Method and apparatus to detect fraudulent calls in a radio network

An apparatus for detecting fraud in a radio network comprising:

• a mobile station including a nonvolatile memory storing an electronic identification number and a first table including a plurality of entries, each entry relating to a prior mobile station calling event;
• a home location register including a memory storing a second table including a plurality of entries, each entry relating to a prior calling event for that mobile station;
• and
• a mobile switching center in radio communication with the mobile station and connected to the home location register, wherein the mobile switching center is adapted to make a calling event query to the mobile station as to the content of a plurality of randomly selected entries in the first table, compare a calling event response message containing the first table content of the plural randomly selected entries that is received from the mobile station responsive to the calling event query with the content of corresponding plural entries in the second table, and detect mobile station fraud when the content from each plural entry does not match.

A method for detecting fraud in a radio network having a mobile station including a nonvolatile memory storing a first table including a plurality of mobile station calling events, said mobile station in communication with the radio network including a memory storing a second table including a plurality of calling events for that mobile station, comprising the steps of:

• querying the mobile station with a calling event query as to the content of a plurality of randomly selected entries in the first table;
• retrieving by the mobile station of the plural entry content responsive to the calling event query from the first table;
• sending by the mobile station of a calling event response message including said retrieved plural entry content from the first table;
• retrieving by the radio network from the second table the plural entry content corresponding to the calling event query;
• comparing the received content to the retrieved content;
• and
• detecting fraud when the received and retrieved content for each of the plural entries does not match.