Home · Legal · Anti-Fraud Policy

Anti-Fraud Policy

Voice fraud is the largest single source of unplanned loss in the wholesale telecommunications industry. This policy describes how Callivex detects and prevents fraud, what we expect of customers, and how losses are apportioned when fraud occurs.

In short
  • Every account has hard channel caps, call-rate limits and spend ceilings.
  • High-cost destinations are blocked on new accounts until you opt in.
  • Unusual traffic, such as a new country or an out-of-hours spike, raises alerts and can pause the account.
  • If one of our controls fails, we absorb the loss. If your system is compromised, the loss is yours.
A plain-English summary. The full text below is what applies.

Effective date: 1 January 2026 · Version: 1.0

Operator: Lunatoria Prime LTD (Company No. 17531648), trading as Callivex.

1. Threat model

Callivex defends customers and the network against, at minimum, the following fraud categories:

  • International Revenue-Share Fraud (IRSF). Calls placed to high-cost destinations co-operatively monetised by the destination operator and the fraudster. Most damaging at scale; commonly hits credential-compromised PBXes overnight or over weekends.
  • Wangiri / one-ring fraud. Inbound call-back schemes where the recipient's call-back is routed to a premium-rate destination.
  • Toll fraud via PBX hijack. Compromised end-user PBX or softswitch credentials used to place calls billed to the customer.
  • Account-takeover fraud. Compromise of customer portal credentials to provision new sub-accounts, change IP whitelists, or extract balance.
  • SIM-box and bypass fraud. Off-net traffic introduced into the public network through unauthorised gateways.
  • Card-payment fraud. Funding accounts with stolen payment instruments, then attempting termination before chargeback.

2. Preventive controls in the platform

2.1 Account caps and enforcement

  • Hard channel caps. Each account has a maximum simultaneous-channel limit enforced at the SBC. Calls beyond the cap are rejected with SIP 503.
  • CPS limits with leaky bucket. Each account has a calls-per-second limit; bursts are smoothed; sustained excess is throttled.
  • Hourly and daily spend ceilings. Accounts auto-suspend when configured ceilings are reached. Defaults are conservative; resellers and customers can tune up after demonstrating clean traffic.
  • Country allow / deny lists. Per-account allowlists block calls outside the customer's stated traffic profile.
  • Premium-rate block by default. High-cost destinations are blocked on every new account; opt-in is explicit.

2.2 Real-time anomaly detection

  • Sudden CPS surges trigger alerts and automatic throttling.
  • Destination-mix shifts (sudden volume to a country the customer has not previously called) raise alerts and may auto-suspend pending review.
  • ANI / CLI anomalies (high cardinality, rapid rotation, presented numbers from outside the customer's authorised pool) trigger investigation.
  • Out-of-hours traffic spikes on customers whose stated profile is "business hours" auto-suspend pending verification.

2.3 Endpoint controls

  • IP-whitelist enforcement at SBC, with no fallback to digest auth on whitelisted accounts.
  • SIP scanner mitigation: registration-failure-rate banning, signature-based filtering, signaling rate limits.
  • Rate-limited SIP REGISTER bursts to defeat credential-stuffing scanners.
  • TLS signaling and SRTP media required for any account opting into hosted SIP-digest authentication.

3. Customer obligations

3.1 Endpoint hygiene

The single largest source of toll fraud is compromised customer-side PBX or softswitch credentials. Customers shall:

  • Maintain firewall rules restricting SIP signaling to known-good source IPs.
  • Apply security updates to PBX, softswitch and SBC software within reasonable timeframes.
  • Use complex, rotated passwords on all SIP and provisioning credentials.
  • Disable unused SIP extensions and unmonitored auto-attendant routing.
  • Rate-limit international and premium-rate dialing at the customer-side dialplan as defence-in-depth.

3.2 Notification of compromise

On suspicion or evidence of credential compromise, account takeover, or unauthorised use, customers shall:

  • Notify Callivex within 24 hours via compliance@callivex.com.
  • Rotate affected credentials within 24 hours.
  • Co-operate with Callivex investigation, including providing CDR, login, and configuration history.

3.3 Cap configuration

Customers are responsible for configuring cap, allowlist, and spend-ceiling values appropriate to their traffic profile. Default caps reflect a conservative posture; customers raising defaults assume the residual fraud risk associated with the higher exposure.

4. Loss apportionment

Fraud losses are apportioned in line with where the failure of control occurred. The default position:

  • Callivex platform failure. Where fraud results from failure of a Callivex preventive control (cap not enforced, account-takeover via Callivex portal, etc.), Callivex absorbs the carrier-cost loss for affected calls and credits the customer's balance accordingly.
  • Customer-side compromise. Where fraud results from credential compromise, configuration error, or insufficient endpoint security on the customer side, the customer is liable for carrier costs of fraudulent traffic, capped at the configured account spend ceiling. Callivex enforces ceilings as a hard limit, not as a marketing claim.
  • Mixed liability. Where both parties contributed (e.g. customer disabled a default cap, Callivex anomaly detection delayed), liability is apportioned by good-faith negotiation and, failing that, by independent review.

In all cases, Callivex will not bill customers for traffic occurring after Callivex received notice of compromise, provided the customer rotated credentials and co-operated with mitigation.

5. Carrier and regulator co-operation

Callivex co-operates with upstream-carrier and regulator fraud-control teams. Where fraud is detected:

  • Affected upstream carriers may be notified to enable cross-network blocking.
  • Where regulator obligations apply (UK, EU, US, others), incidents may be reported to the relevant authority.
  • CDR and signaling capture may be retained for evidential purposes for up to 12 months, governed by our Privacy Policy.

6. Customer recourse

Customers identifying fraud against their account should:

  1. Notify compliance@callivex.com with the suspected timeframe and any indicators.
  2. Rotate affected credentials immediately.
  3. Provide reasonable information for investigation (firewall logs, login records, configuration history).

We respond to fraud notifications inside one (1) business hour during EU business day and within four (4) hours otherwise. Where credentials are clearly compromised we will suspend the affected sub-account immediately, on customer request, even before full investigation.

7. Changes to this policy

This policy will evolve as the threat landscape changes. Material changes will be notified by email and via the service portal at least fourteen (14) days before taking effect.

8. Contact

Fraud reports: compliance@callivex.com
Anti-fraud policy questions: compliance@callivex.com
Postal: Lunatoria Prime LTD, Dept 7139, 196 High Road, Wood Green, London N22 8HH, United Kingdom.