CLI validation & spoof detection
Calling-line identity is validated against origin and route integrity, so spoofed CLIs impersonating trusted brands are flagged before they ring a subscriber.
For mobile & voice operators
Silence robocalls and voice fraud.
A voice firewall at the operator boundary — robocall detection, Wangiri one-ring and IRSF screening, CLI spoofing detection and flash-call abuse control. SIP-side scoring with SS7 CAP corroboration, so fraud is held before it rings a subscriber or lands on the settlement bill.
BroadNet · voice firewall
Voice signalling
SIP / SS7
voice layer
200+
countries
99.99%
SLA
The voice-fraud landscape
Five voice abuses, one boundary.
Robocalls, Wangiri, IRSF, CLI spoofing and flash-call abuse are the same economic attack across different call flows — a billable or trust-eroding event manufactured at scale. The voice firewall catches each at the layer where it shows.
Robocalls & spam floods
SIP · high-volume outbound
Automated, high-volume call floods that erode subscriber trust and drive complaints. Pattern-scored by cadence, fan-out and origin so campaigns are throttled before they reach handsets.
Wangiri one-ring
SS7 / SIP · missed-call bait
Single-ring calls that bait subscribers into calling back a premium range. The loop is detected by the tell-tale one-ring burst pattern before the return leg becomes a settlement liability.
IRSF revenue-share fraud
Interconnect · premium ranges
International revenue-share fraud terminates manufactured minutes on premium ranges the fraudster profits from. Premium-range screening and velocity scoring hold anomalous traffic before it settles.
CLI spoofing
SIP header · CAP
Fabricated calling-line identities that impersonate banks, brands and government to defraud subscribers. Origin and CLI integrity are validated at the boundary.
Flash-call abuse
Voice OTP · verification
Silent-call verification abused to generate billable traffic or probe number ranges. Abuse patterns are separated from legitimate flash-call verification and controlled per route.
Read more: Wangiri one-ring fraud · IRSF explained · What is flash-call verification?
How BroadNet mitigates it
Six controls on the voice boundary.
Wangiri loop detection
One-ring burst campaigns are recognised by their distinctive missed-call signature and blocked before the return leg terminates on a premium range.
IRSF & premium-range screening
Traffic terminating on known premium and test/unallocated ranges is screened and velocity-scored, so manufactured minutes are held before they become an interconnect bill.
Robocall pattern scoring
Call cadence, fan-out, duration and origin behaviour are scored per route, so automated spam floods are throttled while legitimate calling passes untouched.
SS7 / CAP corroboration
Signalling-layer inspection of CAP InitialDP and related operations corroborates the SIP-side verdict, catching fraud that reveals itself at the signalling layer.
Settlement-risk alerts
Anomalous termination patterns raise alerts to fraud and revenue-assurance teams early — including roaming abuse whose cost otherwise surfaces weeks later through clearing.
Threat coverage
Every voice abuse, the control, the outcome.
| Attack vector | BroadNet control | Outcome |
|---|---|---|
| Robocall spam floods | Pattern scoring on call cadence, fan-out, duration and origin, per route. | Automated floods throttled before they reach handsets; legitimate calling passes untouched. |
| Wangiri one-ring bait | Detection of the tell-tale one-ring burst signature. | The return leg is blocked before it terminates on a premium range. |
| IRSF revenue-share fraud | Premium and test/unallocated range screening with velocity scoring. | Manufactured minutes held before they settle up the interconnect chain. |
| CLI spoofing of banks & brands | CLI and origin integrity validated inline at the boundary. | Fabricated caller identities flagged before they ring a subscriber. |
| Flash-call verification abuse | Genuine flash-call OTP separated from abuse, enforced per route. | The low-cost verification channel is kept; billable abuse is controlled. |
Caller-ID authentication
Aligned to STIR/SHAKEN caller-ID attestation.
STIR/SHAKEN is the industry framework for proving a call's caller ID is genuine: the IETF STIR standards sign the originating number in a PASSporT token, and the SHAKEN profile carries it across SIP interconnects with an attestation level — A (full), B (partial) or C (gateway). BroadNet's voice firewall is attestation-aware, so operators moving toward signed caller ID get one control point for both fraud scoring and authentication policy.
