Understanding IRSF Fraud: Protecting Against International Revenue Share Fraud

Understanding IRSF Fraud: Protecting Against International Revenue Share Fraud

Speakers: Vien Van, Senthil Sivasubramanian

Conference: BSidesSF 2025 — April 26-27, 2025, San Francisco

YouTube: Watch on YouTube

Reading time: ~7 minutes

TL;DR

International Revenue Share Fraud (IRSF) is a largely unknown but financially devastating attack vector in which fraudsters abuse SMS and voice OTP endpoints to generate traffic to premium-rate phone numbers, splitting the resulting revenue with unregulated telecom operators. Companies can lose tens or even hundreds of thousands of dollars before they notice the spike. The good news: it is detectable and mitigable with the right combination of anomaly detection, rate limiting, and operational playbooks.

Introduction

When most security practitioners think about telecom fraud, they picture SIM swapping or toll-call theft. International Revenue Share Fraud operates on a different and far less familiar plane — it turns an organization's own authentication infrastructure into a cash machine for criminals. The Communications Fraud Control Association (CFCA) attributes roughly $5 billion in annual losses to IRSF globally, yet the attack type barely registers in most corporate threat models.

Vien Van and Senthil Sivasubramanian, engineers from Gusto's Identity Engineering team, took the stage at BSidesSF 2025 to walk the audience through the mechanics of the attack, how Gusto identified it against their own systems, and the practical controls that can shut it down. For an organization that provides payroll and HR services to small businesses, an unexpected six-figure SMS bill is not just a financial problem — it erodes trust in the platform itself.

What Is IRSF — and Why Does It Work?

▶ Watch: IRSF overview and fraud landscape (02:00)

IRSF belongs to a cluster of related fraud types that also includes artificially inflated traffic (AIT), SMS pumping, and toll fraud. What distinguishes IRSF specifically is the revenue-sharing arrangement at its core: fraudsters collude with providers of International Premium Rate Numbers (IPRNs) and split the termination fees generated by directing traffic to those numbers.

The IPRN market itself is legitimate — it supports services like premium-rate chat lines, voting systems, and adult content. The problem is that TransNexus reports 121 IPRN providers operating globally, and roughly 40 percent of them are undisclosed and unregulated. Between 2019 and 2020 alone, the number of active IPRN numbers grew by over eight million — a period that correlates directly with the explosion in mobile app authentication via SMS OTP.

The economic incentives are stark. When a company pays Twilio or TeleSign roughly $1 per SMS sent, those providers pay ~$0.30 to the carrier network, which in turn pays ~$0.10 to the IPRN provider as a termination fee. Fraudsters sitting behind an IPRN provider collect that $0.10 on every single message — and they can fire thousands per minute using automation.

Anatomy of an Attack

▶ Watch: Attack anatomy walkthrough (10:01)

The attack surface is an application's SMS-triggering endpoints: registration, 2FA enrollment, OTP verify, OTP resend, and voice fallback. Senthil walked through a realistic attack scenario step by step.

An attacker creates accounts at scale using email sub-addressing (also called email tumbling) — a technique where a single Gmail inbox receives messages to [email protected], [email protected], and so on. The same trick used by QA engineers to test multi-account flows becomes the onboarding mechanism for bot-driven fraud. After passing email confirmation, the attacker enrolls an international premium-rate phone number as the SMS 2FA destination, then hammers the OTP-resend and voice-fallback endpoints using a simple browser automation script.

The traffic flows outward, terminating on IPRN numbers concentrated in regions far outside a typical US company's user base — often China and other international geos — while the associated accounts appear to have originated from US or European IP addresses. By the time the billing cycle closes, the damage is done.

Real-world losses make the scale concrete. A Re/Max franchise was billed heavily after fraudsters accessed its PBX phone system and placed international calls. In a separate incident, a hospitality business was hit for nearly $2 million in a single weekend after attackers enabled an auto-callback feature on its voicemail system and left a premium-rate number as the callback — the system dutifully called it back and stayed connected all weekend. Twitter (now X) experienced a version of this during its 2022–2023 acquisition period, when fraudsters created bot accounts using SMS-based MFA and colluded with telcos to pump traffic.

