Flash Call & Voice Firewall

Flash call detection for operators, at the voice ingress

Stop OTT authentication bypass at the signaling layer.

BroadNet's flash call firewall lets mobile operators detect and stop flash-call authentication bypass at the voice ingress, recovering verification revenue that OTT apps would otherwise route around A2P SMS. A voice firewall that detects flash-call authentication bypass from WhatsApp, Telegram, IMO, Viber and other OTTs. Multi-source detection — Flash DB, Flash Profile DB, ATI/SRI-SM, numbering-plan checks, CDR/EDR analysis — then block, modify CLI, or log-and-alert.

Measure flash-call leakage Recover verification revenue

MNO-grade

GSMA Associate Member

Revenue assurance built-in

The BroadNet snow leopard watching a missed-call flash intercepted by a detection lattice

BroadNet · flash-call verify

Flash-call verification

200+

countries

1,000+

operator connections

99.99%

SLA

MNO CONNECTIONS

1,000+

Direct operator interconnects worldwide

COUNTRIES COVERED

200+

Signaling and voice reach across markets

YEARS OPERATOR-GRADE

23+

Carrier-grade infrastructure since 2003

ENGINEERING TEAM

300+

In-house signaling and voice engineers

How it sits in the voice path

From SS7 IAM
to verdict, in under 100 ms.

The firewall lives transparently at the international voice ingress. Every call setup is decoded, scored against Flash DB and Profile DB, cross-checked against ATI / SRI-SM, and a verdict is returned before the MSC ever rings the handset.

01 · Ingress
Int'l voice POI
Inbound international call setup arrives at the voice gateway via SS7 IAM or SIP-I from carrier interconnects.
no added hop
02 · Decode
Setup inspect
ISUP IAM and CAP InitialDP decoded. A-number, B-number, range, expected setup duration extracted in flight.
p99 < 20ms
03 · Score
Flash DB · Profile
Flash DB lookup, Flash Profile DB behavioural match, ATI / SRI-SM cross-check, numbering-plan validation.
p99 < 60ms
04 · Verdict
Policy engine
Monetize · block · modify CLI · log. Per OTT, per range, per market. Operator-configurable.
p99 < 20ms
05 · Action
MSC / Billing
Clean calls pass to MSC. Flash calls billed per-event at the A2P-equivalent rate or dropped at setup.
total < 100ms
← signed CDR · per-OTT report · OCS bill

01 · Ingress

Int'l voice POI

Inbound international call setup arrives at the voice gateway via SS7 IAM or SIP-I from carrier interconnects.

no added hop

02 · Decode

Setup inspect

ISUP IAM and CAP InitialDP decoded. A-number, B-number, range, expected setup duration extracted in flight.

p99 < 20ms

03 · Score

Flash DB · Profile

Flash DB lookup, Flash Profile DB behavioural match, ATI / SRI-SM cross-check, numbering-plan validation.

p99 < 60ms

04 · Verdict

Policy engine

Monetize · block · modify CLI · log. Per OTT, per range, per market. Operator-configurable.

p99 < 20ms

05 · Action

MSC / Billing

Clean calls pass to MSC. Flash calls billed per-event at the A2P-equivalent rate or dropped at setup.

total < 100ms

Threat landscape

A2P revenue, moving off your network in silence.

A flash call is a missed call. The OTT app dials, reads the CLI digits as the verification code, and hangs up before the user answers. No SMS CDR is generated, no A2P billing applies — but your STP, your MSC and your voice POIs carry the load.

Across many MENA and Africa corridors, flash calls can account for a large and growing share of authentication volume — monetized A2P traffic walking out the front door.

How it works

Detect the bypass. Monetize or block it. In one decision.

Six capabilities working together at the international voice ingress. One verdict per call, under 100 ms, with full per-OTT visibility downstream.

ML-based signature detection

Behavioural classifiers trained on flash-call campaign patterns across operator networks. Call duration, attempt ratios, range velocity, A-number entropy.

OTT bypass identification

Source-attributed to WhatsApp, Telegram, IMO, Viber and emerging apps. Continuous active probing keeps the Flash DB ahead of new ranges.

Monetize or block

Charge per-event A2P-equivalent pricing, or drop the call. Operator decides per OTT, per range, per market.

Real-time decision

Verdict returned under 100 ms at international voice ingress. No impact on legitimate voice setup or POI capacity.

Reporting per OTT

WhatsApp vs. Telegram vs. Viber vs. IMO bypass volumes. Revenue at risk, recovered, and policy effectiveness by app.

Operator policy controls

Configurable per prefix, per range, per app, per time window. Phased enforcement: detect, modify-CLI, then block.

Caller-ID authentication

Where flash calls meet STIR/SHAKEN attestation.