Attestation-aware policy
Where your network carries SHAKEN attestation, the firewall reads it into the same decision that scores cadence, origin and CLI — so unattested or low-attestation calls can be treated consistently, per route.
CLI integrity at the boundary
In markets without full STIR/SHAKEN deployment, origin and CLI integrity are still validated inline — closing the caller-ID spoofing gap the framework is designed to remove.
Regulator-ready records
Every verdict — attested, unattested, spoofed or blocked — is logged with its contributing signals, giving a defensible record for regulators enforcing caller-ID authentication mandates.
Where it sits
Inline on SIP, corroborated on SS7.
Inline at the SIP boundary
A voice firewall on the SBC / SIP path scores calls in real time — validating CLI and origin and applying per-route policy before a call is completed.
SS7 CAP corroboration
Inline at the STP for CAP InitialDP and related operations, so signalling-layer voice fraud reinforces or tempers the SIP-side decision.
Mirror, then inline
Rollouts typically begin in detect-and-alert mode to baseline legitimate calling, then move to inline enforcement once the false-positive envelope is agreed.
Per-route policy
Policy is expressed per route and per partner, so bilateral agreements, premium-range rules and roaming controls are enforced from one engine with a shared audit trail.
Why operators pick BroadNet
Voice and signalling, under one policy engine.
Voice and signalling in one stack
Robocall mitigation runs alongside BroadNet's signalling firewall and programmable voice — SIP-side and SS7-side controls under one policy engine.
Global interconnect view
1,000+ operator connections across 200+ countries give visibility into emerging Wangiri and IRSF campaigns as they move between markets.
Carrier-grade since 2003
Two decades running voice and messaging infrastructure for carriers, with a 99.99% platform SLA and a 24/7 carrier NOC behind every deployment.
Auditable by default
Every call verdict is logged with the contributing signals and the policy that applied, so fraud and RA teams — and regulators — get a defensible record.
Operator due diligence
Questions operators ask.
What does robocall mitigation cover?
It is a voice firewall that controls voice-side fraud and abuse at the operator boundary — robocall spam floods, Wangiri one-ring campaigns, IRSF (international revenue-share fraud), CLI spoofing and flash-call abuse. Calls are scored on origin, CLI integrity, cadence and destination, with SS7 CAP corroboration, before they complete.
How are Wangiri and IRSF related, and how do you stop them?
Both are revenue-share fraud: a billable event terminated on a range the fraudster profits from. Wangiri is a one-ring bait that tricks a subscriber into calling a premium number back; IRSF drives manufactured minutes onto premium ranges directly. BroadNet detects the one-ring burst signature, screens premium and test/unallocated ranges, and velocity-scores termination patterns so the traffic is held before it settles up the interconnect chain.
Can you detect CLI spoofing that impersonates banks and brands?
Yes. Calling-line identity is validated against origin and route integrity at the boundary, so a fabricated CLI impersonating a trusted institution is flagged before it rings the subscriber. This pairs with sender-ID controls on the messaging side, so brand impersonation is covered across both bearers.
How does this relate to flash-call verification?
Flash-call verification is a legitimate BroadNet product — silent-call OTP that verifies the last digits of a dropped call. Robocall mitigation separates genuine flash-call verification from abuse, so operators keep the low-cost verification channel while controlling attempts to misuse it for billable traffic or range probing.
How is it deployed and does it slow down calling?
The voice firewall sits inline on the SBC / SIP path with SS7 CAP corroboration. Rollouts usually start in detect-and-alert mode to baseline legitimate calling, then move to inline enforcement once the false-positive envelope is agreed. Legitimate calls pass untouched; policy is enforced per route with a shared audit trail.
Operator-grade
Stop the fraud before it rings.
A voice firewall that scores calls on origin, CLI integrity, cadence and destination — throttling robocalls and holding Wangiri and IRSF traffic before it settles.
SIP / SS7
voice layer
1,000+
direct operator connections
99.99%
SLA
Protect subscribers and settlement.
An operator briefing sizes your voice-fraud exposure, walks the detection controls, and sets out the detect-then-inline deployment path — engineering led, no sales fluff.
Related guides & answers
Go deeper on the concepts behind this product.