Real Time Fraud Detection Solution

Industry: Telecommunications

Services: wireless voice, messaging, and mobile internet

Company / Brand: Play (P4 Sp. z o.o. part of Iliad Group)

Customer base: 13 million active users

Solution highlights

• 70+ Nussknacker scenarios for fraud detection and problematic usage patterns 
• 200 000 events per second at peak

see demo

The challenge

Play needed a fraud detection system that would allow:

1. Rapid development and customization to combat evolving fraud
2. Real-time detection (replacing their existing batch system)
3. Handling of high-volume telecom data streams using tools like Flink
4. Non-technical fraud experts to develop detection algorithms through visual tools, without needing to understand streaming or complex programming

The key requirements were quick adaptability, real-time processing, scalability for telecom data, and usability for domain experts.

Solution Highlights

→ Eliminated the delay in fraud detection from batch processing
→ Addressed complex SIM card fraud schemes that were hard to detect
→ Reduced financial losses from fraudulent activities
→ Solved the challenge of managing complex fraud detection rules

Nussknacker Fraud Detection Features

• Tool for non-technical users. Nussknacker simplifies complex technical operations through its visual interface. Users can build decision algorithms using intuitive graphs instead of code, while core business rules are managed through easily modifiable decision tables. This enables fraud teams to focus on detection strategies rather than technical implementation, with built-in support for Flink processing, time windows, data enrichment, and API integration.

• Teams can focus on fraud detection, not the implementation.. Play's fraud team can now rapidly implement detection scenarios without technical barriers, allowing them to prioritize fraud intelligence and strategy over implementation details.

• Fitted to challenges. Nussknacker processes streaming CDR data from Kafka with high throughput and low latency, while enabling easy data enrichment from external sources. Built on Flink, it supports time-window analysis for detecting multiple fraud types including:
  • SPAM
  • SIM cloning 
  • SIM boxing
  • IRSF fraud
  • Wangiri
  • High usage and Bill Shock
  • Bursts of untypical usage
• Sensitivity tuning and obfuscation. Nussknacker's expression language enables complex detection thresholds and obfuscated rules, making it difficult for fraudsters to reverse-engineer while allowing flexible sensitivity settings.
• Ease of experimentation. Nussknacker enables rapid experimentation with detection algorithms. Teams can create and deploy variations within minutes, test on data subsets, and implement changes without IT support, allowing for immediate feedback and iteration.

ML models inference in fraud detection

How to simplify the integration of ML models into business applications, automate many of the technical complexities, and support advanced techniques like A/B testing and ensemble models. A fraud detection example

Blogpost

see demo

see demo

Telecommunications Fraud: an Introduction

Nussknacker helps detect SMS fraud by analyzing patterns in real-time through visual decision diagrams, enabling quick threat detection and prevention.

Blogpost

SMS Artificially Inflated Traffic

This is an overview of telecom fraud types, with future articles planned to detail how Nussknacker can address each type specifically.

Blogpost