# US 10,484,873 B2 · Detection and blocking of cloned mobile devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,873 B2 - Document ID: US10484873B2 - Status: Granted - Kind: B2 - Application number: 16/267,153 - Filed: 2019-02-04 - Published: 2019-06-06 - Granted: 2019-11-19 - Earliest claimed: 2014-11-20 - Assignees: AT&T Intellectual Property I, L.P.; AT&T Mobility II LLC - Applicants: AT&T Mobility II LLC; AT&T Intellectual Property I, L.P. - Inventors: Sheldon Kent Meredith; William Cottrill; Brandon B. Hilliard - Web page: https://patentgrep.com/patent/US10484873B2 ## CPC - H04W 12/12: Detection or prevention of fraud - H04L 63/101: {Access control lists [ACL]} - H04M 15/39: {Arrangements for preventing metering, charging or billing} - H04M 15/41: {Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]} - H04M 15/47: {Fraud detection or prevention means} - H04W 4/025: {using location based information parameters} - H04W 4/24: Accounting or billing - H04W 8/04: Registration at HLR or HSS [Home Subscriber Server] - H04W 12/06: Authentication - H04W 12/082: using revocation of authorisation - H04W 12/126: Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning - H04W 12/30: Security of mobile devices; Security of mobile applications - H04L 2101/65: Telephone numbers - H04W 12/08: Access security - H04W 12/63: Location-dependent; Proximity-dependent - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08) ## Abstract A method is disclosed for blocking a cloned mobile device by a processor of a network. The processor receives a first registration from a first mobile device at a first location. The first registration includes a device identifier and a phone number. The processor then confirms that a second registration from a second mobile device at a second location includes the device identifier and the phone number and calculates a first fraud score for the first mobile device and a second fraud score for the second mobile device. The processor then determines that the second mobile device is the cloned mobile device, when the second fraud score exceeds the first score, and blocks the cloned mobile device from registering on the network. ## Claims ### Claim 1 A method for blocking a cloned mobile device, the method comprising: receiving, by a processor of a network, a first registration from a first mobile device at a first location, wherein the first registration includes a device identifier and a phone number; confirming, by the processor, that a second registration from a second mobile device at a second location includes the device identifier and the phone number; calculating, by the processor, a first fraud score for the first mobile device and a second fraud score for the second mobile device; determining, by the processor, the second mobile device is the cloned mobile device, wherein the determining the second mobile device is the cloned mobile device comprises determining that the second fraud score exceeds the first fraud score and that a difference between the second fraud score and the first fraud score exceeds a threshold amount; and blocking the cloned mobile device from registering on the network. ### Claim 2 (depends on 1) The method of claim 1, wherein the determining the second mobile device is the cloned mobile device further comprises determining that the second fraud score further exceeds a threshold fraud score. ### Claim 3 (depends on 1) The method of claim 1, wherein the calculating comprises: calculating a first distance from the first location to a home location associated with the phone number; and calculating a second distance from the second location to the home location associated with the phone number, wherein the first fraud score is based upon the first distance and the second fraud score is based upon the second distance. ### Claim 4 (depends on 1) The method of claim 1, wherein the calculating comprises: calculating a first distance from the first location to a location of a previous usage associated with the phone number; and calculating a second distance from the second location to the location of the previous usage associated with the phone number, wherein the first fraud score is based upon the first distance and the second fraud score is based upon the second distance. ### Claim 5 (depends on 4) The method of claim 4, wherein the first registration is received prior to the second registration, wherein the calculating comprises: calculating a plurality of potential locations for the first mobile device based upon a trajectory of the first mobile device; and comparing the second location to the plurality of potential locations for the first mobile device based upon the trajectory, wherein the second fraud score is based upon whether the second location comprises one of the plurality of potential locations. ### Claim 6 (depends on 1) The method of claim 1, wherein the calculating comprises: calculating a first level of matching between a first usage pattern associated with the first location and a previous usage pattern associated with the phone number; and calculating a second level of matching between a second usage pattern associated with the second location and the previous usage pattern associated with the phone number, wherein the first fraud score is based upon the first level of matching and the second fraud score is based upon the second level of matching. ### Claim 7 (depends on 6) The method of claim 6, wherein the first usage pattern and the second usage pattern each comprises a number of calls to a particular region. ### Claim 8 (depends on 6) The method of claim 6, wherein