A 40-cent toll, multiplied at scale, becomes a multi-billion dollar fraud.
A 40-cent toll fraud sounds trivial, until it runs at scale. Arkose Labs COO Frank Teruel breaks down SMS toll fraud, also known as international revenue sharing fraud, a scheme that has quietly become a multi-billion dollar problem while almost never triggering a security alert.
About the speaker
Let me give you the three biggest kinds of attacks we've seen in the last year. SMS toll fraud. So you go to register for an account. Enter your number. We'll send you a code. Use that code to complete your onboarding.
That is a very interesting fraud because what happens is the bots get the numbers through aggregators. It's also called international revenue sharing fraud because the carriers in some cases collude with the bad guys, the bad guys split the revenue.
Here's what's interesting about that one. It never gets to the security people 'cause they never come back. They don't try to take over the account. They simply just cash out and go.
They use numbers in places like Vietnam or faraway numbers, where you're talking 40, 50 cents a toll. Imagine doing that at scale.
Let me give you the three biggest kinds of attacks we've seen in the last year. SMS toll fraud: you go to register for an account, enter your number, we'll send you a code, and you use that code to complete your onboarding. That is a very interesting fraud because what happens is the bots get the numbers through aggregators — it's also called international revenue sharing fraud, because the carriers in some cases collude with the bad guys and split the revenue. You get into a flow and start signing up for accounts en masse. Say it's your favorite rideshare company — you start pounding this thing, it takes all the numbers and puts them in, and the minute it hits submit, that toll has run. That money goes back through the provider, all the way back to the carrier, and ultimately to the person that provisioned the numbers.
That is billions of dollars a year. A few years ago this fraud probably wasn't that prominent — today it's a multi-billion dollar fraud, and it's all around account registration. Here's what's interesting about that one: it never gets to the security people, because they never come back. They don't try to take over the account, they simply cash out and go. They use numbers in places like Vietnam, or other faraway numbers, where you're talking 40, 50 cents a toll. Imagine doing that at scale.
Stopping bots, AI agents, and fraud before they reach your users.
