Abstract:
Prior to completing a telephone call, a database is accessed within a telecommunications network to determine whether the call should be completed. The billing number to which the call is to be charged is compared to a customer record assigned to the billing number and stored in the database. The customer record is checked against a treatment category code which combines geographic call restrictions and thresholding. A call may be identified as potentially fraudulent and blocked if the customer record associated with the billing number indicates that the account is in arrears. In addition, at predetermined intervals during the progress of the call and at the end of each allowed call to be charged to that billing number, the time and/or cost of each call is estimated and added to the total stored in a user-defined threshold counter in the database. When the total stored in the counter exceeds a predetermined threshold limit, a potentially fraudulent call is identified. In this manner, call authorization is performed on a per call basis to prevent fraudulent telephone calls.

Description:
BACKGROUND OF THE INVENTION 
     1. Field of the Invention 
     The present invention relates generally to the field of telecommunications, and more particularly to an automated system for detecting and preventing fraudulent telephone calls in a telecommunications network. 
     2. Description of the Related Art 
     Fraudulent telephone activity for domestic and international calls presents a significant and increasing problem to carriers of telecommunications networks, such as the assignee of the present invention, AT&amp;T Corporation. Such fraudulent activity may include calling card fraud and/or subscriber fraud. 
     Calling card fraud involves the misappropriation of a valid calling card number and then using the misappropriated number to place toll calls which are billed to an unsuspecting subscriber. 
     Subscriber fraud involves fraudulent usage by an otherwise legitimate subscriber. Typically, this type of fraudulent activity occurs when a subscriber signs up for telecommunications services and proceeds to use the services with no intent to ever pay for the services provided. Such a fraudulent/delinquent subscriber would continue to use the services without paying until the network access was blocked by the service provider. Subscriber fraud may also occur through the subscriber&#39;s illegal call forwarding, illegal third party number billing schemes, illegal collect schemes, etc. 
     Conventional telecommunications systems today, such as what is known as the public switched telephone network (PSTN), comprise several interdependent networks: the local or exchange area network, which is typically operated by a local telephone company or local exchange company (LEC); and the toll network, which is operated by a long distance or interexchange carrier (IXC) such as AT&amp;T Corporation. 
     In the conventional PSTN, a given telephone within a LEC network is capable of accessing the IXC network through known gateway switching equipment, such as AT&amp;T&#39;s 4ESS™ and 5ESS™ toll switches and operator services position system (OSPS™) switch. Upon access to the IXC network, a toll call may be completed outside the LEC network. However, because the LEC&#39;s typically perform credit and collection processes on the IXC&#39;s behalf under contracts between the IXC and the LEC&#39;s, it has become increasingly difficult for the IXC to detect and prevent fraudulent telephone calls within the IXC network. 
     Prior attempts to detect and prevent such fraudulent telephone calls have been made, but with generally unsatisfactory results. For instance, because the LEC&#39;s are responsible for billing most customers utilizing the IXC&#39;s toll services, the LEC would provide customers who were delinquent in paying their bills with a predetermined grace period prior to suspending the delinquent customer&#39;s access to the IXC network for domestic and international long distance service. As a result, the IXC would continue to incur high revenue losses as a result of the delinquent customer&#39;s continued use of long distance services during this grace period until access to such service was suspended by the LEC. 
     To combat this type of subscriber fraud, the IXC has previously attempted to block switch-accessed toll calls (international or domestic) at the originating/access 4ESS™ switch (e.g., 1+/011+calls) by creating one or more Network Call Denial (NCD) databases containing billing numbers for customers known to be delinquent in payment to the IXC. Such billing numbers include the number from which the call is placed (ANI), the number to whom the call is directed for collect calls, the third party number when the call is billed to that third party, and calling card numbers issued by the IXC. 
     As illustrated in FIG. 1, when specified call types (i.e., 1+calls) are introduced into the IXC network, the 4ESS™ switch  10! launches a query to a NCD database  12! (in parallel with the call processing) through a common channel signalling network (CCS7 network), such as AT&amp;T&#39;s 2STP™ network. The NCD database  12! is then searched to determine if the billing number matches that of a delinquent customer stored in the database  12!. When a match is found, a response is transmitted back to the 4ESS™ switch  10! to identify and terminate the call. Thus, the IXC was able to block calls within its network for customers who are delinquent in payment when the billing number matches that of a previously known delinquent customer stored in the NCD database  10!. 
