The 5 Hottest Topicsin Revenue Assurance

and Fraud ManagementEric Priezkalns

WeDo Technologies User Group MalaysiaJanuary 2017

Who is Eric Priezkalns?● Specialist in risk and assurance for communications providers● Former Director of Risk Management at Qatar Telecom● Also worked with: Cable & Wireless, T-Mobile, Worldcom…● Chartered accountant, trained at Deloitte London Enterprise Risk Services● Author of Revenue Assurance: Expert Opinions for Communications Providers● Co-founder of the TM Forum RA team; wrote original maturity model● Former member of the Qatar National Committee for Internet Safety● Currently on the committee of the Risk & Assurance Group● Editor of Commsrisk.com● But mostly retired!

What is ‘Hot’?● This list was compiled from various sources:

○ Page views at Commsrisk.com○ Social media data on the sharing of Commsrisk articles○ Popular topics for discussion at key events including WeDo’s Lisbon

Summit and the Risk & Assurance Group (RAG) Summer Conference○ My own opinion!!

He who cannot puthis thoughts on ice

should not enter intothe heat of dispute

Wer seine Gedanken nicht auf Eis zu legen versteht, der soll sich nicht in die Hitze des Streites begeben

Friedrich Nietzsche, Menschliches, Allzumenschliches: Ein Buch für freie Geister

1. Tension Over Scope● TMF 2016 RA Survey: 47% of RA teams also do FM

○ Up from 30% in 2015

● CFCA 2015 Fraud Survey: 57% of fraud teams in Finance, 22% in Security○ 11% swing to Finance since 2013 Survey (45% in Finance, 33% in Security)○ But there was an 8% swing to Security between 2011 and 2013

● GSMA combined its fraud and security working groups into one○ No appetite to expand into assurance○ Will not cover OTT bypass

● Many strong differences of opinion

Pull Upwards Instead of Sideways?● Technology synergies pushing RA and FM together● But cultural issues pull RA and FM apart

○ Different working styles and sometimes different sense of priorities

● Good argument for a stronger bond between FM and Security○ Example: evolving threats like mobile malware

● Key problem: telcos more diverse than ever before● Unify under the risk umbrella?

○ Risk can be a vague concept, but risk management is increasingly standardized○ Creates a more reliable route to talk to the board about frauds and leakages○ The board’s priorities may not be the same as those of management!

● Shift from accounting-style KPIs to protecting shareholder value○ Solves the conundrum of ‘putting yourself out of a job’○ Creates bridge to new objectives: reputation, protecting customers from fraud, insider fraud

2. Education and Professionalization● FM tends to be better at educating its people than RA, partly because of the

longer and deeper history of knowledge sharing between telcos● However, many RAFM practitioners continue to express dissatisfaction with

the range and quality of education available to them

The Way Forward For Education● Overwhelming demand means RAG will develop an education program,

however… ● Difficult to create a cost-effective program which customers are willing to

pay for and which addresses the varied needs of people doing real work● Some vendors seek to assist by providing education as part of a rounded

relationship with customers● Online training is not ideal, but getting better● We must professionalize for the sake of driving up pay and coping with the

increasing range of risks and challenges we face

3. Identities and Biometrics● Fraudsters have always stolen and created false identities, but the internet

escalates the battle between the abusers and verifiers of identities● Key challenge is identifying who people are without infringing their privacy● Very real link to terrorism

○ Terrorists engage in large scale fraud to raise and launder money

● Biometrics provide a means to verify identities● Identification schemes may be implemented on national or commercial basis

In Pakistan, all 75mn SIMs have been verified by fingerprint since mid-2015. From February anyone buying a new SIM in Thailand will have their fingerprint taken.

Sky UK currently implementing project to automatically recognize the voices of all of its 11mn customers

Understanding the Wider Risk Implications● Identity and biometrics provide good examples of how RAFM practitioners

benefit from having a wider awareness of risk and corporate objectives● Lot of misunderstandings about legal and moral obligations when it comes to

identity, privacy, data protection etc● A “just say no” attitude to compliance is unhelpful

○ Wrong to exaggerate legal barriers○ Counter-productive to block controls that customers might support and appreciate○ Governments can force adoption anyway

● But we do need to think about customer perception as well as the law○ Need to be outward-facing and explain the benefits of changes to customers○ Better verification of identity can boost customer service as well as reducing fraud

Social Data Will Help Us Fight Fraud● Most popular Commsrisk article of 2016 about using social media to

automatically assess the ‘riskiness’ of an individual○ http://commsrisk.com/wedo-uses-ai-to-judge-your-personality/○ See who people are connected to e.g. known criminals○ Judge if identity is real or fake○ Assess somebody’s personality

● Data indicates that criminals are found in clusters● Predictive is the new proactive

○ People used to confuse being proactive with reacting more quickly!○ Prevention of loss increasingly about evaluating risks and predicting outcomes○ New tech makes it much more viable to make useful predictions about customers○ Blurs boundaries around managing credit risk and links to other responsibilities like churn

prevention - predictive techniques could look for signs a customer may soon churn

4. National Audits● National audits of telco revenues increasingly popular with governments in

some parts of the world○ Goal is to check the government has received all the tax it should○ Often the focus is on fees for international termination○ One RA firm sells only to governments, never to telcos; they boast they are “independent”!

