nternational Revenue Share Fraud (IRSF) is a telecom scam in which fraudsters obtain International Premium Rate Numbers (IPRNs), then pump artificial traffic to them — via hacked PBXs, SIM boxes, or Wangiri call-backs — so the originating operator pays inflated interconnect and settlement fees while the fraudster and a complicit number provider split the premium termination revenue.
IRSF is the voice-side cousin of Artificially Inflated Traffic. If you have read our breakdown of SMS pumping and AIT fraud, the economics here will feel familiar: automate a billable event, terminate it on a range you profit from, and let the victim pay the bill.
What IRSF is and why it persists
At the centre of every IRSF scheme is an International Premium Rate Number. IPRNs are legitimate in origin — they are the international equivalent of a domestic premium line, used for paid content, voting, and technical test ranges — and they carry an above-standard termination fee that is shared back with whoever leases the number. That revenue-share mechanic is the whole point: an IPRN provider will pay a partner a cut of the fee for every minute terminated to the range. Fraud begins when the traffic is generated artificially and the originating operator, not a willing caller, pays for it.
IRSF persists because it is charged per minute, the payout is automatic, and the loss is often invisible until the wholesale bill arrives weeks later. Unlike a stolen handset or a cloned SIM, there is no obvious single victim raising an alarm mid-attack — the money leaks quietly through the international settlement chain that ties voice interconnect partners together.
The revenue-share chain: who gets paid
IRSF is best understood as a revenue-share scheme dressed up as ordinary international traffic. Each party in the chain has a clear incentive except the one that pays. The table below shows how the money moves from the victim operator to the fraudster.
| Party | Role in the scheme | How they profit |
|---|---|---|
| Fraudster / traffic pumper | Generates artificial calls or call-backs to the premium range | Revenue-share cut of the premium termination fee |
| IPRN provider | Leases the international premium-rate number and shares its revenue | Margin on every minute terminated to the range |
| Complicit terminating operator | Hosts the premium range and bills for terminated minutes | Inflated international termination revenue |
| Victim operator or enterprise PBX | Originates the traffic, usually unknowingly | Nothing — pays the inflated interconnect and settlement bill |
| Transit carriers | Carry the calls in good faith along the settlement chain | Ordinary carriage fees, plus dispute and reputational risk |
The structure explains why IRSF is so hard to unwind after the fact. By the time the terminating operator has billed the transit carrier and the transit carrier has billed the originating operator, the premium fee has already been shared out and moved on. Recovering it means a settlement dispute across multiple jurisdictions, which is exactly why prevention on the originating side is where operators get their return.
How fraudsters pump traffic to premium ranges
IRSF needs a source of traffic pointed at the fraudster's range. The techniques below are the common enablers — some hijack another party's network, some trick a real subscriber into placing the call, and several are used in combination to make the traffic look organic.
- PBX / dial-through fraud — attackers brute-force voicemail, SIP, or DISA on a poorly secured enterprise PBX and dial out to premium ranges, typically overnight or over a weekend so the bill lands before anyone notices.
- SIM boxes and compromised devices — banks of SIMs or malware-infected handsets place automated calls to the fraudster's ranges, spreading the volume across many origins so it evades simple per-line thresholds.
- Wangiri call-backs — a single missed one-ring call baits the subscriber into calling an international premium number back; that returned minute is the payout. Wangiri is a classic IRSF feeder, the voice equivalent of the automated triggering seen in messaging fraud.
- Roaming abuse — a fraudster uses a stolen or fraudulently acquired SIM abroad to terminate premium calls; the home operator only sees the cost weeks later through the roaming clearing process, a settlement lag that GCC hub operators watch closely.
- Test-number and unallocated ranges — fraud rings exploit number ranges reserved for testing or not yet in commercial service, where monitoring and range databases lag the reality on the wire.
Dial-through fraud deserves special attention because it is the most preventable: the overwhelming majority of hijacked PBXs are compromised through a default or weak password on an internet-exposed voicemail or SIP service. A single misconfigured branch exchange can generate five-figure losses in one weekend, which is why PBX hardening sits in every serious defence plan.
Why IRSF is one of the largest telecom fraud categories
Industry fraud surveys consistently rank IRSF among the most damaging fraud types operators face. The Communications Fraud Control Association (CFCA), whose Global Telecom Fraud Loss Survey polls operators worldwide, has repeatedly placed IRSF near the top of reported fraud-loss methods, and estimates total industry fraud losses in the tens of billions of US dollars a year. The GSMA likewise treats IRSF as a core fraud category in its operator security guidance.
