insights into how users connect and what impacts their experience.

Indexing Quality of Experience (QoE) across users, apps, and regions is complex. Browsing, streaming, voice, and gaming each impose unique connectivity demands. That’s why understanding user context—including mobility—is essential for accurate analytics.

There is no single metric that fits all. Enea gives mobile operators the flexibility to define what should be measured, why it matters, and how it should be indexed and normalized for meaningful comparison.

DNS fraud

Domain Name traffic (port 53) is often overlooked as a channel for data fraud. Fraudulent domain names (garbled alphanumeric strings), multiple requests within a short period of time, and abnormally large responses (much larger than a typical set of IP address alternates) can all be indicators. In such cases, data is transferred and reassembled on the client side—often through rogue device apps.

In one of our recent examples, 40 MB of data was accessed free of charge in just six minutes. This not only represents a direct revenue loss but also introduces a serious security risk, as the data transferred could contain malware targeting the device.

Zero-Rated Fraud

Zero-rating services (which enable access to specific domains without charging against a user’s data allowance) have become increasingly popular and, in many cases, necessary for telecom organizations. They serve both to ensure user access to essential services and to promote competitive offerings. Examples include:

• Promotional social media access – e.g., zero-rated WhatsApp and Facebook in LATAM countries
• Educational and public services – e.g., free access to public benefit organizations
• Commercial promotions – e.g., free data access for ride-sharing apps

While designed to help users and encourage adoption, these services are frequently exploited. Attackers may fake SNI (Server Name Indication) or tunnel traffic through vulnerable servers. Customer data shows that such attacks are often viral (techniques shared in online forums) and transient (occurring over just a few days), yet highly damaging. Individual attackers have been observed consuming 40–50 GB of free data, resulting in significant revenue losses per incident.

Enea’s Approach to Fraud Detection

The scalability of our core platforms (Integra and 5G Service Engine), combined with in-house analysis tools, provides operators with a practical and powerful solution for monitoring encrypted, real-time, all-IP traffic. This delivers both a robust Day 1 solution and the ability to continuously evolve detection patterns over time (Day N), adapting as fraud techniques change.

No single data point is always representative of fraud, and avoiding false positives is critical. Enea correlates multiple variables—such as data volume, frequency of access from single or multiple users, time of day, protocol, and service parameters—to calculate the probability of fraud. This flexible approach allows operators to adjust parameters and weightings over time, depending on specific data policies or service models. For instance, a prepaid subscriber may be abusing their authentication credentials to exploit zero-rated services.

As a practical example, unusually long VoIP sessions can indicate potential fraud. For more details, see our recent insight trend article on fighting telecom fraud.

Traffic management and optimization are about gaining full control of your network and understanding exactly how data is accessed. With Enea’s advanced tools, operators can take charge—maximizing efficiency, improving user experience, and protecting revenues!