the first usage pattern and the second usage pattern each comprises a volume of calls. ### Claim 9 (depends on 6) The method of claim 6, wherein the first usage pattern and the second usage pattern each comprises a ratio of voice calls to data calls. ### Claim 10 (depends on 1) The method of claim 1, further comprising: removing billing entries associated with the cloned mobile device from a bill associated with the phone number. ### Claim 11 (depends on 1) The method of claim 1, wherein the blocking comprises refusing to establish communications for the cloned mobile device at a mobile switching center of the network that is associated with the second location. ### Claim 12 (depends on 1) The method of claim 1, wherein the blocking comprises correcting an entry associated with the phone number in a home location register or a home subscriber server to associate the phone number with the first location. ### Claim 13 (depends on 1) The method of claim 1, wherein the device identifier comprises at least one of: an electronic serial number; a mobile equipment identifier; an integrated circuit card identifier; an international mobile equipment identity; or an international mobile subscriber identity. ### Claim 14 A non-transitory computer readable medium storing a plurality of instructions which, when executed by a processor of a network, cause the processor to perform operations for blocking a cloned mobile device, the operations comprising: receiving a first registration from a first mobile device at a first location, wherein the first registration includes a device identifier and a phone number; confirming that a second registration from a second mobile device at a second location includes the device identifier and the phone number; calculating a first fraud score for the first mobile device and a second fraud score for the second mobile device; determining that the second mobile device is the cloned mobile device, wherein the determining the second mobile device is the cloned mobile device comprises determining that the second fraud score exceeds the first fraud score and that a difference between the second fraud score and the first fraud score exceeds a threshold amount; and blocking the cloned mobile device from registering on the network. ### Claim 15 An apparatus for blocking a cloned mobile device, the apparatus comprising: a processor of a network; and a computer-readable medium storing instructions which, when executed by the processor, cause the processor to perform operations, the operations comprising: receiving a first registration from a first mobile device at a first location, wherein the first registration includes a device identifier and a phone number; confirming that a second registration from a second mobile device at a second location includes the device identifier and the phone number; calculating a first fraud score for the first mobile device and a second fraud score for the second mobile device; determining that the second mobile device is the cloned mobile device, wherein the determining the second mobile device is the cloned mobile device comprises determining that the second fraud score exceeds the first fraud score and that a difference between the second fraud score and the first fraud score exceeds a threshold amount; and blocking the cloned mobile device from registering on the network. ### Claim 16 (depends on 15) The apparatus of claim 15, wherein the determining the second mobile device is the cloned mobile device further comprises determining that the second fraud score further exceeds a threshold fraud score. ### Claim 17 (depends on 15) The apparatus of claim 15, wherein the calculating comprises: calculating a first distance from the first location to a home location associated with the phone number; and calculating a second distance from the second location to the home location associated with the phone number, wherein the first fraud score is based upon the first distance and the second fraud score is based upon the second distance. ### Claim 18 (depends on 15) The apparatus of claim 15, wherein the calculating comprises: calculating a first distance from the first location to a location of a previous usage associated with the phone number; and calculating a second distance from the second location to the location of the previous usage associated with the phone number, wherein the first fraud score is based upon the first distance and the second fraud score is based upon the second distance. ### Claim 19 (depends on 18) The apparatus of claim 18, wherein the first registration is received prior to the second registration, wherein the calculating comprises: calculating a plurality of potential locations for the first mobile device based upon a trajectory of the first mobile device; and comparing the second location to the plurality of potential locations for the first mobile device based upon the trajectory, wherein the second fraud score is based upon whether the second location comprises one of the plurality of potential locations. ### Claim 20 (depends on 15) The apparatus of claim 15, wherein the calculating comprises: calculating a first level of matching between a first usage pattern associated with the first location and a previous usage pattern associated with the phone number; and calculating a second level of matching between a second usage pattern associated with the second location and the previous usage pattern associated with the phone number, wherein the first fraud score is based upon the first level of matching and the second fraud score is based upon the second level of matching.