In production atFraud management and real-time marketing at iliad and Play.
The cost of late
$41.8 billion lost to telecom fraud in 2025.1
Much of it is lost in the gap between the first fraudulent event and the moment a rule acts on it.
- ~$38M in 16 minOne SIM swap at a US operator; a $33M award against the operator.³
- Up to €40k per hourRoaming fraud, severe cases.⁴
- NZ$35k in one weekendHacked business PBXs dialling premium numbers.⁶
Inside Nussknacker
A SIM box hides in your network. One scenario finds it.
International calls enter through the internet and leave a box of SIM cards as cheap local calls. The call records give it away: every SIM in the box calls out, never receives, and dials far too many numbers.
Scenarios›detect-sim-boxingRUNNINGLIVE · 1,180 call records/sThe first ten nodes of the scenario, as the Designer draws them. Counters are synthetic.
Threat atlas
Thirteen schemes, and many more, on one stream.
Where fraud enters your network. Pick a scheme to see what gives it away and what the scenario does.
How a SIM swap unfolds
SIM swap detection before the one-time password is used.
Nussknacker joins the SIM change, the new device and the bank's OTP per number as they arrive. It can alert an analyst, hold the SMS through your SMS firewall, or feed a SIM swap lookup for banks, depending on what you allow.
- Step 1SIM replaced in a store, ID shownSIM change noted
- Step 2New SIM appears in a new device (new IMEI)+ new IMEI on the line
- Step 3Bank sends a one-time password+ OTP from a bank
- Seconds laterWaits for the SMSALERT · STEP UP
- Hours laterA batch job or a hand-tuned vendor rule flags the swap.The account is already empty.
Illustrative sequence, not data from a real case.
SIM cloning
One SIM, two places at once.
A phone hands over from tower to tower at the speed of a car. When the same IMSI shows up hundreds of kilometres away a few minutes later, a second card is answering for it. Nussknacker checks every move against the previous one, per SIM, as the records arrive.
- 10:02:11cell 2201
- 10:09:41cell 22047 km56 km/h ✓
- 10:16:11cell 22078 km74 km/h ✓
- 10:18:11cell 8150540 km16,200 km/h
- get trail
- velocity
- implied speed
- location conflict requires review
- open case
#velocity.distanceKm > 200.0 &&#impliedSpeedKmh > 800.0AINu Assistant
Say what to catch. Watch the scenario build.
Analysts describe a detector or a change in plain words. Nu Assistant builds it on the canvas, node by node, so the team sees exactly what changed before it is tested and deployed.
Scenarios›detect-sim-boxingDRAFTRe-enacted from the recording below. Node names as in the scenario; the conversation is shortened.
Add a live signal to a running detector, test it, deploy.
The fraud team asks Nu Assistant for one more signal, the number of cells each SIM was seen in during the last hour. It adds the aggregate, passes the value to the decision model, and the analyst tests the HIGH case with a mocked model before deploying. Monitoring keeps running the whole time.
Fraud management
Real-time telecom fraud management, owned by your fraud team.
Analysts write a rule on Friday and have it running in shadow mode the same evening. It blocks a customer only when someone with deploy rights switches it on.
- Writein the Designer or with Nu Assistant
- Teston recorded traffic or from CI
- Shadownext to production
- Alertan analyst decides
- Automateonly where you allow
Drag nodes, write expressions and decision tables, test on recorded traffic, deploy a new version.
Connect Kafka topics, add enrichers, model endpoints and custom components, set roles and environments.
- Real time, not batchScored as events arrive.
- Patterns, not single recordsWindows per IMSI, IMEI, customer.
- ML next to rulesYour models in the same decision.
- Fewer false positivesAllowlists for VIP, corporate, M2M.
- Verdicts come backAnalysts tune thresholds and labels.
- Every change auditedVersions, authors, diffs.
On Kafka and Flink.
Next to the stack you already run.
Apache Kafka
Confluent
Redpanda
Aiven
Azure Event Hubs
MLflow
Databricks Unity Catalog
PostgreSQL
Snowflake
Amazon Redshift
OpenAPI- Apache Kafka
- Confluent
- Redpanda
- Aiven
- Azure Event Hubs
- MLflow
- Databricks Unity Catalog
- PostgreSQL
- Snowflake
- Amazon Redshift
- OpenAPI
How it fits your network
Reads what your network produces. Acts through what you already run.
From Kafka or your mediation in, over Kafka or REST out, through the interfaces you already expose.
on Kafka and FlinkReal-time marketing
Real-time marketing on the same events.
The same events that catch fraud sell roaming packs and top-ups the moment a customer needs them. Marketers build the campaigns themselves, and no offer reaches a line under investigation.
- WhenLands abroadRCSEU data pack, one tap
- WhenData at 90%PushTop-up offer
- WhenTops upLoyaltyBonus points added
Contact policyfrequency capsquiet hoursmessage limitsstreaming and batch
Carrier scale
A whole network's traffic, not a sample of it.
On Apache Flink, straight from Kafka, in production at 350,000 events per second, with peaks above 800,000.
- On-premises or your cloudSubscriber data stays with you.
- SSO, roles and auditOpenID Connect or OAuth2 sign-in, roles per category, every deploy versioned.
- Your modelsMLflow models or any model behind REST, inside the decision.
- Open-source coreApache 2.0 on GitHub. Enterprise components and support by subscription.
Questions operators ask
Does it replace our current fraud management system?
It can, or it can sit next to it for the real-time cases first: SIM swap, IRSF, Wangiri, SMS pumping. Alerts go to your existing case management over Kafka or REST.
What does a pilot need from us?
An engineer to connect call records and SIM change events, and a fraud analyst to review the results. We bring example scenarios and run them with you in shadow mode.
Is there a case management screen?
Nussknacker is not a case manager. It opens and enriches cases in the one you use, over REST or Kafka, with the events behind each alert.
Who writes the rules?
Your fraud and marketing analysts, in the visual Designer. They can also describe a change to Nu Assistant in plain words: it edits the scenario on the canvas, so the team sees exactly what changed before testing and deploying it. Engineers connect the streams once. Roles decide who may deploy a change, including moving a rule from alert-only to automatic.
Which data do we need to start?
Call records and SIM change events cover the core threats: SIM swap, IRSF, Wangiri and SMS pumping. If they are already in Kafka, you can start quickly. If not, we connect to your mediation output.
How do you handle false positives?
In the pilot, every scenario starts in shadow mode on your traffic. You see what it would have done, add allowlists for VIP, corporate and M2M lines, and only then choose which actions run automatically.
Can banks query SIM swap status?
Nussknacker runs request-response scenarios, so a lookup such as "was this SIM changed recently" can be built on the same state the fraud rules use, including behind a CAMARA SIM Swap API. We can scope it in the demo.
Does it do revenue assurance?
It is not a reconciliation suite. It can add real-time controls next to your revenue assurance tool.
Where does it run, and how is it operated?
On-premises or in your cloud, on Kubernetes, next to your Kafka; subscriber data stays in your environment. Scenarios run as Flink jobs: checkpoints keep their state across restarts, parallelism scales each one, the Designer shows counts per node, any earlier version can be deployed again, and redeploys keep their state through Flink savepoints.
Can we extend it?
Yes. Custom components in Java or Scala, a REST API to deploy scenarios from your CI, scenarios exported as JSON for version control, and tests on recorded data.
How is it licensed?
The core is open source under Apache 2.0. Enterprise components and support come with a subscription.