# Flash call detection for operators, at the voice ingress - Canonical URL: https://www.broadnet.me/operators/flash-call - Language: en - Last updated: 2026-10-10 - Publisher: BroadNet (https://www.broadnet.me) - Markdown version of the page above, generated from the rendered page. Flash Call & Voice Firewall Stop OTT authentication bypass at the signaling layer. BroadNet's flash call firewall lets mobile operators detect and stop flash-call authentication bypass at the voice ingress, recovering verification revenue that OTT apps would otherwise route around A2P SMS. A voice firewall that detects flash-call authentication bypass from WhatsApp, Telegram, IMO, Viber and other OTTs. Multi-source detection — Flash DB, Flash Profile DB, ATI/SRI-SM, numbering-plan checks, CDR/EDR analysis — then block, modify CLI, or log-and-alert. [Measure flash-call leakage](https://www.broadnet.me/contact?topic=flash-call-leakage&product=flash-call) [Recover verification revenue](https://www.broadnet.me/contact?topic=verification-revenue&product=flash-call) MNO-grade GSMA Associate Member Revenue assurance built-in ![The BroadNet snow leopard watching a missed-call flash intercepted by a detection lattice](https://www.broadnet.me/marketing/art/op-flash-call.webp) BroadNet · flash-call verify Flash-call verification 200+ countries 1,000+ operator connections 99.99% SLA MNO CONNECTIONS 1,000+ Direct operator interconnects worldwide COUNTRIES COVERED 200+ Signaling and voice reach across markets YEARS OPERATOR-GRADE 23+ Carrier-grade infrastructure since 2003 ENGINEERING TEAM 300+ In-house signaling and voice engineers How it sits in the voice path ## From SS7 IAM to verdict, in under 100 ms. The firewall lives transparently at the international voice ingress. Every call setup is decoded, scored against Flash DB and Profile DB, cross-checked against ATI / SRI-SM, and a verdict is returned before the MSC ever rings the handset. 1. 01 · Ingress Int'l voice POI Inbound international call setup arrives at the voice gateway via SS7 IAM or SIP-I from carrier interconnects. no added hop 2. 02 · Decode Setup inspect ISUP IAM and CAP InitialDP decoded. A-number, B-number, range, expected setup duration extracted in flight. p99 < 20ms 3. 03 · Score Flash DB · Profile Flash DB lookup, Flash Profile DB behavioural match, ATI / SRI-SM cross-check, numbering-plan validation. p99 < 60ms 4. 04 · Verdict Policy engine Monetize · block · modify CLI · log. Per OTT, per range, per market. Operator-configurable. p99 < 20ms 5. 05 · Action MSC / Billing Clean calls pass to MSC. Flash calls billed per-event at the A2P-equivalent rate or dropped at setup. total < 100ms 6. ← signed CDR · per-OTT report · OCS bill 01 · Ingress Int'l voice POI Inbound international call setup arrives at the voice gateway via SS7 IAM or SIP-I from carrier interconnects. no added hop 02 · Decode Setup inspect ISUP IAM and CAP InitialDP decoded. A-number, B-number, range, expected setup duration extracted in flight. p99 < 20ms 03 · Score Flash DB · Profile Flash DB lookup, Flash Profile DB behavioural match, ATI / SRI-SM cross-check, numbering-plan validation. p99 < 60ms 04 · Verdict Policy engine Monetize · block · modify CLI · log. Per OTT, per range, per market. Operator-configurable. p99 < 20ms 05 · Action MSC / Billing Clean calls pass to MSC. Flash calls billed per-event at the A2P-equivalent rate or dropped at setup. total < 100ms Threat landscape ## A2P revenue, moving off your network in silence. A flash call is a missed call. The OTT app dials, reads the CLI digits as the verification code, and hangs up before the user answers. No SMS CDR is generated, no A2P billing applies — but your STP, your MSC and your voice POIs carry the load. Across many MENA and Africa corridors, flash calls can account for a large and growing share of authentication volume — monetized A2P traffic walking out the front door. How it works ## Detect the bypass. Monetize or block it. In one decision. Six capabilities working together at the international voice ingress. One verdict per call, under 100 ms, with full per-OTT visibility downstream. ### ML-based signature detection Behavioural classifiers trained on flash-call campaign patterns across operator networks. Call duration, attempt ratios, range velocity, A-number entropy. ### OTT bypass identification Source-attributed to WhatsApp, Telegram, IMO, Viber and emerging apps. Continuous active probing keeps the Flash DB ahead of new ranges. ### Monetize or block Charge per-event A2P-equivalent pricing, or drop the call. Operator decides per OTT, per range, per market. ### Real-time decision Verdict returned under 100 ms at international voice ingress. No impact on legitimate voice setup or POI capacity. ### Reporting per OTT WhatsApp vs. Telegram vs. Viber vs. IMO bypass volumes. Revenue at risk, recovered, and policy effectiveness by app. ### Operator policy controls