# SMS firewalls and SS7 fraud — what operators are actually defending against

> SIM-box termination, SMS originator spoofing, and SS7-layer attacks all leak A2P revenue and endanger subscribers. A grounded look at the threat model and the controls.

- Canonical URL: https://www.broadnet.me/blog/sms-firewall-ss7-fraud-protection-operators
- Language: en
- Last updated: 2026-10-01
- Publisher: BroadNet (https://www.broadnet.me)

- Published: 2026-04-15
- Author: BroadNet Operator Solutions

When operators ask us to scope an SMS firewall, the conversation often starts with revenue and ends with security — because the two are inseparable. The same grey routes that leak A2P revenue are the routes used to deliver smishing, OTP interception lures, and spoofed-sender fraud. A firewall is a revenue-assurance product and a subscriber-protection product at the same time. Here is the threat model it has to cover.

## Threat 1 — SIM-box A2P termination

An aggregator buys consumer SIM cards, racks them in a GSM gateway, and terminates A2P traffic as if it were ordinary person-to-person SMS. The operator sees P2P, bills at P2P rates (often near zero), and the aggregator pockets the A2P margin. Detection relies on behavioural baselining: real subscribers do not send thousands of near-identical messages per hour from one MSISDN, do not send only outbound with no inbound, and do not exhibit machine-regular inter-message timing.

## Threat 2 — SMS originator spoofing

At the SS7 MAP layer, the originating address of an SMS can be set to an arbitrary string. That is the mechanism behind 'your bank' smishing that appears in the same thread as legitimate bank messages. The defence is sender-ID enforcement: a registry of which sender IDs are authorised on which routes, with anything unregistered or arriving on the wrong route blocked or quarantined.

## Threat 3 — SS7 interconnect abuse

- Unauthorised SendRoutingInfoForSM (SRI-SM) requests harvesting subscriber IMSI and serving-MSC data — reconnaissance for targeted attacks.
- MT-ForwardSM injection from interconnect partners that bypasses the home SMSC and any A2P agreement entirely.
- Location-tracking queries (anyTimeInterrogation, ProvideSubscriberInfo) that have no legitimate roaming purpose from the requesting network.

These are addressed at the signalling layer with an SS7 firewall: category-based MAP message filtering, velocity limits per interconnect, and cross-checks (for example, rejecting an MT-ForwardSM for a subscriber the network knows is not roaming on the claimed visited network). GSMA FS.11 and FS.19 codify the recommended categories; a competent SS7 firewall implements them rather than reinventing them.

## Why rules alone are not enough anymore

Pure rule engines fail against adversaries who adapt — rotating sender IDs, varying message content, switching interconnect partners hourly. Modern firewalls pair deterministic rules (registry, category, route reputation) with behavioural machine learning that correlates throughput patterns, content similarity, and recipient-overlap signals across sender IDs and routes. The rules catch the known; the ML catches the adaptive. You need both layers.

> BroadNet's firewall has been trained on MENA operator traffic since 2003. Region-specific training data matters — fraud patterns, sender-ID conventions, and roaming topologies in the Gulf differ enough from global averages that a generic model underperforms.

## What a deployment looks like

A typical engagement runs in monitor-only mode for two to four weeks to baseline traffic and tune thresholds without blocking anything, then moves to active enforcement. First-year outcomes follow a consistent pattern: grey-route A2P moved back onto billed routes, a sharp drop in subscriber-reported smishing, and — the part operators do not always anticipate — a much cleaner data picture of who is actually sending what across the network.