Detection: Anomaly Detection Is the Name of the Game

▶ Watch: Detection strategies (14:01)

Vien framed the detection strategy around a single principle: establish a baseline for normal and alert loudly on deviation. Several concrete signals to monitor include:

• Traffic spikes on SMS endpoints — registration, enrollment, verify, resend, and voice fallback. A sudden surge — especially outside business hours — is the primary tell.
• New country codes appearing in SMS recipient data. If a US-focused business suddenly sees 2FA codes being sent to numbers in countries it has never served, something is wrong.
• User agent anomalies. A spike in Linux user agents when the normal traffic baseline is Mac and Windows strongly suggests automation.
• IP address ranges and geographies not previously seen in the application's access logs.
• Unusual new user registration volume. The team recommends cross-checking any registration spike with marketing and growth teams — if there is no campaign that explains it, investigate.

The Gusto team uses Datadog for detection monitoring. They noted that IRSF traffic also tends to hurt other channels — sales pipelines, for instance — which creates a second organizational tripwire and an opportunity to involve other teams in spotting the pattern.

Mitigation: Layered Defenses and a Ready Playbook

▶ Watch: Mitigation controls (18:02)

Detection without response is just expensive noise. The presenters described a set of mitigations that should be deployed in layers:

Firewall-level controls include blocking traffic by suspicious IP ranges, previously unseen countries, and user agents associated with bot traffic. The team also recommends analyzing TLS fingerprints via JA3 hashes — but with caution: baseline at least two weeks of traffic before using JA3 as a blocking signal to avoid disrupting legitimate users.

Application-level controls include detecting when the same phone number is submitted across multiple accounts, or is used for SMS more than a defined threshold (e.g., ten times per minute or fifty times per day). Device fingerprinting can flag a single device attempting to register many accounts.

Country code restrictions are one of the highest-leverage mitigations. Limiting which country codes can be enrolled for SMS 2FA — enforced at the front end, back end, and at the SMS provider level simultaneously — removes the vast majority of viable IPRN destinations. Vien noted that working directly with the UCaaS provider (TeleSign, Twilio) to establish a deny list at the carrier level prevents fraudsters from running up the bill even when they find a new entry path.

Email domain deny lists are also effective. Research by Interout Consulting found that generic top-level domains like .top and .xyz attract fraudsters because of rock-bottom registration prices and no meaningful identity requirements. Blocking these TLDs at account registration removes a significant cohort of fraudulent accounts before they ever trigger an SMS.

Finally, the team emphasized the importance of a pre-built incident playbook attached to every relevant alert — one that can be executed without requiring a new code deployment. Dynamic allow/deny list controls that can be adjusted in real time are essential when an attack is already in progress and every minute counts.

Notable Quotes

"The CFCA actually attributes almost five billion dollars to the entire IRSF fraud." — Senthil Sivasubramanian (06:01)

"Anomaly detection is the name of the game here — and although your applications could be a little different, IRSF attacks often try to abuse a common set of patterns." — Vien Van (16:01)

"Make sure you apply defense in depth — take away the country code on the front end, restrict it on the back end, and work with your SMS provider to establish a deny list." — Vien Van (20:02)

Key Takeaways

• IRSF is a $5B annual problem that most security teams have never modeled. Any application with SMS or voice OTP is a potential target.
• The attack entry point is your own onboarding and authentication flows. Email sub-addressing bypasses email verification; bot scripts handle the rest.
• Anomaly detection on SMS endpoints is the primary detection signal — traffic spikes, new country codes, suspicious user agents, and abnormal registration volume are the key indicators.
• Country code restrictions combined with provider-level deny lists are among the highest-ROI mitigations. Enforce them at every layer — front end, back end, and UCaaS.
• Have a playbook and attach it to every alert. When an attack is in progress, the team needs to be able to act without waiting for a deployment cycle.