A flash call works because the subscriber trusts the caller ID they see. STIR/SHAKEN is the industry framework for proving that caller ID is genuine — signing the originating number and carrying an attestation level across SIP interconnects. BroadNet's flash-call firewall is attestation-aware, so operators can tell real verification from spoofed voice-OTP and keep the monetisation decision either way.

Attestation-aware verification

STIR/SHAKEN signs a call's originating number in a PASSporT token and carries an attestation level across SIP. Where your network carries it, the flash-call firewall reads attestation into the verdict alongside CLI and cadence.

Spoofed voice-OTP caught

Fake verification calls that spoof a bank or brand CLI fail origin and CLI-integrity checks at the boundary — the same gap STIR/SHAKEN is designed to close, enforced in markets that have not yet mandated it.

Legitimate flash calls kept

Genuine flash-call verification is separated from abuse per route, so operators keep the low-cost channel and the monetisation decision while blocking spoofed or pumped attempts.

Policy & integration

Per-OTT rules. Per-event CDRs. Maker-checker promoted.

Declarative policy that your RA, wholesale, and signaling teams can read without a meeting. Verdicts surface as standard CDRs into your existing billing and RA pipelines.

flashfw.operator.local · prod

Example

1# /etc/broadnet/flashfw/policy.d/whatsapp.yaml
2# Monetize WhatsApp flash calls in UAE, KSA, Egypt
3policy: whatsapp_flash_monetize
4  match:
5    flash_db_hit:    true
6    ott_attribution: whatsapp
7    b_party_mcc:     [424, 420, 602]
8    setup_duration:  "< 4s"
9  action: bill
10  rate_card:
11    AED: 0.040
12    SAR: 0.040
13    EGP: 0.500
14  cdr_tag: a2p_flash_monetized
15 
16policy: telegram_flash_modify_cli
17  match:
18    flash_db_hit:    true
19    ott_attribution: telegram
20  action: modify_cli
21  modify:
22    a_number: "+0000000000"     # OTP unreadable
23  cdr_tag: flash_neutralized
24 
25policy: viber_block_freemium
26  match:
27    flash_db_hit:    true
28    ott_attribution: viber
29    subscriber_tier: prepaid_freemium
30  action: block
31  cdr_tag: a2p_flash_dropped

Deployment

Phase enforcement. Keep subscriber trust.

Three deployment modes, sequenced. Most operators run detection-only for 30 days, then negotiate commercial monetization with the OTT before enforcing.

Detect only

Mirrored ingress feed. Zero call impact. Build the evidence file — volume, OTT attribution, revenue at risk — for commercial discussions.

Monetize

Per-event billing on detected flash calls. Operator-set rate card per OTT. Reconciled monthly against the same A2P portal.

Enforce

Block, or modify CLI so the verification code is unreadable. Whitelist-aware. Reversible by policy at any time.

At a glance

Specifications

Deployment

International voice ingress · in-line or mirrored

Detection sources

Flash DB · Profile DB · ATI · SRI-SM · NP · CDR/EDR

Decision latency

< 100 ms p99

Actions

Monetize · Block · Modify CLI · Log-Alert

Flash DB update cadence

Continuous — active probing + CDR feedback

OTT coverage

WhatsApp · Telegram · IMO · Viber · emerging apps

Whitelist policy

Operator-configurable per prefix/range

Reporting

Per-OTT volume · revenue impact · policy effect

Integration

STP · voice billing · NOC · operator portal

Compliance

GSMA FS.19 · operator-controlled subscriber privacy

Compliance

Operator-controlled. Subscriber-safe.

BroadNet runs as an extension of the operator network. No third-party data processing, no PII leaves the perimeter, full audit trail on every policy decision.

GSMA FS.19 aligned

Signaling firewall guidelines for voice and authentication traffic.

No PII export

All inspection runs in-network. CDRs and metadata stay within the operator.

Full audit trail

Per-call decision log retained per the operator's retention policy.

Operator-set policy

Whitelist, rate card, enforcement mode — configured and reversible by the operator.

Illustrative operator scenarios

What flash-call monetization
looks like on the P&L.

GCC mobile operatorMNO · GCC

Challenge: Flash-call bypass volume from OTT verification was eroding A2P revenue with no commercial evidence to confront the OTT or regulator.
Approach: A detect-only phase built a measured volume baseline that fed into regulator and OTT negotiations.

VP wholesale & roaming

South Asian telecom operatorMNO · South Asia

Challenge: A blanket block on flash calls risked subscriber complaints and regulator escalations.
Approach: CLI modification gradually steered OTTs back to SMS OTP without breaking subscriber sign-in flows.

Head of A2P strategy

Levant MNOMNO · Levant

Challenge: A smaller network lacked the in-house data science capacity to classify OTT flash traffic.
Approach: BroadNet's Flash DB worked from day one, with portal reports flowing directly into the finance team's monthly settlement.

Revenue assurance manager

Operator due diligence

Eight answers
for the wholesale committee.

