# US 2026/0095752 A1 · Anomalous entitlement request detection

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2026/0095752 A1
- Document ID: US20260095752A1
- Status: Published application
- Kind: A1
- Application number: 18/901,590
- Filed: 2024-09-30
- Published: 2026-04-02
- Earliest claimed: 2024-09-30
- Assignees: T-Mobile USA, Inc.
- Applicants: T-Mobile USA, Inc.
- Inventors: Anjani Deepthi Nandigam; Nilesh Ranjan; Anthony Yiu
- Web page: https://patentgrep.com/patent/US20260095752A1

## CPC

- H04W 8/205: {Transfer to or from user equipment or user record carrier}
- H04L 41/16: using machine learning or artificial intelligence
- H04W 8/183: {Processing at user equipment or user record carrier}
- H04W 12/121: Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
- H04W 12/72: Subscriber identity
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The present technology relates to detecting and responding to anomalous entitlement change requests in a telecommunication network. The method involves receiving, at an entitlement server of a telecommunication network provided by a mobile network operator (MNO), a request for a change to an entitlement of a subscriber on a wireless device. Network activity data related to the subscriber or the wireless device and collected by the MNO is received and used to analyze the legitimacy of the entitlement change request using a machine learning model trained on historical network activity data. If the request is deemed anomalous by the machine learning model, a security operation is performed to protect the subscriber.

## Claims

### Claim 1

A system comprising:
at least one hardware processor; and
at least one non-transitory memory storing instructions that, when executed by the at least one hardware processor, cause the system to:
receive, at an entitlement server of a telecommunication network provided by a mobile network operator (MNO), a request for a change to an entitlement of a subscriber to the MNO on a wireless device;
receive, from one or more servers of the telecommunication network other than the entitlement server, subscriber activity data relating to activity of the subscriber collected by the MNO during a time period prior to or concurrent with the request for the change to the entitlement of the subscriber to the MNO on the wireless device,
wherein the subscriber activity data comprises subscriber identity module (SIM) swap data relating to a swap of a SIM provisioned to the subscriber from a first SIM provided to a previous wireless device to a second SIM provided to the wireless device, the SIM provisioned to the subscriber updatable over time;
determine, by a machine learning model and based on the subscriber activity data, whether the request for the change to the entitlement of the subscriber to the MNO on the wireless device is anomalous,
wherein the machine learning model is trained on previous sets of additional subscriber activity data collected by the MNO and related to previous requests for entitlement changes on the telecommunication network, each of the previous sets of additional subscriber activity data tagged as anomalous or typical of an expected entitlement change request; and
in response to determining that the change to the entitlement of the subscriber to the MNO on the wireless device is anomalous, perform a security operation associated with the subscriber.

### Claim 2 (depends on 1)

The system of claim 1, wherein:
the subscriber activity data includes a location of the previous wireless device when the SIM provisioned to the subscriber corresponded to the first SIM provided to the previous wireless device and a location of the wireless device when the SIM provisioned to the subscriber corresponded to the second SIM provided to the wireless device.

### Claim 3 (depends on 1)

The system of claim 1, wherein the subscriber activity data includes a number of swaps of the SIM provisioned to the subscriber during the time period.

### Claim 4 (depends on 1)

The system of claim 1, wherein the instructions further cause the system to:
receive, from an equipment inventory registry of the telecommunication network, a blacklist status of respective ones of one or more wireless devices that were provided a respective third SIM that previously corresponded to the SIM provisioned to the subscriber,
wherein the subscriber activity data further comprises the blacklist status of the respective ones of the one or more wireless devices that were provided the respective third SIM.

### Claim 5 (depends on 1)

The system of claim 1, wherein the instructions further cause the system to:
after accepting or rejecting the request for the change to the entitlement of the subscriber to the MNO on the wireless device, receive an indication that the request for the change to the entitlement of the subscriber to the MNO on the wireless device was fraudulent or legitimate; and
train the machine learning model using the subscriber activity data based on whether the request for the change to the entitlement of the subscriber to the MNO on the wireless device was indicated as fraudulent or legitimate.

### Claim 6 (depends on 1)

The system of claim 1, wherein:
the security operation associated with the subscriber comprises transmitting, to the subscriber using a communication channel that is independent of a Mobile Station International Subscriber Directory Number (MSISDN) of the subscriber, an indication that the change to the entitlement of the subscriber to the MNO on the wireless device is anomalous.

### Claim 7 (depends on 1)

The system of claim 1, wherein:
the security operation associated with the subscriber comprises removing, by the entitlement server and from the subscriber on the wireless device, access to one or more network services to which the subscriber was previously entitled on the wireless device.

### Claim 8 (depends on 1)

The system of claim 1, wherein the instructions further cause the system to:
provide, to one or more other MNOs different from the MNO, at least one of the previous sets of additional subscriber activity data tagged as anomalous or typical of the expected entitlement change request.