     However, the above-described NCD database  10! proved ineffective in detecting and preventing fraudulent credit card calls for credit cards issued by the LEC (LEC cards). In an attempt to prevent such fraudulent credit card calls, the IXC must access the line information database (LIDB) of the LEC in order to validate the credit card before the call is completed in the IXC network, as illustrated in FIG. 2. 
     In operation, when a LEC credit card call is placed by a customer, the call is processed in the IXC network  1! by an OSPS™ switch  20! which receives the LEC card number as the billing vehicle. The OSPS™ switch  20! thereafter launches an appropriate query  Query 1! through the CCS7 network  24! (such as AT&amp;T&#39;s 2STP™ network) to a line service application/network control point (LSA/NCP)  22! within the IXC network  1!. Upon receipt of the query  Query 1!, the LSA/NCP  22! checks a &#34;hot list&#34; (a.k.a. deactivation list) stored in the LSA/NCP  22! for that particular LEC card number and associated personal identification number (PIN). If the LEC card number and associated PIN match a card number and PIN contained in the &#34;hot list&#34;, the LSA/NCP  22! sends a deny response through the CCS7 network  24! back to the OSPS™ switch  20!, which in turn prevents completion of the call. 
     If the LEC card number and associated PIN do not match any numbers and PIN&#39;s stored in the LSA/NCP &#34;hot list&#34;, then the LSA/NCP  22! was required to send a subsequent query  Query 2! through the CCS7 network  24! to the LIDB  26! in the LEC network  2! for &#34;true&#34; validation by the LEC. The LIDB  26! in the LEC network  2! contains a list of valid credit card numbers and PIN&#39;s issued by that particular LEC, as well as a list of LEC credit card numbers that should be denied due to unauthorized/fraudulent usage and/or delinquent payment. 
     Should the LEC card number and associated PIN transmitted in the second query  Query 2! fail to match one of the valid numbers stored in the LIDB  26! of the LEC network  2! (invalid LEC card number and/or PIN), then the LIDB  26! returns a first response  Response 1! to the LSA/NCP  22! to deny the call and the LSA/NCP passes the &#34;deny&#34; response  Response 2! to the OSPS™ switch  20! to prevent completion of the call. 
     In contrast, however, should the LEC card number and associated PIN transmitted in the second query  Query 2! match one of the valid numbers stored in the LIDB  26!, then the LIDB  26! returns a response  Response 1! to the LSA/NCP  22! to allow the call and the LSA/NCP  22! passes the &#34;allow&#34; response (Response 2) to the OSPS™ switch  20! to allow the call. The LSA/NCP  22! also stores the LEC card number and PIN in a fraud tracking list, and increments the card usage by one each time a call is made that is to be charged to that particular LEC card number. If the usage count for a particular LEC card number and PIN exceeds a predetermined threshold in a given time period (velocity), then the LSA/NCP  22! will identity that particular LEC card number and PIN combination as potentially fraudulent. 
     While the above-described LSA/NCP application has met with moderate success in preventing fraudulent calls billed to LEC cards by validating the cards and monitoring the frequency of calls in a given period of time (velocity), such application has several drawbacks. First, to validate the LEC card, the IXC must communicate outside the IXC network with the LIDB  26!. In addition, unscrupulous callers seeking to perpetrate fraudulent calls are becoming more and more sophisticated. As such, these fraudulent callers have learned to recognize the velocity threshold levels set by the IXC and continue to go undetected by maintaining their fraudulent calls below the velocity threshold levels. In this manner, these fraudulent callers adjust their fraudulent calling patterns to go undetected by placing smaller numbers of fraudulent calls (below the velocity threshold) and instead hold each fraudulent call for longer (and more expensive) durations. 
     To prevent fraudulent calls charged to credit cards issued by the IXC (IXC cards), the IXC has also previously utilized a customer account services/network control point (CAS/NCP)  30! in the IXC network  2! which contains information concerning the IXC cardholder. Referring to FIG. 3, when an IXC credit card call is received from the LEC network  2! by an OSPS™ switch  20!, the OSPS™ switch  20! sends a query  Query 1! to the CAS/NCP  30! through the CCS7 network  24! to validate the call. Like the LIDB  26! described above and illustrated in FIG. 2, the CAS/NCP  30! checks the IXC card number and PIN to ascertain its validity by comparing the IXC card number and PIN to those stored in a database within the CAS/NCP  30!. If the card number and PIN match and the account is in good standing, the CAS/NCP  30! sends a response  Response 1! back to the OSPS™ switch  20! to allow the call. 
