Subex · Schema

Subex Fraud Case

A telecom fraud case detected by Subex ROC fraud analytics

TelecomRevenue AssuranceFraud ManagementAnalyticsBSS/OSS

Properties

Name Type Description
caseId string Unique fraud case identifier
fraudType string Classification of fraud type: SIM_SWAP=unauthorized SIM replacement, BYPASS_FRAUD=traffic bypass to avoid charges, IRSF=International Revenue Share Fraud, WANGIRI=missed call fraud
status string
riskScore integer Fraud risk score from 0 (no risk) to 100 (confirmed fraud)
detectedAt string Timestamp when the fraud was detected
subscriberMsisdn string Subscriber MSISDN (international format without +)
imsi string IMSI of the subscriber SIM card
estimatedFraudLoss number Estimated fraud loss in base currency
currency string
indicators array Fraud indicators that contributed to this case
callDataRecords array Associated CDRs as evidence
actions array Actions taken on this fraud case
assignedTo string Analyst assigned to this case
resolutionNotes string
closedAt stringnull
View JSON Schema on GitHub

JSON Schema

subex-fraud-case-schema.json Raw ↑ 
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://www.subex.com/schemas/fraud-case",
  "title": "Subex Fraud Case",
  "description": "A telecom fraud case detected by Subex ROC fraud analytics",
  "type": "object",
  "properties": {
    "caseId": {
      "type": "string",
      "description": "Unique fraud case identifier"
    },
    "fraudType": {
      "type": "string",
      "enum": ["SIM_SWAP", "BYPASS_FRAUD", "SUBSCRIPTION_FRAUD", "IRSF", "ROAMING_FRAUD", "INTERCONNECT_FRAUD", "WANGIRI"],
      "description": "Classification of fraud type: SIM_SWAP=unauthorized SIM replacement, BYPASS_FRAUD=traffic bypass to avoid charges, IRSF=International Revenue Share Fraud, WANGIRI=missed call fraud"
    },
    "status": {
      "type": "string",
      "enum": ["OPEN", "UNDER_INVESTIGATION", "CONFIRMED", "FALSE_POSITIVE", "CLOSED"]
    },
    "riskScore": {
      "type": "integer",
      "minimum": 0,
      "maximum": 100,
      "description": "Fraud risk score from 0 (no risk) to 100 (confirmed fraud)"
    },
    "detectedAt": {
      "type": "string",
      "format": "date-time",
      "description": "Timestamp when the fraud was detected"
    },
    "subscriberMsisdn": {
      "type": "string",
      "description": "Subscriber MSISDN (international format without +)",
      "pattern": "^\\d{7,15}$"
    },
    "imsi": {
      "type": "string",
      "description": "IMSI of the subscriber SIM card",
      "pattern": "^\\d{14,15}$"
    },
    "estimatedFraudLoss": {
      "type": "number",
      "minimum": 0,
      "description": "Estimated fraud loss in base currency"
    },
    "currency": {
      "type": "string",
      "pattern": "^[A-Z]{3}$",
      "default": "USD"
    },
    "indicators": {
      "type": "array",
      "description": "Fraud indicators that contributed to this case",
      "items": {
        "$ref": "#/$defs/FraudIndicator"
      }
    },
    "callDataRecords": {
      "type": "array",
      "description": "Associated CDRs as evidence",
      "items": {
        "$ref": "#/$defs/CDREvidence"
      }
    },
    "actions": {
      "type": "array",
      "description": "Actions taken on this fraud case",
      "items": {
        "$ref": "#/$defs/FraudAction"
      }
    },
    "assignedTo": {
      "type": "string",
      "description": "Analyst assigned to this case"
    },
    "resolutionNotes": {
      "type": "string"
    },
    "closedAt": {
      "type": ["string", "null"],
      "format": "date-time"
    }
  },
  "required": ["caseId", "fraudType", "status", "detectedAt"],
  "$defs": {
    "FraudIndicator": {
      "type": "object",
      "properties": {
        "indicatorName": {
          "type": "string",
          "description": "Name of the fraud indicator rule",
          "examples": ["HighVolumeInternational", "UnusualCallPattern", "NewSIMHighActivity"]
        },
        "indicatorValue": {
          "type": "string",
          "description": "Observed value that triggered the indicator"
        },
        "threshold": {
          "type": "string",
          "description": "Threshold value configured for this indicator"
        },
        "weight": {
          "type": "number",
          "minimum": 0,
          "maximum": 1,
          "description": "Weight of this indicator in the overall risk score"
        }
      },
      "required": ["indicatorName", "indicatorValue"]
    },
    "CDREvidence": {
      "type": "object",
      "description": "A Call Detail Record as fraud evidence",
      "properties": {
        "cdrId": {
          "type": "string"
        },
        "callDateTime": {
          "type": "string",
          "format": "date-time"
        },
        "callingNumber": {
          "type": "string"
        },
        "calledNumber": {
          "type": "string"
        },
        "callDuration": {
          "type": "integer",
          "description": "Call duration in seconds"
        },
        "callType": {
          "type": "string",
          "enum": ["VOICE_MO", "VOICE_MT", "SMS_MO", "SMS_MT", "DATA", "ROAMING"]
        },
        "charge": {
          "type": "number"
        }
      }
    },
    "FraudAction": {
      "type": "object",
      "properties": {
        "actionType": {
          "type": "string",
          "enum": ["BLOCK_SUBSCRIBER", "REDUCE_LIMIT", "FLAG_FOR_REVIEW", "NOTIFY_ANALYST", "ESCALATE"]
        },
        "takenAt": {
          "type": "string",
          "format": "date-time"
        },
        "takenBy": {
          "type": "string"
        },
        "notes": {
          "type": "string"
        }
      },
      "required": ["actionType", "takenAt"]
    }
  }
}