# Nussknacker in Telecom > Real-time fraud management (FMS) and real-time marketing for mobile operators, built on Nussknacker, the open-source low-code decision engine on Apache Flink and Kafka. > It reads every call record, SMS, SIM change and top-up as it arrives, detects fraud schemes per SIM, device and customer, and acts through the operator's own systems. > Analysts build and change the detectors in a visual Designer, or by describing them to Nu Assistant, the built-in AI assistant. Page: https://telecom.nussknacker.io/ ## How it works - Sources: call records (CDR, xDR), SMS and A2P logs, SIM changes and HLR/HSS events, signalling firewall alerts, top-ups, roaming records, CRM and logins; from Kafka or from mediation. - Scenarios: windows and sessions per IMSI, IMEI and customer, rules and decision tables, ML and decision models next to the rules, lists. - Actions over Kafka or REST: barring, spend caps, SMS hold, cases in the existing fraud management system, offers, service upgrades, loyalty points. - Fraud and marketing analysts build and deploy scenarios in a visual Designer; every change is versioned and audited. - Shadow mode on real traffic before any automatic action; allowlists for VIP, corporate and M2M lines. ## Example: SIM box detection - A SIM box terminates international calls as cheap local calls through a bank of SIM cards, bypassing interconnect fees. - The scenario `detect-sim-boxing` counts calls per SIM over one hour and flags a SIM with at least 100 outbound calls, at least 95% of them outbound, to at least 50 different numbers. - It loads the subscriber profile and the device reputation as context, a decision model judges, and a HIGH verdict opens an analyst case with the events behind it. ## Example: SIM cloning - The scenario `detect-sim-cloning` keeps a trail of the cells each SIM was seen in and computes the speed implied by consecutive sightings. - A jump of more than 200 km at more than 800 km/h raises a location conflict for review, not a block: delayed or inaccurate cell data can look the same. ## Nu Assistant (AI) - Analysts describe a detector or a change in plain words; Nu Assistant builds or edits the scenario on the canvas, so the team sees exactly which nodes changed. - The change is then tested (decision models can be mocked in test cases) and deployed as a new version while monitoring keeps running. - Recording: [Real-time SIM box detection with Nu Assistant: add a live signal, test it, deploy](https://www.youtube.com/watch?v=aVyXF7uQrS8) (2:45, no audio). ## Fraud schemes it detects ### Subscriber and SIM - **SIM swap**: A criminal moves the victim's number to a new SIM to catch bank one-time passwords. Signals: SIM change, port-out request, new IMEI, bank OTP. Action: Alert, step up. - **eSIM swap**: The same takeover through an eSIM profile, in minutes and without a store visit. Signals: SM-DP+ download, app login, device change. Action: Step up, hold profile. - **SIM cloning**: Two devices answer for one SIM: a copied card or a hijacked identity. Signals: same IMSI, two cells, impossible travel, IMEI change. Action: Block SIM, alert. - **Subscription fraud**: Lines and devices taken on a fake or stolen identity, never paid for. Signals: onboarding, lines per ID, first bill. Action: Review before activation. - **Account takeover**: A stolen self-care login used to change details, order SIMs or move money. Signals: login location, new device, profile changes. Action: Lock and verify. ### Voice and interconnect - **IRSF**: Calls pumped to premium international ranges, revenue shared with the fraudster. Signals: risky ranges, rated cost, sustained exposure. Action: Bar international. - **SIM boxing**: International calls terminated as cheap local calls through banks of SIMs. Signals: 100+ outbound calls / h, 95% outbound, 50+ destinations, short calls. Action: Open a case. - **PBX hacking**: A hijacked business PBX dials premium numbers, usually over a weekend. Signals: trunk records, off-hours, new destinations. Action: Bar trunk, alert. ### Inbound calls and messaging - **Wangiri**: One-ring missed calls that bait callbacks to premium numbers. Signals: short call bursts, many victims, callbacks. Action: Block range, warn. - **SMS pumping**: Fake OTP and A2P traffic generated to earn termination fees. Signals: OTP without sign-up, verification rate, number sequences. Action: Throttle sender. - **CLI spoofing**: Calls from abroad wearing a national number to make scams believable. Signals: national CLI, international trunk. Action: Block or flag, alert. ### Network and roaming - **Roaming fraud**: Abuse abroad while the home network sees the records late. Signals: visited location update, real-time charging, NRTRDE. Action: Cap spend. - **Signalling attacks**: SS7, Diameter or GTP messages used to track phones or reroute SMS. Signals: firewall alerts, location mismatch. Action: Correlate, escalate to SOC. ## Real-time marketing - Campaigns react to customer events (roaming start, data running low, top-up) instead of a multi-day campaign cycle. - Channels: SMS, MMS, RCS, email, push and in-app, IVR, telesales; a contact policy with frequency caps, quiet hours and message limits. - No offer reaches a line under a fraud investigation, because fraud and marketing share one stream. ## Scale and deployment - In production at 350,000 events per second sustained, with peaks above 800,000, on Apache Flink reading from Kafka. - On-premises or in the operator's cloud, on Kubernetes; subscriber data stays in the operator's environment. - In production at iliad and Play for fraud management and real-time marketing. ## FAQ ### Does it replace our current fraud management system? It can, or it can sit next to it for the real-time cases first: SIM swap, IRSF, Wangiri, SMS pumping. Alerts go to your existing case management over Kafka or REST. ### What does a pilot need from us? An engineer to connect call records and SIM change events, and a fraud analyst to review the results. We bring example scenarios and run them with you in shadow mode. ### Is there a case management screen? Nussknacker is not a case manager. It opens and enriches cases in the one you use, over REST or Kafka, with the events behind each alert. ### Who writes the rules? Your fraud and marketing analysts, in the visual Designer. They can also describe a change to Nu Assistant in plain words: it edits the scenario on the canvas, so the team sees exactly what changed before testing and deploying it. Engineers connect the streams once. Roles decide who may deploy a change, including moving a rule from alert-only to automatic. ### Which data do we need to start? Call records and SIM change events cover the core threats: SIM swap, IRSF, Wangiri and SMS pumping. If they are already in Kafka, you can start quickly. If not, we connect to your mediation output. ### How do you handle false positives? In the pilot, every scenario starts in shadow mode on your traffic. You see what it would have done, add allowlists for VIP, corporate and M2M lines, and only then choose which actions run automatically. ### Can banks query SIM swap status? Nussknacker runs request-response scenarios, so a lookup such as "was this SIM changed recently" can be built on the same state the fraud rules use, including behind a CAMARA SIM Swap API. We can scope it in the demo. ### Does it do revenue assurance? It is not a reconciliation suite. It can add real-time controls next to your revenue assurance tool. ### Where does it run, and how is it operated? On-premises or in your cloud, on Kubernetes, next to your Kafka; subscriber data stays in your environment. Scenarios run as Flink jobs: checkpoints keep their state across restarts, parallelism scales each one, the Designer shows counts per node, any earlier version can be deployed again, and redeploys keep their state through Flink savepoints. ### Can we extend it? Yes. Custom components in Java or Scala, a REST API to deploy scenarios from your CI, scenarios exported as JSON for version control, and tests on recorded data. ### How is it licensed? The core is open source under Apache 2.0. Enterprise components and support come with a subscription. ## Contact - Book a demo or a shadow-mode pilot: https://telecom.nussknacker.io/#demo ## More - [Nussknacker](https://nussknacker.io/) - [Nussknacker on GitHub](https://github.com/TouK/nussknacker)