Configurable per prefix, per range, per app, per time window. Phased enforcement: detect, modify-CLI, then block. Caller-ID authentication ## Where flash calls meet STIR/SHAKEN attestation. A flash call works because the subscriber trusts the caller ID they see. STIR/SHAKEN is the industry framework for proving that caller ID is genuine — signing the originating number and carrying an attestation level across SIP interconnects. BroadNet's flash-call firewall is attestation-aware, so operators can tell real verification from spoofed voice-OTP and keep the monetisation decision either way. ### Attestation-aware verification STIR/SHAKEN signs a call's originating number in a PASSporT token and carries an attestation level across SIP. Where your network carries it, the flash-call firewall reads attestation into the verdict alongside CLI and cadence. ### Spoofed voice-OTP caught Fake verification calls that spoof a bank or brand CLI fail origin and CLI-integrity checks at the boundary — the same gap STIR/SHAKEN is designed to close, enforced in markets that have not yet mandated it. ### Legitimate flash calls kept Genuine flash-call verification is separated from abuse per route, so operators keep the low-cost channel and the monetisation decision while blocking spoofed or pumped attempts. Policy & integration ## Per-OTT rules. Per-event CDRs. Maker-checker promoted. Declarative policy that your RA, wholesale, and signaling teams can read without a meeting. Verdicts surface as standard CDRs into your existing billing and RA pipelines. flashfw.operator.local · prod Example ``` 1# /etc/broadnet/flashfw/policy.d/whatsapp.yaml2# Monetize WhatsApp flash calls in UAE, KSA, Egypt3policy: whatsapp_flash_monetize4 match:5 flash_db_hit: true6 ott_attribution: whatsapp7 b_party_mcc: [424, 420, 602]8 setup_duration: "< 4s"9 action: bill10 rate_card:11 AED: 0.04012 SAR: 0.04013 EGP: 0.50014 cdr_tag: a2p_flash_monetized15 16policy: telegram_flash_modify_cli17 match:18 flash_db_hit: true19 ott_attribution: telegram20 action: modify_cli21 modify:22 a_number: "+0000000000" # OTP unreadable23 cdr_tag: flash_neutralized24 25policy: viber_block_freemium26 match:27 flash_db_hit: true28 ott_attribution: viber29 subscriber_tier: prepaid_freemium30 action: block31 cdr_tag: a2p_flash_dropped ``` Deployment ## Phase enforcement. Keep subscriber trust. Three deployment modes, sequenced. Most operators run detection-only for 30 days, then negotiate commercial monetization with the OTT before enforcing. 01 ### Detect only Mirrored ingress feed. Zero call impact. Build the evidence file — volume, OTT attribution, revenue at risk — for commercial discussions. 02 ### Monetize Per-event billing on detected flash calls. Operator-set rate card per OTT. Reconciled monthly against the same A2P portal. 03 ### Enforce Block, or modify CLI so the verification code is unreadable. Whitelist-aware. Reversible by policy at any time. At a glance ## Specifications Deployment International voice ingress · in-line or mirrored Detection sources Flash DB · Profile DB · ATI · SRI-SM · NP · CDR/EDR Decision latency < 100 ms p99 Actions Monetize · Block · Modify CLI · Log-Alert Flash DB update cadence Continuous — active probing + CDR feedback OTT coverage WhatsApp · Telegram · IMO · Viber · emerging apps Whitelist policy Operator-configurable per prefix/range Reporting Per-OTT volume · revenue impact · policy effect Integration STP · voice billing · NOC · operator portal Compliance GSMA FS.19 · operator-controlled subscriber privacy Compliance ## Operator-controlled. Subscriber-safe. BroadNet runs as an extension of the operator network. No third-party data processing, no PII leaves the perimeter, full audit trail on every policy decision. ### GSMA FS.19 aligned Signaling firewall guidelines for voice and authentication traffic. ### No PII export All inspection runs in-network. CDRs and metadata stay within the operator. ### Full audit trail Per-call decision log retained per the operator's retention policy. ### Operator-set policy Whitelist, rate card, enforcement mode — configured and reversible by the operator. Illustrative operator scenarios ## What flash-call monetization looks like on the P&L. GCC mobile operator MNO · GCC SA **Challenge** Flash-call bypass volume from OTT verification was eroding A2P revenue with no commercial evidence to confront the OTT or regulator. **Approach** A detect-only phase built a measured volume baseline that fed into regulator and OTT negotiations. VP wholesale & roaming South Asian telecom operator MNO · South Asia PK **Challenge** A blanket block on flash calls risked subscriber complaints and regulator escalations. **Approach** CLI modification gradually steered OTTs back to SMS OTP without breaking subscriber sign-in flows. Head of A2P strategy Levant MNO MNO · Levant LB **Challenge** A smaller network lacked the in-house data science capacity to classify