The reason IRSF stays at the top is structural, not accidental. The fee is charged per minute, the range can be spun up in an obscure destination faster than a database can flag it, and the victim frequently discovers the loss only when the settlement statement lands. Contain it on one route and the traffic simply moves to another number range — which is why detection has to watch behaviour, not just block a static list.
How operators detect and defend against IRSF
No single control stops IRSF. It is contained by layering real-time behavioural monitoring on top of range intelligence, hard commercial limits, and edge hardening — the same defence-in-depth model operators apply to signalling and messaging fraud. The playbook below is the order most revenue-assurance teams deploy it in.
- Run real-time call-pattern and destination-range monitoring — score every call against baselines for destination, duration, concurrency, and time-of-day, and alert on sudden concentration toward high-cost or rarely dialled ranges.
- Screen against IPRN and high-risk-range databases — commercial and industry-shared lists of known premium and revenue-share ranges let you block or hold traffic to destinations no legitimate subscriber has a reason to dial.
- Enforce credit, velocity, and spend limits — cap concurrent international calls, spend-per-subscriber, and per-destination velocity so a hijacked PBX or roaming SIM cannot run up an unbounded bill before the alert fires.
- Harden the PBX and SIP edge — disable unused DISA and voicemail dial-out, enforce strong credentials, restrict international dialling by policy, and rate-limit registration attempts; most dial-through fraud exploits a default password.
- Analyse settlement and interconnect anomalies — reconcile traffic against expected settlement patterns, because a spike in minutes to an obscure destination in the wholesale bill is often the first hard evidence of an IRSF run.
The MENA and GCC angle is a live one. Gulf operators sit on some of the busiest international voice corridors in the world, with heavy inbound roaming and large migrant-worker calling volumes, which gives IRSF both the traffic to hide inside and the settlement complexity to exploit. Regional fraud teams increasingly pair destination-range monitoring with roaming near-real-time data exchange so a fraudulent burst abroad is caught in hours rather than at month-end clearing. Operating since 2003 across 200+ countries and 1,000+ operator connections gives BroadNet the cross-market visibility to baseline what normal traffic to each destination actually looks like.
IRSF, Wangiri, and SMS pumping are the same economic attack across different bearers — a billable event terminated on a range the fraudster profits from. BroadNet's operator-grade anti-fraud scoring and firewall controls baseline behaviour across messaging and signalling, so anomalous traffic is held before it becomes a settlement liability. If you run interconnect, it pairs directly with your existing revenue-assurance stack.
Frequently asked questions
What is IRSF?
IRSF (International Revenue Share Fraud) is a telecom fraud in which criminals obtain international premium-rate numbers that pay a share of their termination fee, then pump artificial traffic to those numbers. The originating operator pays inflated interconnect and settlement fees for calls no genuine subscriber intended to make, while the fraudster and the number provider split the premium revenue.
How does international revenue share fraud work?
A fraudster partners with a provider of international premium-rate numbers that shares its per-minute revenue, then drives traffic to those ranges — by hacking a PBX to dial out, running SIM boxes, or using Wangiri missed-call baits so subscribers call back. Each terminated minute triggers the premium fee, which flows back through the settlement chain and is shared between the fraudster and the number provider.
How do operators detect IRSF?
Operators detect IRSF with real-time call-pattern and destination-range monitoring that flags sudden concentration toward high-cost or rarely dialled numbers, screening against IPRN and high-risk-range databases, and credit and velocity limits that cap exposure per subscriber and destination. Settlement-anomaly analysis then catches anything that slipped through, when unexpected minutes to obscure destinations appear in the wholesale bill.
How is IRSF related to Wangiri and SMS pumping?
All three are revenue-share fraud on different bearers. Wangiri is a feeder technique for IRSF — a missed call that tricks a subscriber into dialling a premium number back. SMS pumping (AIT) applies the same logic to messaging, automating OTP sends to ranges the fraudster profits from. The common thread is a billable event terminated where the attacker collects a cut.
References
- GSMA — Fraud and security resources for operators: gsma.com
- Communications Fraud Control Association (CFCA) — Global Telecom Fraud Loss Survey: cfca.org
- i3forum — International carrier fraud and interconnect best practice: i3forum.org
- BroadNet — Operator solutions and anti-fraud: operators, anti-fraud, voice.