# US 11,310,360 B2 · System and methods thereof for real-time fraud detection of a telephone call transaction > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,360 B2 - Document ID: US11310360B2 - Status: Granted - Kind: B2 - Application number: 17/126,767 - Filed: 2020-12-18 - Published: 2021-06-24 - Granted: 2022-04-19 - Earliest claimed: 2019-12-20 - Assignees: Clear Labs Israel Ltd. - Applicants: Clear Labs Israel Ltd. - Inventors: Gal Hochberg; Doron Shamia-Sadeh - Web page: https://patentgrep.com/patent/US11310360B2 ## CPC - H04M 3/2281: {Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls} - H04M 3/2218: {Call detail recording} - H04M 3/382: {using authorisation codes or passwords} - H04M 3/436: Arrangements for screening incoming calls {, i.e. evaluating the characteristics of a call before deciding whether to answer it (based on the calling party profile H04M3/42059; based on location H04M3/42348; based on presence H04M3/42365; diversion H04M3/54)} - H04M 2203/6027: Fraud preventions - H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08) ## Abstract A method for detecting of fraudulent calls is provided. The method includes initiating, by an origin node, a call to a target node, and generating, by the origin node, a first call data record (CDR) for the call, wherein the CDR includes at least one call parameter of the call recorded by the origin node upon termination of the call. The method also includes generating, by the origin node, a first secure CDR that contains the first CDR, sending, by the origin node, the first secure CDR to the target node, and generating, by the origin node, a fraud notification based on a second secure CDR received from a first node and the first secure CDR. ## Claims ### Claim 1 A method for detecting of fraudulent calls, comprising: initiating, by an origin node, a call to a target node; generating, by the origin node, a first call data record (CDR) for the call, wherein the CDR includes at least one call parameter of the call recorded by the origin node upon termination of the call; generating, by the origin node, a first secure CDR that contains the first CDR; sending, by the origin node, the first secure CDR to the target node; and generating, by the origin node, a fraud notification based on a second secure CDR received from a first node and the first secure CDR, wherein the first node is different from the origin node, and wherein the fraud notification is generated in response to a comparison of secure CDRs generated by two different nodes. ### Claim 2 (depends on 1) The method of claim 1, wherein the first node is any one of: the target node and at least one intermediary node between the origin node and the target node. ### Claim 3 (depends on 2) The method of claim 2, wherein generating the fraud notification further comprises: generating the fraud notification upon determination that the second secure CDR received by the origin node from the at least one intermediary node resulted in false validation. ### Claim 4 (depends on 3) The method of claim 3, wherein the false validation includes any one of: the second secure CDR received contained a time duration mismatch between respective call parameters recorded by the origin node and provided by the target node in the second secure CDR, and no second secure CDR is received within a predetermined time period from the sending of the first secure CDR. ### Claim 5 (depends on 2) The method of claim 2, wherein each of the origin node, the target node, and the at least one intermediary node is a node of a Telco provider. ### Claim 6 (depends on 1) The method of claim 1, wherein the call is at least one of: a voice call, a video call, and a data call. ### Claim 7 (depends on 2) The method of claim 2, where initiating the call further comprises: transferring the call via the at least one intermediary node. ### Claim 8 (depends on 7) The method of claim 7, wherein sending the first secure CDR further comprises: sending the first secure CDR via the intermediary node. ### Claim 9 (depends on 1) The method of claim 1, wherein the secure CDR comprises an authentication signature. ### Claim 10 (depends on 1) The method of claim 1, wherein the at least one call parameter is a call duration. ### Claim 11 (depends on 1) The method of claim 1, further comprising: validating the call upon determination that no fraud was detected. ### Claim 12 (depends on 1) A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute the method of claim 1. ### Claim 13 A method for detecting of fraudulent calls, comprising: receiving, by a target node, a call by the target node from an origin node initiating the call; generating, by the target node, a first call data record (CDR) that includes at least one call parameter recorded by the target node upon termination of the call; receiving, by the target node, a first secure CDR that contains the first CDR, wherein the first secure CDR is received from a node different from the target node; and generating, by the target node, a fraud notification when the first secure CDR is determined to be invalid. ### Claim 14 (depends on 13) The method of claim 13, wherein the first secure CDR is determined to be invalid upon determination of any one: a call parameter recorded by the origin node mismatches a respective call parameter recorded by the target node, and when the first secure CDR received by the target node after a predetermined time period. ### Claim 15 (depends on 13) The method of claim 13, wherein the call is at least one of: a voice call, a video call, and a data call. ### Claim 16 (depends on 13) The method of claim 13, further comprising: receiving the call via at least one intermediary node; and receiving the first secure CDR from the at least one intermediary node. ### Claim 17 (depends on 16) The method of claim 16, wherein each of the origin node, the target node, and the at least one intermediary node is a node of a Telco provider. ### Claim 18 (depends on 13) The method of claim 13, wherein the first secure CDR comprises an authentication signature. ### Claim 19 (depends on 13) The method of claim 13, further comprising: sending to the origin node a combined secure CDR, wherein the combined secure CDR includes at least a call parameter of the call as received by the target node and the respective call parameter of the call as recorded by the target node. ### Claim 20 (depends on 19) The method of claim 19, wherein sending to the origin node a combined secure CDR comprises: sending the combined secure CDR to an intermediary node. ### Claim 21 (depends on 18) The method of claim 18, further comprising: generating the first secure CDR using an authentication signature. ### Claim 22 (depends on 13) A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute the method of claim 13. ### Claim 23 A Telco provider origin node for detecting of fraudulent calls, comprising: a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the origin node to: initiate a call to a target node; generate a first call data record (CDR) for the call, wherein the CDR includes at least one call parameter of the call recorded by the origin node upon termination of the call; generate a first secure CDR that contains the first CDR; send the first secure CDR to the target node; and generate a fraud notification based on a second secure CDR received from a first node and the first secure CDR, wherein the first node is different from the origin node, and wherein the fraud notification is generated in response to a comparison of secure CDRs generated by two different nodes. ### Claim 24 A Telco provider target node for detecting of fraudulent calls, comprising: a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the target node to: receive a call by the target node from an origin node initiating the call; generate a first call data record (CDR) that includes at least one call parameter recorded by the target node upon termination of the call; receive a first secure CDR that contains the first CDR, wherein the first secure CDR is received from a node different than the target node; and generate a fraud notification when the first secure CDR is determined to be invalid.