Unlocked cellular phone

There is no silver bullet when it comes to cellular cloning fraud, according to some carriers and fraud prevention experts. But educating the consumer with a combination of high-tech firewalls and some old-fashioned footwork can help cut fraud and lost revenues in half, some officials say.

Others believe the trend toward non-intrusive electronic fingerprinting and authentication technologies will make current prevention methods such as personal identification numbers (PINs) and caller profiling systems obsolete.

At this stage of the war on cellular theft, industry members are well aware of the cloning scenario. Thieves use signal intercept devices to steal the electronic serial number (ESN) and mobile identification number (MIN) every cellular phone emits. Those numbers are then programmed into other cellular telephones.

The Washington, D.C.-based Cellular Telecommunications Industry Association estimates that the U.S. industry lost nearly $650 million to fraud in 1995. This is 25% more than the $482 million loss in 1994, and losses are expected to continue to increase again in 1996. Worldwide fraud losses could surpass $1 billion this year, according to CTIA estimates.

Although losses are up, actual instances of cloning have gone down, says Tom McClure, CTIA's director of fraud management. Losses have increased because cloning prevention technologies have forced cloners to go outside of the traditionally hot cloning spots - such as New York, Miami and Los Angeles - to find unprotected cellular systems. The ESNs and MINs are then shipped back to the hot spots, where roaming charges apply. Because cloned numbers are used more often in higher-priced roaming areas, the cost of fraud continues to rise.

A fraud-fighting arsenal

"L.A. Cellular was one of the first systems in the country to employ fraud prevention technologies," says a spokesman for the Los Angeles-based carrier. "Now other carriers are coming to us asking what formula we have used to fight cloning."

Los Angeles Cellular Telephone Co. relies on a combination of technologies - including a PIN system, radio frequency fingerprinting, customer profiling technology and a team of fraud investigators - to manage and detect fraud, the spokesman says, adding that the company has cut its losses by well over 50% using these technologies.

The first line of defense, the PIN system, requires a customer to key in a four-digit number that unlocks the phone to make calls.

After completing the calls, the customer re-enters the code, locking the phone. A cloner who may have stolen the customer's ESN and MIN would not be able to make calls using those numbers unless the subscriber's phone were in the unlocked mode.

For customers who are roaming, carriers can enhance the PIN protection method by sharing the PIN information with other carriers who are roaming partners, he says.

However, PINs are not fool proof. Thus, L.A. Cellular also employs the PhonePrint electronic fingerprinting system provided by Corsair Communications of Palo Alto, Calif. PhonePrint uses an advanced technology known as radio frequency fingerprinting to detect and disconnect calls from cloned cellular phones as they are placed. The specifics of the technology are proprietary, says a Corsair spokesman, declining further comment on how PhonePrint works.

PhonePrint technology best protects a roaming subscriber when the roaming carrier is also employing the same technology. "When there is a PhonePrint service in two markets, the roaming carrier requests fingerprints from the home market," the spokesman says. "The system also has some stand-alone roaming capabilities if roaming partners have not deployed the system."

L.A. Cellular also uses a customer profiler technology, which keeps track of a subscriber's calling and roaming patterns. If there is break in the pattern, a red flag will go up, and the carrier will contact the subscriber to confirm whether or not the calls are valid.

"All of the technologies work hand in hand," The L.A. Cellular spokesman says.

New technology trends

Profiling and PINs are on their way out, some carriers and fraud prevention experts believe. PINs have been defeated by cloners, says Joe Herzog, director of marketing and product management for Cellular Technical Services Co. Inc., Seattle. "To cellular bandits, PIN numbers are even more valuable and increase the price they can get for a cloned phone.

"We will see a significant shift toward transparency and pre-call approaches," says Herzog. "As competitive pressure heats up from personal communication services, radio frequency fingerprinting and authentication will take off."

An effective roaming fraud prevention technology is crucial to cellular carriers to remain competitive in the face of the burgeoning digital PCS industry, Herzog says. PCS systems are not vulnerable to similar theft at the air interface because of their digital technology.

"The one advantage cellular currently has over PCS is its ubiquitous coverage coast to coast. However, if there is a brown-out, that strategic edge is gone," Herzog says, referring to some carriers' practice of shutting down all roaming capabilities in certain markets if fraud becomes prevalent.

CTS and Corsair are competitors in providing radio frequency fingerprinting systems. Corsair's PhonePrint is in about a dozen markets, according to the company spokesman. More than eight carriers, including Bell Atlantic Nynex Mobile and AirTouch Cellular, employ CTS' Blackbird platform. AirTouch has signed a blanket contract and intends to deploy Blackbird in all its markets.

Radio frequency fingerprinting could be hindered by a lack of standardization - Corsair and CTS technologies, for example, currently are not compatible. Herzog acknowledges the need for interoperability between different fingerprinting systems. To this end, both CTS and Corsair have been aggressively talking to Bellcore about developing an interoperability standard. Until such a standard exists, however, carriers will most likely choose the fingerprinting technology already employed by their key roaming partners.

Meanwhile, Herzog predicts that the number of mid-sized carriers installing fingerprinting technology will grow significantly in the next three to six months. They are the new targets of cellular bandits and will soon begin to feel the pinch of cellular fraud losses, he says.

CTS also has been examining the "A-Key authentication" technique as a possible future solution.

A-Key is based on cryptographic techniques in existence since World War II and would rely on a secret piece of data - the A-Key - which would be stored in both the wireless phone and the carriers' systems. When a call is made, the network requests a password generated by the A-Key from the wireless phone. The A-Key is never broadcast over the network - thus it cannot be intercepted by cloners.

However, only a handful of carriers are currently using A-Key technology, according to CTS, because a number of problems prevent its widespread use. The vast majority of existing mobile phones - approximately 40 million - in the United States are not equipped with the technology. Subscribers would have to get new phones, and carriers would need to upgrade their cellular switches to accommodate A-Key technology.

Renee Saunders is a freelance writer based in Arlington, Va.