Telco Payment Fraud Detection Platform

Enterprise-grade real-time payment fraud detection system designed for Telco/MSP environments. Built to handle high-throughput transactions with sub-10ms decision latency.

The Challenge

Payment fraud in the telecommunications industry costs operators billions annually. Traditional batch-processing approaches fail because:

• Too slow: Fraudsters complete SIM activations, device purchases, and service upgrades before detection
• Too rigid: Static rules cannot adapt to evolving attack patterns like SIM farms and device resale fraud
• Poor UX: Blocking legitimate subscribers hurts revenue more than the fraud itself

The Solution

A real-time decisioning engine that:

Key Features

Real-Time Decisioning

Every transaction receives an instant decision:

ALLOW → Proceed normally
FRICTION → Request additional verification (3DS, OTP)
REVIEW → Queue for manual review
BLOCK → Decline transaction

Multi-Signal Detection

The platform analyzes five distinct payment fraud patterns targeting Telco/MSP:

1. Card Testing - Rapid small topups probing stolen card validity
2. SIM Farm / Velocity Attacks - Multiple SIM activations from same card (fraud ring indicator)
3. Device Resale Fraud - Subsidized device upgrades with intent to resell
4. Bot/Automation - Emulators, datacenter IPs, Tor exit nodes (automated fraud)
5. Friendly Fraud - Historical dispute patterns and subscriber behavioral signals

Configurable Policy Engine

Business rules are defined in YAML and can be updated without deployment:

thresholds:
  block_score: 85
  review_score: 60
  friction_score: 35

rules:
  - name: device_upgrade_new_subscriber
    condition: event_subtype = device_upgrade AND subscriber_age_days < 30
    action: REVIEW
  - name: high_risk_sim_swap
    condition: event_subtype = sim_swap
    action: REVIEW

Architecture at a Glance

┌─────────────────────────────────────────────────────────────┐
│                      Payment Gateway                         │
└─────────────────────────────┬───────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│                     Fraud Detection API                      │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌──────────┐    │
│  │ Feature  │  │Detection │  │  Risk    │  │  Policy  │    │
│  │ Engine   │  │ Engine   │  │ Scoring  │  │  Engine  │    │
│  └────┬─────┘  └────┬─────┘  └────┬─────┘  └────┬─────┘    │
└───────┼─────────────┼─────────────┼─────────────┼──────────┘
        │             │             │             │
   ┌────▼────┐   ┌────▼────┐   ┌────▼────┐   ┌────▼────┐
   │  Redis  │   │ Detect  │   │  Score  │   │  YAML   │
   │Counters │   │ Signals │   │ Combine │   │ Config  │
   └─────────┘   └─────────┘   └─────────┘   └─────────┘
                              │
                              ▼
                    ┌─────────────────┐
                    │   PostgreSQL    │
                    │ Evidence Vault  │
                    └─────────────────┘

Technical Stack

Results

The Sprint-1 MVP delivers:

• 5 detection signals covering major fraud patterns
• Sub-10ms latency for decision responses
• Hot-reload policy updates without restarts
• Complete evidence capture for dispute resolution
• 45+ unit tests with comprehensive coverage
• Load tested to 1000+ requests/second

Author: Uday Tamma