● Other countries focus on making telcos liable for the tax evaded by criminals○ Fraudsters often cheat both the telco and the taxman at the same time○ Tax authorities holding telcos liable for tax bill of criminals○ To avoid liability telcos must demonstrate they took every reasonable effort to prevent fraud○ Emphasis has shifted to what the telco should have known about their customers

The Italian Job● One high-profile case saw Telecom Italia lose €298mn and Fastweb lose

€39mm for VAT relating to an enormous criminal scam● Fastweb CEO spent a year in ‘preventative detention’● Hypothetical end users of the services were supposedly in Tuvalu● €298mn + €39mm = €337mn; that much VAT requires sales worth €1,685mn● The GDP of Tuvalu is €35mn

Q. What comms services were supposedly purchased by the Tuvaluans?

A. Pornography!

The African Situation● Clearly telcos make mistakes and some behave badly● But situation in some African countries is toxic; telcos publicly vilified

○ In Ghana, two different regulators employ two different companies to audit the same telco revenues!

● Governments promise voters that huge amounts of money will be raised by ‘revenue assurance’○ Partly a promise to collect all the tax owed from ‘cheating’ telcos○ Partly the levying of tariffs on cross-border trade: international termination fees

● Now some RAFM people working in telcos are saying they want their government to place more obligations on the telcos○ Naïvety about government intentions○ Not thinking through implications for RAFM staff inside the telco

How Increased Focus on Tax Changes the RAFM Dynamic● The potential loss to the business from frauds and other leakages is

magnified by the taxman wanting money too● Also potential damage to reputation of the business● Should lead to increased emphasis on prevention, rather than detecting and

responding to frauds and errors● Work must be done in a systematic way and documented, in case it needs to

be shown to tax authorities or in court of law● Simplistic one-sided drive to increase profits is inadequate; need to ensure

all revenues and costs are correct - neither over nor under● People inside the telco should aspire to make the taxman’s audit redundant,

or risk being made redundant by external auditors

5. OTT Bypass● Over-the-top bypass is the most popular recurring topic on Commsrisk● Excellent example of many of the themes discussed in the other hot topics

○ People not sure if it is a fraud or not, or who in the telco should deal with it○ It is a risk in some sense, but whose risk?○ Is it a good thing? Should telcos want it because it lowers costs?○ Or is it a bad thing because it will destroy revenues?○ Is there a law against it? Does it violate any contract?○ How do we detect it?○ Even if we can detect it, what should we do about it? What can we do about it?○ Do customers want it? Should we warn them about it?

● Apologies for not yet describing what OTT bypass is!● First want to emphasize that low-level detection of network activity can

connect to the corporate strategy and law and the customer experience

So What Is OTT Bypass?● George in Sweden calls his friend Jane in New Zealand

○ He is using a regular phone, dials her mobile number

● Jane receives the call, but using an OTT VoIP application on her mobile○ For example, Viber

● George’s Swedish telco does not know how the call is terminated● Jane’s NZ telco does not know they lost the revenues for terminating the call● Some carrier between has a relationship with the OTT provider; if dialled

number matches an OTT user they route call to the OTT app● The motive for terminating on the OTT app is to get lower wholesale costs

because there are no fees for terminating the international call

What Telcos Should Do About OTT Bypass● Do not “do nothing” by default - at least gather data and make a strategic

decision on how the business will respond, even if decision is to do nothing● Put in place monitoring to measure the impact of OTT bypass on

termination, so understand the effect it has on customers and revenues● Lobbying governments and regulators● Consider the customer● Change business model?

OTT Bypass and Other Hot Topics● OTT bypass shows why we need coordination across the telco

○ Is it fraud? Is it leakage? Whatever it is, somebody should do testing and monitoring

● However you allocate risk duties, big new risks will break your org chart○ Example of the benefits of moving towards a broader risk-based sensibility

● African taxmen chasing termination revenues - but there will be no revenues to chase if OTT bypass takes over!

● Cannot predict the impact on your business if you have no useful data● If the industry does not know how to respond to OTT bypass, then obviously

cannot teach that as part of a ‘standard’ RAFM course

Conclusions● The heat is rising: we must remould ourselves… or risk a meltdown● Scope of RAFM work will have to change, because telcos are changing● Education is key to increasing value, for both employer and employee● Cannot ignore the altering relationship between telcos and government● Biometrics is an opportunity and a risk● Need to actively use social media data; criminals will use it● OTT bypass illustrates how and why the industry will reinvent itself

A woman is like a tea bag. You never know how

strong she is until youput her into hot water.

Irish proverb