itu-t Series-D: Tariff and Accounting Principles
The economic governance layer of international telecommunications — where financial fraud, interconnect bypass, and revenue assurance meet standards.
Official Scope
Study Group: SG3 — Tariff and Accounting Principles
Active Status: Ongoing
Defines the economic and policy principles for international telecom services: charging frameworks, interconnect settlement, quality of service pricing, and Internet interconnection economics. Directly governs the financial relationships between operators that fraud actors exploit.
Tactical Security Significance
- Relevance: 🟢 High — Revenue Assurance, IRSF, Interconnection Fraud
- Key Security Concepts: Settlement Fraud (IRSF), Interconnect Charge Bypass, SIM-Box Revenue Bypass, Mobile Money Security
- Attack Surface: Interconnect agreements and settlement systems — exploited by IRSF actors who profit from inflated international call charges
Key Recommendations
| ITU Rec | Title | Security Domain | Cross-Reference |
|---|---|---|---|
| D.1 | General tariff principles | Financial Security Baseline | GSMA PRD BA.41 |
| D.50 | International Internet interconnection charging | Peering & Transit Security | RIPE/ARIN BGP policy |
| D.195 | Settlement of accounts for international telecom services | Settlement Fraud (IRSF) | CFCA Fraud Report |
| D.212 | Charging framework for M2M / IoT services | IoT Billing Integrity | 3GPP TS 32.240 |
| D.300 | Framework for international charging for OTT services | Bypass Fraud Economics | GSMA OTT framework |
Security Mapping
IRSF — International Revenue Share Fraud
IRSF is the most expensive telecom fraud globally. Attackers obtain access to PBX systems or MVNO SIM accounts, then route calls to premium-rate international numbers in which they share revenue. ITU-T D.195 governs the settlement accounting that determines who bears the inflated cost.
- Threat Vector: Compromised PBX (SIP brute-force), stolen SIM credentials, or MVNO wholesale abuse
- Financial Impact: $2.73B annually per CFCA (Communications Fraud Control Association)
- Mitigation: Implement velocity controls on international outbound calls; cross-reference call destinations against known IRSF premium-rate ranges; require D.195-compliant settlement dispute processes in interconnect agreements
SIM-Box / Interconnect Bypass Fraud
Traffic legitimately subject to international termination rates is converted to local calls using illegally operated SIM-box arrays. This bypasses the D.1/D.50 interconnect economics — operators lose international termination revenue and regulators are deprived of accounting data.
- Threat: Bulk calls arrive as local termination; CLI spoofing (E.157) masks international origin
- Detection: Compare CLI patterns against E.164 number analysis; look for GSM-specific ring patterns, call duration distributions, and codec fingerprints inconsistent with local origination
Mobile Money Transaction Integrity (D.212)
D.212 governs charging frameworks for M2M and IoT — including mobile money platforms. Incorrect charging records (CDRs) can mask fraudulent micro-transactions or enable SIM-swap-based account takeovers that exploit billing system blind spots.
!NOTE This series is part of the master Series Tracker.