Stop the box. Recover the revenue.
SIM-box origination steals international-termination revenue from operators and floods the network with low-trust A2P traffic. BroadNet detects it with ML behavioural fingerprinting + signalling-edge inspection — and routes the recovered traffic back through your A2P monetisation engine.
Detection signals
Threshold-based detection alone misses modern SIM-box estates that rotate IMEIs and SIMs in cadence. BroadNet scores the meta-pattern.
Per-IMSI / per-IMEI / per-MSISDN models score each subscriber on call cadence, destination diversity, mobility patterns, on-net/off-net ratio and roaming history. SIM-box behaviour looks nothing like a real subscriber once you score it correctly.
MAP / Diameter signatures at the STP and DRA. IMEI re-use across SIMs, abnormal location updates, and 'always-on, never-roaming, only-MT-from-international' patterns surface in real time.
Voice CDRs from the MSC cross-referenced with A2P DLRs from the SMSC. Suspect SIMs that show high MT-only voice from international origins while sending domestic A2P are flagged and quarantined.
Per-detection revenue-recovery estimate based on the operator's own interconnect rate card. Lets finance + fraud teams prioritise the largest leaks first instead of chasing every false positive.
Patterns we detect
Subscriber stays attached to the same cell tower 24/7 with no realistic mobility — characteristic of a SIM rack sitting in a building.
Receives a high volume of international mobile-terminated voice but originates only domestic mobile-originated calls — the classic SIM-box revenue-arbitrage pattern.
Spikes in call volume during overnight hours when the SIM owner shouldn't be active — common when the box owner is running a separate timezone's traffic through the rack.
Same IMEI hopping across many SIMs (or vice versa) on a regular cadence to dodge legacy threshold rules. Behavioural model picks up the meta-pattern.
SIM boxes never touch an inline hop. BroadNet mirrors your signalling, CDR and DLR feeds, correlates six evidence sources per subscriber, scores them with a rule engine and a behavioural model in parallel, then quarantines confirmed estates and re-routes the bypassed traffic back to billable A2P.
Signalling (SS7/MAP), CDRs and DLRs are mirrored to BroadNet — no inline element, no added hop, no risk to live traffic.
Six sources joined per subscriber, IMEI and route — velocity, cell spread, call/SMS ratio, silent periods, device and A-number reuse.
A deterministic rule engine and a behavioural model run in parallel — explainable thresholds for the regulator, ML for rotating estates under any fixed limit.
Confirmed boxes are quarantined or barred under maker-checker control, with a defensible evidence pack attached to every action.
Bypassed international voice and A2P is pushed back onto billable, on-net routes — with a per-event CDR your finance team can settle.
Signalling (SS7/MAP), CDRs and DLRs are mirrored to BroadNet — no inline element, no added hop, no risk to live traffic.
Six sources joined per subscriber, IMEI and route — velocity, cell spread, call/SMS ratio, silent periods, device and A-number reuse.
A deterministic rule engine and a behavioural model run in parallel — explainable thresholds for the regulator, ML for rotating estates under any fixed limit.
Confirmed boxes are quarantined or barred under maker-checker control, with a defensible evidence pack attached to every action.
Bypassed international voice and A2P is pushed back onto billable, on-net routes — with a per-event CDR your finance team can settle.
Inside the engine
A deterministic rule engine and a behavioural model evaluate every subscriber at the same time. Thresholds give explainable verdicts you can defend to a regulator; the model catches the rotating estates that stay under any fixed threshold. Their outputs are fused into a single quarantine decision.
Hard, explainable checks that fire the moment a SIM crosses a policy line — IMEI/TAC deny-lists, velocity ceilings, on-net/off-net ratio limits and test-call-generation corroboration. Explainable enough to defend a termination decision to a subscriber or a regulator.
Per-IMSI / per-IMEI / per-MSISDN models that score the meta-pattern a threshold rule can't express — SIM and IMEI rotation in cadence, off-hours surges, and the always-on, never-roaming, only-MT-from-international shape a real subscriber never produces. Retrains nightly on your own labelled ground truth.
Where the evidence comes from
MAP location-update and SRI patterns at the STP, Diameter at the DRA. SIM boxes betray themselves with abnormal update cadence and an attached-forever, never-roaming signature.
Type-allocation-code checks catch modem-class hardware masquerading as handsets, and IMEI re-use across many SIMs surfaces the rack behind the numbers.
Voice CDRs from the MSC are correlated with A2P DLRs from the SMSC. A SIM taking high international-MT voice while pushing domestic A2P is the arbitrage tell.
