How to Fight Telecommunications Subscription Fraud in the Age of AI

Subscription fraud has always had a straightforward economic logic. The device drove the resale value, so taking the value out of the handset took much of the value out of the fraud. Two developments are now weakening that logic, and telecoms whose controls still rest on it are increasingly defending against an out-of-date model of the crime.

Key Takeaways

• The fraud target has shifted from devices to identities. Synthetic identity fraud and eSIM provisioning mean the handset no longer drives resale value, the subscription and account access do.
• Telecom fraud attacks are outpacing other industries. LexisNexis Risk Solutions found 5.2% of digital interactions in telecoms were confirmed fraud in 2025, higher than ecommerce (4.6%) and five times the fraud ratio in financial services.
• Falling fraud filings mask a tactical shift, not less harm. Cifas reports a 24% drop in telecom identity fraud filings, driven by criminals moving from new-account fraud to account takeovers, particularly on mobile accounts.
• An identity-led model only works with clear ownership. Before deploying new controls, telcos need an agreed answer to who owns subscription fraud risk (fraud, credit risk, or revenue assurance) and an executive-sponsored risk appetite.
• Three controls matter most now: adaptive machine learning over static scorecards, early warning monitoring that continues after activation, and link analysis run across the full account lifecycle, not just at application.

What Are the Two Shifts That Have Moved the Subscription Fraud Target?

The first is the industrialization of synthetic identity fraud. Cifas reports that criminals are building convincing long-term synthetic profiles that blur the line between real users and AI-generated imposters. LexisNexis Risk Solutions, analyzing 116 billion transactions during 2025, found synthetic identity fraud rose eight-fold year-on-year to 11% of all global fraud attacks; while this is a cross-sector figure rather than a telecom one, it shows the urgency of this trend. A stolen identity has a real victim who eventually notices and disputes. A fabricated one has nobody: no one to trace a device back to, no one to blacklist, and no dispute that closes the loop.

The second is eSIM. Global eSIM connections are on track to grow 30% in 2026, from 1.2 billion to 1.5 billion.Once provisioning happens over the air, the handset stops being the only thing worth taking. The number itself becomes the asset, and the account that controls it becomes the way in.

The Evolution of Fraud in the Telco Industry: What the Filing Data Shows

LexisNexis Risk Solutions found that 5.2% of digital interactions in the telecoms sector were a confirmed fraud attack in 2025, a higher rate than ecommerce at 4.6% and five times higher than financial services. The attacks concentrate at new account creation, where roughly one in eight attempts is fraudulent, and at payments, where attack volume rose 84% year on year.

Identity fraud filings from the telecom sector fell 24% over the same period, the largest drop of any sector. Cifas attributes this not to a reduction in harm but to a shift in criminal tactics, with fraudsters increasingly targeting account takeovers, particularly against mobile phone accounts. The fraud has not receded. It has moved from opening accounts to taking over existing ones.

The practical consequence is that controls anchored at the point of fulfillment will catch progressively less fraud. The decision has to move upstream to the application, and then keep running after the account goes live.

Who Is Accountable for Subscription Fraud? 

Before any of that, telecoms should determine who owns and is accountable for subscription fraud. Is it the fraud team? Credit risk? Revenue assurance? Is there a clear and agreed fraud risk appetite that has executive sponsorship and is agreed by all stakeholders? An identity-led model only works when someone owns the identity.

Industry data sharing matters for the same reason. There are numerous examples of the industry coming together to share data on known fraud threats and profiles to mitigate the impact of fraudulent activity. Data sharing for these purposes should be non-competitive, but it still relies on a common definition of what data to share, where to host it securely, how regularly it is updated, and what mechanisms are available to access the consortium data.

Three Analytical Priorities for the Near Future

Once those questions have clear answers, analytical techniques can substantially reduce and prevent subscription fraud losses. Three matter more now than they did three years ago.

• Adaptive models rather than scorecards. While the scorecard approach is tried and tested, the time required to develop the score means that by the time it is operationalized the fraud MO has changed. Machine learning techniques are scalable, self-learning and adaptive. Algorithms such as neural networks can understand hidden layers within the relationships between variables, which is what allows them to surface the quiet inconsistencies characteristic of a fabricated identity.
• Early warning that keeps learning. Once activated, the early usage of a new subscription can be monitored for warning signals of fraudulent activity: zero usage in the first few days after an order is fulfilled, for instance. These alerts have traditionally been deployed by rules-based systems, which are effective to a point, but dependency on rules introduces latency and rulesets can quickly become obsolete. Adaptive machine learning identifies changing patterns and prioritizes alerts, enabling fraud teams to make efficient use of analysts’ time.
• Link analysis across the whole lifecycle. Link analysis has always been the counter to organized rings, whose biggest weakness is shared identity data. Fuzzy matching and relationship-driven predictive analytics turn one uncovered case into many, and visualization techniques significantly reduce the time taken to unpick a ring. What has changed is that the same shared-data fingerprints now appear in SIM swap and takeover events after the point of sale. Running link analysis only at the pre-book stage overlooks half the signal.

Pulling It Together: The Three Controls That Work Against Subscription Fraud in the Age of AI

An identity-led approach starts with the data. Internal and external sources need to come into a single view at the point of application. That changes the question being asked. Instead of ‘is this application complete and plausible?’, the check becomes ‘does this identity exist, and does it behave like the person it claims to be?’

That view cannot stop at the sale. It has to carry on after activation, monitoring for sleeper behavior rather than closing the case at fulfillment.

Entity resolution and network analytics do the rest. Together they expose the links across applications and accounts that reveal a ring. Organized groups reuse addresses, devices, bank details and contact points, because they have little choice. Run that analysis across new applications and live accounts, and one confirmed case becomes the whole cluster.

The controls that have always worked against subscription fraud still work: clear ownership, adaptive machine learning and link analysis. They simply have to be pointed at the identity rather than the handset.

How FICO Is Helping Telcos 

• Learn more about account takeover fraud in the telecommunications industry  and how to tackle subscription fraud..
• Read more about transforming the customer experience for telecommunications and why poor affordability analytics create a disconnect for telcos
• Download our IT Leadership Reimagined: A Telco Playbook for the Age of AI playbook to get a four-step roadmap to becoming intelligence architects
• Read our executive brief on the Telco CIO as Architect of AI-Driven Digital Transformation to understand the role of decision intelligence in the next era of telecommunications

Note: This is an update of a post from 2023.