International Revenue Share Fraud (IRSF): how it works and how to detect it

International Revenue Share Fraud (IRSF) is a type of telecom fraud where criminals generate traffic to numbers that pay a share of the termination revenue, then collect that share. The carrier or customer whose network or account was used to send the calls pays the bill. The fraud is usually found at invoice time, after the minutes have already been terminated.

How IRSF works

A fraudster obtains number ranges, often in destinations with high termination rates, that pay revenue share to the holder. They then need traffic. They create it by taking over a business phone system or SIP account, by abusing a free trial or a stolen identity, or by using automated dialers. The calls are placed to the range they control, often long calls to a small set of numbers.

The victim is the party that carries the cost: the account holder, the reseller or the wholesale carrier that terminated the minutes upstream.

Warning signs in call detail records

• A sudden jump in calls or minutes to destination prefixes the account has never used before.
• Traffic concentrated on a few destinations, or on a few numbers inside one range.
• Activity at hours when the account is normally quiet, such as nights and weekends.
• Longer than usual call durations to a high-cost destination.
• Spend rising faster than the account's own history or agreed limit.

None of these is proof on its own. A genuine customer can start calling a new country. The useful signal is a change from that customer's own normal, combined with a risky destination.

How to reduce exposure

• Block or require approval for high-risk destinations by default, and open them per customer when there is a business need.
• Set spend and concurrent-call limits per account.
• Monitor call records continuously, not just at billing time.
• Alert a person quickly and keep a one-click way to limit or block an account.
• Review destination lists regularly, because fraudulent ranges change.

How Smart Gravity Shield approaches IRSF

Smart Gravity Shield reads call detail records from your softswitch, compares each customer with their own baseline and watches volume and spend toward high-risk destinations, including at unusual hours. It scores risk from 0 to 100 and alerts your team, typically about 30 to 60 seconds after calls are recorded. Automatic rate-limiting or blocking is optional and depends on your switch. No system catches every case, so limits and human review still matter.

Common questions

Is IRSF the same as traffic pumping?

They are related but not identical. IRSF is about sending traffic to number ranges that share revenue with the fraudster. Traffic pumping inflates traffic to specific numbers to earn termination fees. Both often show as spikes to a small set of destinations.

Can IRSF be stopped before the first call?

Destination blocking and spend limits can stop it before it starts. Call record analysis detects it shortly after calls are recorded, which limits the loss but does not prevent the first calls.

This guide is general information, not legal or security advice. Fraud patterns change, and no detection system catches every case.