Real subscribers move. A SIM anchored to one cell 24/7 with no realistic handover pattern scores as stationary hardware, not a person.
SIM/IMEI hopping on a regular schedule to dodge legacy thresholds is itself a signature. The model scores the rotation, not the individual identifiers.
Each detection carries an international-termination recovery estimate from your own interconnect rate card, so RA and fraud teams chase the biggest leaks first.
Passive by default · signalling + CDR + DLR fusion
Deployment model
We deploy in mirror mode on a tap at the SMSC and STP edges. Your RA + fraud teams set the policy lock once the baseline is signed off — no risk to delivery during the learning window.
Nodes flip to inline at carrier-grade availability. Flagged SIMs get quarantined per the agreed policy — silent quarantine, throttling, or terminate-with-reason — depending on the operator's regulator stance.
The model retrains nightly on your operator's own labelled ground truth (RA disputes, complaint queues, regulator advisories) blended with anonymised signal from BroadNet's global feed.
Detected fraud is routed back through your A2P monetisation engine. Grey-route enterprises become billed enterprises; international-voice termination revenue stays on the operator's books.
Detection is half the answer. The other half is converting the recovered grey-route into billed enterprise traffic through BroadNet's A2P monetisation engine — which is why operators run the two side-by-side.
SIM-box arbitrage that bypasses your IGW gets killed at the signalling edge. The international termination minutes stay on the operator's books at the agreed wholesale rate.
Detected senders are pulled into the A2P monetisation funnel. Where SMS firewall + sender-ID registry are deployed together, grey traffic that was escaping billing is moved onto billed A2P routes.
Lower complaint volumes on spam SMS = better NPS = lower churn. Hard to measure but consistently visible in CSAT panels post-deployment.
Operator due diligence
A SIM box is a rack of prepaid SIMs that terminates international voice as if it were local mobile-originated traffic, bypassing the licensed international gateway. The operator loses the international-termination fee it should have billed, and the network fills with low-trust SIMs that also pump grey-route A2P. Detection recovers both the termination revenue and the A2P revenue.
Threshold rules catch yesterday's SIM boxes. Modern estates rotate SIMs and IMEIs in cadence specifically to stay under any fixed threshold. BroadNet runs those deterministic rules in parallel with a behavioural model that scores the meta-pattern — the rotation itself, the mobility shape, the international-MT/domestic-MO ratio — so estates that evade thresholds still get caught.
TCG is one corroborating signal, not the whole system. Probe calls confirm a suspected route, but they are expensive, slow and easy to evade with SIM rotation. BroadNet's primary detection is passive behavioural and signalling analysis over your live CDR and signalling feeds; TCG hits simply reinforce an already-scored verdict.
The model scores the full behavioural fingerprint, not a single metric. A legitimate heavy user still moves, still roams, still originates a normal mix of calls. SIM-box behaviour is distinguishable once you score mobility, cadence, IMEI/TAC class and the CDR/DLR cross-check together. Every quarantine ships with feature attribution your fraud team can review before enforcement.
Rollouts start in passive-mirror mode on a tap at the SMSC and STP edges for a 7-21 day baseline, with zero delivery risk. Once your RA and fraud teams sign the policy lock, nodes flip to inline at 5x9 availability. Enforcement is configurable — silent quarantine, throttle, or terminate-with-reason — to match your regulator's stance.
Two ways. Killing SIM-box arbitrage at the signalling edge keeps international-termination minutes on your books at the wholesale rate. And detected grey-route enterprises are routed into BroadNet's A2P monetisation engine, converting unbilled senders into billed enterprises — which is why operators run SIM-box detection and A2P monetisation side by side.
Read access to voice CDRs from the MSC, A2P DLRs from the SMSC, and a signalling feed at the STP (SS7/MAP) and DRA (Diameter). It sits alongside your existing SMS and signalling firewalls and shares the sender-ID registry, so it augments rather than replaces the estate you already run.
It retrains nightly on your operator's own labelled ground truth — RA disputes, complaint queues and regulator advisories — blended with anonymised signal from BroadNet's global feed. New evasion tactics seen on one network harden detection across the fleet without exposing any operator's data.
In-network SMS and SS7 firewalls stop grey routes and fraud at line rate while legitimate traffic flows untouched.
Operator briefing covers deployment model, integration timeline, ground-truth labelling workflow and a model recovery-revenue forecast based on your CDR mix.
Go deeper on the concepts behind this product.