OTT flash traffic. **Approach** BroadNet's Flash DB worked from day one, with portal reports flowing directly into the finance team's monthly settlement. Revenue assurance manager Operator due diligence ## Eight answers for the wholesale committee. The false-positive rate against legitimate international voice stays very low because the Flash DB and Flash Profile DB are combined with numbering-plan validation and ATI / SRI-SM cross-check, so the verdict is rarely based on a single signal. We expose the per-OTT FP rate in the operator dashboard so RA teams can audit it and tune sensitivity per app. We always start in detect-only (mirror) for 30 days. That gives the operator a clean baseline of the bypass volume by OTT, range, and market — the evidence file used to negotiate with the OTT or set the rate card. Once policy is agreed, the firewall flips to inline enforcement (monetize, modify-CLI, or block). Hybrid (inline on monetized OTTs, mirror on emerging ones) is the common steady state. Continuously. We run test installations of WhatsApp, Telegram, IMO, Viber, and a long tail of emerging apps in our Dubai lab and trigger OTP generation around the clock. Newly observed CLI ranges are added to the Flash DB within hours and pushed to all operator deployments. Operators also contribute back via CDR feedback — the loop is closed. Possibly, if you go straight to block. Best practice is the phased path: 30 days detect-only, then CLI modification (the OTP becomes unreadable, the user is gently nudged back to SMS OTP over a few attempts), then monetization or block as appropriate per OTT. The verdict produces a CDR / EDR with a configurable rate tag in the operator's billing schema. We support direct write to Amdocs, Ericsson Charging System, Huawei CBS, Oracle BRM, and several in-house BSS stacks. For real-time monetization, the firewall speaks Diameter Ro / Gy to OCS for per-event reservation and charge, which most operators wire up in the second phase of deployment. Per inspected call setup, banded by monthly volume, with no Erlang fee. There is a one-time NRE for integration with the voice POI and a small annual maintenance fee covering Flash DB updates, the lab probe fleet, and quarterly tuning. Yes. The lab tracks twenty-plus apps actively, including Botim, ToTok, Snapchat, Signal, LINE, KakaoTalk, WeChat, Skred, Element, and a long tail of regional apps. When a new app shows up in the bypass mix on any operator network, we onboard it into the probe fleet within a week. Operators can also request bespoke coverage for niche apps via the support portal. Yes. Every verdict is signed, timestamped, and written to a tamper-evident audit store retained for the operator's regulatory window. We ship pre-built export templates for TRA (Lebanon), CST (KSA), NTRA (Egypt), TDRA (UAE), CRA (Qatar), TRA (Oman), TRA (Bahrain), TRC (Jordan), ARPT (Algeria), ANRT (Morocco), and INT-T (Tunisia). The export module also produces the quarterly bypass-traffic disclosure that several regulators now ask for. Need the bypass-traffic disclosure template or a working session with our voice-firewall engineers? [Measure flash-call leakage →](https://www.broadnet.me/contact?topic=flash-call-leakage&product=flash-call) Related capabilities [SS7 SMS Firewall Signaling firewall for SMS at the international STP. Learn more](https://www.broadnet.me/operators/ss7-firewall) [Local SMSC Firewall Application-layer SMS filtering and sender control. Learn more](https://www.broadnet.me/operators/sms-firewall) [SMSC Gateway Hosted SMSC for A2P-monetized authentication. Learn more](https://www.broadnet.me/operators/smsc-gateway) [A2P SMS Direct operator connections for monetized OTP delivery. Learn more](https://www.broadnet.me/products/a2p-sms) Operator-grade ## Protect and monetize at the signaling layer. In-network SMS and SS7 firewalls stop grey routes and fraud at line rate while legitimate traffic flows untouched. <5ms Inspection 99.99% Uptime 1,000+ MNO links [Talk to our carrier team](https://www.broadnet.me/operators/contact) Operator briefing · NDA available ## Stop carrying their traffic for free. Thirty days of detection-only deployment reveals the bypass volume on your network. The commercial case writes itself. [Measure flash-call leakage](https://www.broadnet.me/contact?topic=flash-call-leakage&product=flash-call) [Recover verification revenue](https://www.broadnet.me/contact?topic=verification-revenue&product=flash-call) $ broadnet flash-call --mode detect --window 30d Related guides & answers Go deeper on the concepts behind this product. [What is Flash Call verification Read](https://www.broadnet.me/answers/what-is-flash-call-verification) [What is OTP Read](https://www.broadnet.me/answers/what-is-otp) [OTP vs 2FA — what's the difference Read](https://www.broadnet.me/answers/otp-vs-2fa) [What is voice OTP Read](https://www.broadnet.me/answers/voice-otp-explained)