The false-positive rate against legitimate international voice stays very low because the Flash DB and Flash Profile DB are combined with numbering-plan validation and ATI / SRI-SM cross-check, so the verdict is rarely based on a single signal. We expose the per-OTT FP rate in the operator dashboard so RA teams can audit it and tune sensitivity per app.

We always start in detect-only (mirror) for 30 days. That gives the operator a clean baseline of the bypass volume by OTT, range, and market — the evidence file used to negotiate with the OTT or set the rate card. Once policy is agreed, the firewall flips to inline enforcement (monetize, modify-CLI, or block). Hybrid (inline on monetized OTTs, mirror on emerging ones) is the common steady state.

Continuously. We run test installations of WhatsApp, Telegram, IMO, Viber, and a long tail of emerging apps in our Dubai lab and trigger OTP generation around the clock. Newly observed CLI ranges are added to the Flash DB within hours and pushed to all operator deployments. Operators also contribute back via CDR feedback — the loop is closed.

Possibly, if you go straight to block. Best practice is the phased path: 30 days detect-only, then CLI modification (the OTP becomes unreadable, the user is gently nudged back to SMS OTP over a few attempts), then monetization or block as appropriate per OTT.

The verdict produces a CDR / EDR with a configurable rate tag in the operator's billing schema. We support direct write to Amdocs, Ericsson Charging System, Huawei CBS, Oracle BRM, and several in-house BSS stacks. For real-time monetization, the firewall speaks Diameter Ro / Gy to OCS for per-event reservation and charge, which most operators wire up in the second phase of deployment.

Per inspected call setup, banded by monthly volume, with no Erlang fee. There is a one-time NRE for integration with the voice POI and a small annual maintenance fee covering Flash DB updates, the lab probe fleet, and quarterly tuning.

Yes. The lab tracks twenty-plus apps actively, including Botim, ToTok, Snapchat, Signal, LINE, KakaoTalk, WeChat, Skred, Element, and a long tail of regional apps. When a new app shows up in the bypass mix on any operator network, we onboard it into the probe fleet within a week. Operators can also request bespoke coverage for niche apps via the support portal.

Yes. Every verdict is signed, timestamped, and written to a tamper-evident audit store retained for the operator's regulatory window. We ship pre-built export templates for TRA (Lebanon), CST (KSA), NTRA (Egypt), TDRA (UAE), CRA (Qatar), TRA (Oman), TRA (Bahrain), TRC (Jordan), ARPT (Algeria), ANRT (Morocco), and INT-T (Tunisia). The export module also produces the quarterly bypass-traffic disclosure that several regulators now ask for.

Need the bypass-traffic disclosure template or a working session with our voice-firewall engineers? Measure flash-call leakage →

Related capabilities

SS7 SMS Firewall

Signaling firewall for SMS at the international STP.

Learn more

Local SMSC Firewall

Application-layer SMS filtering and sender control.

Learn more

SMSC Gateway

Hosted SMSC for A2P-monetized authentication.

Learn more

A2P SMS

Direct operator connections for monetized OTP delivery.

Learn more

Operator-grade

Protect and monetize at the signaling layer.

In-network SMS and SS7 firewalls stop grey routes and fraud at line rate while legitimate traffic flows untouched.

<5ms

Inspection

99.99%

Uptime

1,000+

MNO links

Talk to our carrier team

Operator briefing · NDA available

Stop carrying their traffic for free.

Thirty days of detection-only deployment reveals the bypass volume on your network. The commercial case writes itself.

Measure flash-call leakage Recover verification revenue

$ broadnet flash-call --mode detect --window 30d

Related guides & answers

Go deeper on the concepts behind this product.

Flash call detection for operators, at the voice ingress

From SS7 IAM to verdict, in under 100 ms.

A2P revenue, moving off your network in silence.

Detect the bypass. Monetize or block it. In one decision.

ML-based signature detection

OTT bypass identification

Monetize or block

Real-time decision

Reporting per OTT

Operator policy controls

Where flash calls meet STIR/SHAKEN attestation.

Attestation-aware verification

Spoofed voice-OTP caught

Legitimate flash calls kept

Per-OTT rules. Per-event CDRs. Maker-checker promoted.

Phase enforcement. Keep subscriber trust.

Detect only

Monetize

Enforce

Specifications

Operator-controlled. Subscriber-safe.

GSMA FS.19 aligned

No PII export

Full audit trail

Operator-set policy

What flash-call monetization looks like on the P&L.

Eight answers for the wholesale committee.

SS7 SMS Firewall

Local SMSC Firewall

SMSC Gateway

A2P SMS

Protect and monetize at the signaling layer.

Stop carrying their traffic for free.

What is Flash Call verification

What is OTP

OTP vs 2FA — what's the difference

What is voice OTP

From SS7 IAM
to verdict, in under 100 ms.

What flash-call monetization
looks like on the P&L.

Eight answers
for the wholesale committee.