Per-customer baselines: fraud detection that does not block genuine call-centre traffic

Many fraud tools use one set of rules for every customer. That works poorly in VoIP, where customers behave very differently. A call centre running an auto-dialer has short calls and a low answer rate every day. A wholesale customer has long, steady traffic. A small business has a handful of calls. One threshold cannot be right for all of them.

Key metrics

• CDR (call detail record): the record of each call, with numbers, time, duration, route and result.
• CPS (calls per second): how fast calls are being placed.
• ASR (answer seizure ratio): the share of call attempts that are answered.
• ACD (average call duration): the average length of answered calls.

Why fixed rules fail

Suppose a rule blocks any account whose ASR falls below 20 percent. A genuine auto-dialer campaign with an ASR of about 5 percent is blocked every day, and your customer loses revenue and trust. If you raise the threshold to avoid that, you miss fraud on accounts that normally have a high ASR.

How a baseline works

A baseline is a customer's own normal: typical CPS, ASR, ACD, destinations, hours and spend. The system learns it from history, then alerts when behaviour moves away from it. For example, CPS jumping from 80 to 400, or ASR falling from 5 percent to 0.5 percent, is a meaningful change for that customer, even if neither number would trip a global rule.

Making it safe to adopt

• Start in monitor-only mode for a learning period of one to two weeks.
• Switch on automatic actions gradually, customer by customer.
• Keep whitelists for trusted traffic and a one-click way to undo any action.
• Review alerts and tune thresholds per customer.

Baselines reduce false positives, but they do not remove them, and they take time to learn. New customers have little history, so combine baselines with sensible default limits.

How Smart Gravity Shield uses baselines

Smart Gravity Shield builds a baseline per customer and traffic profile, such as call centre, auto-dialer, retail or wholesale. It combines baseline changes with rules for risky destinations, spend and odd-hour activity into a 0 to 100 risk score, and responds in steps: alert, then rate-limit, then block.

Common questions

How long does a baseline take to learn?

A learning period of one to two weeks in monitor-only mode is typical to start. Machine-learning anomaly detection needs more history, roughly two to three months, and is on the roadmap.

What about brand new customers?

They have little history, so default limits and closer review apply until a baseline forms.

This guide is general information, not legal or security advice. Fraud patterns change, and no detection system catches every case.