### Claim 9

At least one non-transitory, computer-readable storage medium storing instructions, which, when executed by at least one data processor of a system, cause the system to:
receive, at an entitlement server of a telecommunication network provided by a mobile network operator (MNO), a request for a change to an entitlement of a subscriber to the MNO on a wireless device;
receive, from one or more servers of the telecommunication network other than the entitlement server, network activity data relating to activity of the subscriber or the wireless device collected by the MNO during a time period prior to or concurrent with the request for the change to the entitlement of the subscriber to the MNO on the wireless device;
determine, by a machine learning model and based on the network activity data, whether the request for the change to the entitlement of the subscriber to the MNO on the wireless device is anomalous,
wherein the machine learning model is trained on previous sets of additional network activity data collected by the MNO and related to previous requests for entitlement changes on the telecommunication network, each of the previous sets of additional network activity data tagged as anomalous or typical of an expected entitlement change request; and
in response to determining that the change to the entitlement of the subscriber to the MNO on the wireless device is anomalous, perform a security operation associated with the subscriber.

### Claim 10 (depends on 9)

The at least one non-transitory, computer-readable storage medium of claim 9, wherein:
the network activity data comprises subscriber identity module (SIM) swap data relating to a swap of a SIM provisioned to the subscriber from a first SIM provided to a previous wireless device to a second SIM provided to the wireless device, the SIM provisioned to the subscriber updatable over time.

### Claim 11 (depends on 9)

The at least one non-transitory, computer-readable storage medium of claim 9, wherein:
receiving, from an emergency 911 (E911) server of the telecommunication network, one or more locations of the wireless device during the time period,
wherein the network activity data further comprises the one or more locations of the wireless device during the time period.

### Claim 12 (depends on 9)

The at least one non-transitory, computer-readable storage medium of claim 9, wherein the network activity data includes a number of swaps of a SIM provisioned to the subscriber during the time period.

### Claim 13 (depends on 9)

The at least one non-transitory, computer-readable storage medium of claim 9, wherein the network activity data includes a number of SIM swaps performed by the wireless device during the time period.

### Claim 14 (depends on 9)

The at least one non-transitory, computer-readable storage medium of claim 9, wherein the instructions further cause the system to:
receive, from an equipment inventory registry of the telecommunication network, a blacklist status of respective ones of one or more wireless devices that were provided a SIM provisioned to the subscriber, the SIM provisioned to the subscriber updatable over time,
wherein the network activity data further comprises the blacklist status of the respective ones of the one or more wireless devices that were provided the SIM provisioned to the subscriber.

### Claim 15 (depends on 9)

The at least one non-transitory, computer-readable storage medium of claim 9, wherein the instructions further cause the system to:
after accepting or rejecting the request for the change to the entitlement of the subscriber to the MNO on the wireless device, receive an indication that the request for the change to the entitlement of the subscriber to the MNO on the wireless device was fraudulent or legitimate; and
train the machine learning model using the network activity data based on whether the request for the change to the entitlement of the subscriber to the MNO on the wireless device was indicated as fraudulent or legitimate.

### Claim 16 (depends on 9)

The at least one non-transitory, computer-readable storage medium of claim 9, wherein:
the security operation associated with the subscriber comprises transmitting, to the subscriber using a communication channel that is independent of a Mobile Station International Subscriber Directory Number (MSISDN) of the subscriber, an indication that the change to the entitlement of the subscriber to the MNO on the wireless device is anomalous.

### Claim 17 (depends on 9)

The at least one non-transitory, computer-readable storage medium of claim 9, wherein:
the security operation associated with the subscriber comprises removing, by the entitlement server and from the subscriber on the wireless device, access to one or more network services to which the subscriber was previously entitled on the wireless device.

### Claim 18 (depends on 9)

The at least one non-transitory, computer-readable storage medium of claim 9, wherein the instructions further cause the system to:
provide, to one or more other MNOs different from the MNO, at least one of the previous sets of additional network activity data tagged as anomalous or typical of the expected entitlement change request.

### Claim 19

A method comprising:
receiving, at an entitlement server of a telecommunication network provided by a mobile network operator (MNO), a request for a change to an entitlement of a subscriber to the MNO on a wireless device;
receiving, from one or more servers of the telecommunication network other than the entitlement server, network activity data relating to activity of the subscriber or the wireless device collected by the MNO during a time period prior to or concurrent with the request for the change to the entitlement of the subscriber to the MNO on the wireless device;
determining, by a machine learning model and based on the network activity data, that the request for the change to the entitlement of the subscriber to the MNO on the wireless device is anomalous,
wherein the machine learning model is trained on previous sets of additional network activity data collected by the MNO and related to previous requests for entitlement changes on the telecommunication network, each of the previous sets of additional network activity data tagged as anomalous or typical of an expected entitlement change request; and
in response to determining that the change to the entitlement of the subscriber to the MNO on the wireless device is anomalous, performing a security operation associated with the subscriber.

### Claim 20 (depends on 19)

The method of claim 19, wherein:
the network activity data comprises subscriber identity module (SIM) swap data relating to a swap of a SIM provisioned to the subscriber from a first SIM provided to a previous wireless device to a second SIM provided to the wireless device, the SIM provisioned to the subscriber updatable over time.