     In addition, like the LIDB  26!, the CAS/NCP  30! may increment the card usage by one each time a call is made that is to be charged to that particular IXC card number and store the usage count in its database. If the usage count for a particular IXC card number exceeds a predetermined threshold in a given time period (velocity)--which threshold is also stored in the database of the CAS/NCP  30!--then the CAS/NCP  30! will identify that particular IXC card number as potentially fraudulent. 
     Alternatively, if the card number and/or PIN do not match those stored in the CAS/NCP database, the account is overdue, or the velocity threshold is exceeded, then the CAS/NCP  30! may take appropriate action, such as terminating the call attempt or allowing the call but notifying the appropriate work center of the IXC for customer follow-up. 
     Additionally, credit limits could be placed on particular IXC card numbers stored in the database of the CAS/NCP  30!. When the initial query  Query 1! is transmitted to the CAS/NCP  30! by the OSPS™ switch  20!, the CAS/NCP  30! can also verify that the credit amount for the particular IXC card is not exceeded. If the credit amount is not exceeded, the CAS/NCP  30! may instruct the OSPS™ switch  20! in its response  Response 1! to allow the call. Periodically, an adjunct in communication to the OSPS™ switch  20! may determine the actual cost of the IXC card call to that point in time and may transmit that information to the CAS/NCP  30! through the CCS7 network  24! whereupon the CAS/NCP  30! will deduct that amount from the IXC card&#39;s credit and store the new amount in the database. When the credit amount is exhausted, the CAS/NCP  30! may instruct the OSPS™ switch  20! via the CCS7 network  24! to terminate the call in progress or to take some further action, such as having an operator access the call to request another form of payment. 
     While the CAS/NCP  30! has been successfully used by the IXC, its use is limited to IXC card calls. Accordingly, the CAS/NCP  30! is not capable of detecting potentially fraudulent calls utilizing billing methods other than an IXC issued credit card. 
     SUMMARY OF INVENTION 
     The above and other problems of the prior art are solved by the present invention which provides a system on a single platform for detecting and handling fraudulent telephone calls in a telecommunications network without adversely affecting call set-up. In accordance with the present invention, the system comprises one or more databases within the network containing customer records. The system processes information received from a switch in the network, such as the billing number to be charged for the call. When the record associated with the billing number is located in the database, the system further processes certain user-defined conditions including whether the account is in arrears and/or whether specific calling features (domestic, international, collect, bill to third party, LEC calling card, specific destination numbers, country codes or city codes, area codes/exchanges, etc.) are satisfied. 
     If any of these conditions are satisfied, the system may instruct the switch to block the call. The term &#34;block&#34; or &#34;blocking&#34; as used herein is not intended to be limited simply to the denial of a call. Instead, the term may be user defined to include, for example, denial of the call, redirecting the call to a fraud/credit management center, or offering the caller an alternative billing method. 
     Alternatively, if none of the user-defined conditions are satisfied, the system may instruct the switch to allow the call and to signal the system at the end of the call. On predetermined intervals during the progress of the call, the system measures the time of the call and estimates the cost of the call by applying the measured time to rate tables stored in the database. 
     Based upon a user-defined treatment category assigned to the customer record and stored in the database, the system adds the cost of the call to the total cost stored in a threshold counter identified by the treatment category and corresponding to the type of call. When the total cost stored in the threshold counter exceeds a predetermined threshold limit, the system identifies the call as potentially fraudulent and may take further user-defined investigatory action including interrupting the call in progress or automatic denial of subsequent calls. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     The foregoing features and other aspects of the invention are explained in the following description taken in connection with the accompanying drawings wherein: 
     FIG. 1 is a schematic illustrating a prior art communication architecture for detecting fraud prior to call set-up; 
     FIG. 2 is a schematic illustrating a second prior art communication architecture for detecting fraud prior to call set-up; 
     FIG. 3 is a schematic illustrating a third prior art communication architecture for detecting fraud prior to call set-up; 
     FIG. 4 is a schematic illustrating the NAI communication architecture of the present invention. 
     FIGS. 5 and 6 are tables illustrating examples of various thresholds which are monitored by the NAI platform of the present invention. 
     FIGS. 7A-7C are block diagrams illustrating the steps for processing a call in accordance with the present invention. 
