The first Sunday of every month, something curious happens in my town.
Alameda, California is usually a pretty laid-back place—quiet streets, easy parking, the occasional jogger or cyclist. But on that first Sunday, everything changes. The roads clog up with traffic, cars crawl toward the west end of the island, and local drivers (myself included) start muttering under their breath. What’s going on?
It’s the Alameda Point Antiques Faire — an enormous open-air flea market that draws thousands of visitors to a spot that’s normally pretty sleepy.
I’ve never actually attended the event, but I always know it’s happening. The pattern of traffic is so unusual, so out-of-place, that it sets off mental alarm bells. Something’s different. Something’s wrong.
In the world of telecoms, this kind of anomaly detection can save your business.
What does “unusual traffic” look like on a Class 5 switch?
If you manage a Class 5 softswitch, you probably have a general sense of what normal traffic looks like on your network. Perhaps most calls are local, durations are fairly short, and volume peaks during business hours.
So what would it look like if something were off?
Here are a few examples:
- A sudden spike in international calls to high-cost destinations.
- Long-duration calls at odd hours from a typically quiet subscriber line.
- A subscriber’s call volume increasing by a factor of 10 or 100—overnight.
These aren’t signs of a bustling antiques market. These are the digital equivalent of a smash-and-grab.
And more often than not, they point to outbound toll fraud.
Toll fraud: Why vigilance matters
Toll fraud happens when a bad actor gains unauthorized access to your network — often by compromising a subscriber’s SIP credentials or setting up unconditional call forwarding on a line — and starts generating outbound calls to high-cost destinations. The fraudster pockets a cut of the call revenue, while you foot the bill.
This isn’t just a theoretical problem. It can cost providers tens of thousands of dollars in a single night if not caught early.
The good news is that just like I can spot Alameda traffic gone haywire, it’s possible to detect and stop toll fraud based on traffic patterns — if you have the right tools in place.
Enter ClearIP: Real-time protection for your switch
For the past five years, we’ve partnered with TransNexus to offer our clients a powerful, cloud-based solution called ClearIP.
ClearIP works in real-time, analyzing call traffic as it passes through your switch. It flags and blocks suspicious calls before they connect, based on:
- Call destinations and rates
- Call volumes per user
- Historical traffic norms
- Known fraud patterns
It’s like having a security guard stationed at every road into your network, watching for signs of unusual behavior.
And ClearIP isn’t just about fraud prevention. It also supports:
- STIR/SHAKEN call authentication to reduce spoofing
- Least Cost Routing to optimize outbound call costs
- Advanced analytics and reporting to give you better visibility into your network
We’ve helped many regional service providers integrate ClearIP into their Metaswitch environments, and the results have been rock solid.
Stay ahead of the traffic jam
You don’t have to wait until the bill arrives to find out something went wrong. Just like an unusual spike in city traffic can hint at an event you didn’t know about, an unusual traffic pattern on your network is often your first clue that fraud is underway.
ClearIP gives you the visibility and protection you need to respond in real-time—and we’re here to help get it set up.
If you’d like to learn more or discuss how ClearIP could fit into your network, just reach out and we’d be happy to help you out.
