Sharp escalation in scam calls originating from foreign phone numbers
Russian Mobile Operator T2 Faces Increase in International Fraudulent Traffic
Russian mobile operator T2 has reported a significant increase in fraudulent traffic from international numbers, according to the company's press service. This surge is primarily driven by the exploitation of weak anti-fraud measures, international telecom fraud networks, and the strategic use of number spoofing and bot-driven attack campaigns.
Causes of the Issue
The increase in fraudulent traffic is due in part to the inadequate adoption of robust protocols like STIR/SHAKEN, which are widely deployed in the U.S. and Canada to flag and block spoofed calls. Russia's own Anti-Fraud system exists but is scarcely utilized, mostly limited to narrow cases, leaving operators like T2 vulnerable to cross-border fraud attempts and number spoofing.
Fraudsters exploit this gap by routing calls through international number pools to bypass local detection, creating surges in fraudulent traffic. The global scam ecosystem includes complex scams like payment gateway breaches, highlighting the scale of transnational fraud networks impacting telephony infrastructure.
Current Trends
The surge in fraudulent traffic is characterized by sophisticated, AI-driven spoofing and fraud campaigns. These campaigns often leverage behavioral analytics gaps. Deployment of proprietary "Fraud Matrix" and frameworks by Russian cybersecurity firms to detect and mitigate fraud is growing but has yet to become the industry standard.
Use of app-level defenses on platforms like Telegram, common in Russian digital communications, reflects parallel but incomplete protection efforts. However, the tightly controlled Russian internet and telecom environment does not fully prevent insider or external fraud using international numbers to bypass controls.
Countermeasures
To effectively combat this issue, several measures are recommended. Adopting and adapting international anti-spoofing protocols (like STIR/SHAKEN) is crucial to more effectively identify and block fraudulent traffic at the operator level.
Increased use of behavioral analytics, AI-based detection systems, and machine-learning filters tailored for the Russian telecom context can help recognize anomalous call patterns. Collaborative investigations and intelligence sharing between providers and law enforcement are essential to tackle infrastructure abuse and rapidly respond to emerging fraud schemes.
Regulatory push toward certification frameworks (e.g., FSTEC-mandated hardware/software approvals) can enhance security, but with caveats regarding access and transparency. User-level education and app-based spam filters continue to be valuable but insufficient alone in controlling the influx of international number fraud.
In July, 3% of calls were from international numbers, 40% were generated by SIM-box and virtual PBX, and the remaining 57% were on messengers. The company analyses the channels of delivery of fraudulent messages based on its own data on blocked calls and investigations following clients' complaints about fraud. Fraudsters are using calls with international numbers as an alternative to number spoofing calls.
In summary, the rise in fraudulent traffic from international numbers on T2 results from gaps in anti-fraud adoption and growing sophistication of global fraud networks exploiting Russian telecom vulnerabilities. While Russia has developed some internal tools and policies for fraud detection and network control, they lag behind global standards in blocking spoofed international traffic comprehensively. Strengthened protocol adoption, AI analytics, cross-agency coordination, and regulatory enforcement represent the crucial next steps for effective countermeasures.
