Everything worth knowing, nothing that isn't.
Where MAP sits in the stack
MAP rides on top of TCAP, which rides on SCCP, which rides on either MTP3 (legacy SS7) or SIGTRAN's M3UA (SS7 over IP). The handset never sees MAP — it is purely a network-to-network protocol between Mobile Switching Centres (MSCs), Home Location Registers (HLRs), Visitor Location Registers (VLRs), and Short Message Service Centres (SMSCs).
The SMS-MT flow in MAP
When an SMSC needs to deliver an MT (mobile-terminated) message it sends MAP-SRI-FOR-SM to the recipient's HLR. The HLR replies with the current serving MSC address and the IMSI. The SMSC then sends MAP-MT-FORWARD-SHORT-MESSAGE to that MSC. The MSC pages the handset, delivers the SM, and returns success/failure. Operators see two distinct billable events per delivery (HLR query + delivery) and SMS firewalls inspect both.
Why fraud lives in MAP
SRI-for-SM is the most-abused MAP operation in the world. By querying SRI-for-SM, an attacker learns the serving MSC of any subscriber — a powerful location-tracking primitive. GSMA FS.07 and FS.11 specifically tell operators to filter inbound SRI-for-SM by reputation, and to deploy SS7 signalling firewalls. BroadNet's firewall classifies inbound MAP messages by GSMA SS7 Category 1/2/3 and drops Category 3 by default.
What replaces MAP
On 4G, Diameter S6a/S6d carries the equivalent signalling. On 5G standalone, the Service-Based Architecture uses HTTP/2 with the NRF/UDM/SMSF chain. But because the vast majority of MENA handsets still camp on 2G/3G for SMS (CSFB), MAP is not going away this decade.