Calling line identity spoof detection in the presence of repeat calls

A computer implemented method of processing calls in a telephone network, the method comprising:

• identifying a plurality of calls that have been made by a particular telephone number to destination telephone numbers in the telephone network;
• dividing the plurality of calls into N subsets of calls, each subset corresponding to a respective occurrence of the calls to the destination telephone numbers, such that the first subset of calls includes a first call to each of the destination telephone numbers and the Nth subset of calls includes any Nth call to each destination telephone number;
• determining whether a sequence in each of more than one of the N subsets of calls separately corresponds to a respective correct calling order, wherein the correct calling order for each sequence is determined based on a predetermined rule for ordering destination telephone numbers in the telephone network, that rule having previously been generated based on a secret shared between the network's operator and a party that is authorised to use the particular telephone number;
• classifying any calls in those sequences that follow the respective correct calling order as being legitimate calls or likely legitimate calls;
• and
• classifying any calls in those sequences that break the correct calling order as being spoof calls;
• wherein the method further comprises, in response to determining that one or more of the calls were made by spoofing the particular telephone number:
• notifying the party that is authorised to use the particular telephone number that calls are being made by spoofing that telephone number;
• and/or
• taking action to prevent further spoof calls.