Carrier grade identification of subscriber identity module card-related fraudulent events

A method comprising:

• processing, by a system comprising a processor, call detail records and billing events to detect a subscriber identity module swap event based on a change of an international mobile subscriber identity from being associated with a first mobile device having a first international mobile equipment identity to being associated with a second mobile device having a second international mobile equipment identity;
• classifying, by the system, the subscriber identity module swap event according to a classification of a group of classifications, the group of classifications comprising a benign classification and a malicious classification, wherein the classifying comprises determining a classification type of the subscriber identity module swap event from among a plurality of classification types including at least two of:
• a first type representative of a stale account theft, a second type representative of an identity theft, a third type representative of a duplicate identity activity, or a fourth type representative of a service fraud;
• and
• in response to the subscriber identity module swap event being classified according to the malicious classification, outputting, by the system, information representative of the malicious classification, wherein the outputting of the information representative of the malicious classification comprises outputting the classification type.

A non-transitory machine-readable medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations, the operations comprising:

• detecting, based on call detail records and billing events, a subscriber identity module swap event in which an international mobile subscriber identity formerly active on a first mobile device associated with a first international mobile equipment identity is determined to be currently active on a second mobile device associated with a second international mobile equipment identity;
• accessing data associated with the subscriber identity module swap event;
• processing the data associated with the subscriber identity module swap event to determine whether the subscriber identity module swap event is malicious, wherein the processing comprises determining a classification type of the subscriber identity module swap event from among a plurality of classification types including at least two of:
• a first type representative of a stale account theft, a second type representative of an identity theft, a third type representative of a duplicate identity activity, or a fourth type representative of a service fraud;
• and
• in response to the subscriber identity module swap event being determined to be malicious, outputting information representing the subscriber identity module swap event being malicious, wherein the outputting of the information representing the subscriber identity module swap event being malicious comprises outputting the classification type.