    
    
     DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     Referring to FIG. 4, when an individual attempts to place a toll telephone call from telephone  3!, that call is routed within the LEC network  2! and connected to the IXC network  1! in a conventional manner. Typically, when the call is a direct dialed toll call (1+call) to be billed to the ANI of the calling party, the call accesses the IXC network  1! in a conventional manner at a known toll originating switch  10!, such as AT&amp;T&#39;s 4ESS™ or 5ESS™ toll switches. When the call is to be billed to some other billing vehicle (0+call) (i.e., third party call, collect call, LEC card call or other commercial credit card call), the call typically accesses the IXC network  1! in a conventional manner at a known gateway switch  20! such as AT&amp;T&#39;s OSPS™ switch. 
     Irrespective of whether the call is a 1+ or 0+call, the present invention is capable of processing the call on a single platform to determine whether the call is potentially fraudulent without adversely impacting call set-up time. This fraud detection is accomplished by providing a system operating on a single platform in the IXC network  1!, which system is referred to hereinafter as &#34;Network Access Interruption&#34; (NAI) and denoted by reference numeral  40!. 
     The NAI  40! comprises one or more multiprocessor computers within the IXC network  1!. The NAI  40! also includes at least one database containing information for certain customer accounts. The NAI database includes a Customer Account Table containing all line numbers (ANI, Mobile Identification Number (MIN), 10 digit card number, or dialed number) that are to receive NAI treatment, including those customers who are to be denied credit or for whom selective blocking and/or thresholding are to be provided. 
     In addition, the Customer Account Table stored in the NAI database may also include, but is not limited to, the following information about each of the above-mentioned customer accounts: 
     a Credit Deny Indicator to identify a customer having delinquent credit. 
     a Collect Call Indicator to indicate whether a collect call to a particular customer should be denied or a query sent to the LIDB  26!. 
     a Third Number Indicator to indicate whether a bill to third call should be denied or a query sent to the LIDB  26!. 
     a 900 Call Indicator to indicate whether a 900+call should be allowed or denied. 
     an International Call Indicator to indicate whether an international call should be allowed or denied. 
     a Treatment Category Number which identifies the record in the Treatment Category Table defining the type of blocking and/or thresholding for the particular customer. 
     four threshold counters or buckets, each of which are associated with a threshold type specified in the Treatment Category Table. These threshold counters store the total amount of dollars and cents or minutes that have accumulated against their associated threshold types. Preferably, as illustrated in FIGS. 5-6, the threshold types allow for combinations of the following types of calls: 
     1. International Collect 
     2. Domestic Collect 
     3. International Bill to Third 
     4. Domestic Bill to Third 
     5. International Sent Paid 
     6. Domestic Sent Paid 
     7. International LEC Card 
     8. Domestic LEC Card 
     9. International Toll, including 900 
     10. Domestic Toll, not including 900 
     11. Domestic Toll 900 (1+900) 
     12. Domestic Commercial Credit Card 
     13. International Commercial Credit Card 
     14. Specific Destination Thresholding 
     15. Dollar vs. Minute-of-Use Thresholding 
     16. IntraLATA Collect 
     17. In traLATA Sent Paid 
     18. IntraLATA LEC Card 
     19. IntraLATA Toll 
     20. IntraLATA Commercial Credit Card 
     four threshold call counters, each of which is associated with a threshold type specified in the Treatment Category Table. These threshold call counters track the total number of calls that have accumulated against their associated threshold type. 
     preferably, five threshold levels per threshold type. 
     Furthermore, the following information may also be stored in a database of the NAI  40!: 
     a Card Deactivation Table which stores all card (LEC or commercial) numbers and PIN combinations to be denied service by the IXC. 
     a Blocked Dialed Telephone Number Table which identifies domestic and international destination telephone numbers to which all call s are to be blocked/denied, regardless of caller and access method. 
     a Selective Blocking Category which identifies destination country and city codes, world zone and area code/exchanges, which are to be allowed and/or blocked. 
     a Domestic Rate Table which contains the rates for domestic calls. 
     an International Rate Table which contains the rates for international calls. 
     While any number of customers may be maintained in the Customer Account Table in the NAI database, it may be preferable that only delinquent customers, high risk customers, repetitive delinquent customers, and new customers be maintained in the Customer Account Table. In this manner, thresholding may be implemented for new customers for a brief period (such as three to nine months) to verify that the customer timely pays its bills. If the customer&#39;s account is not delinquent at the end of this initial period, then that particular customer may be removed from the Customer Account Table. In contrast, if the particular customer&#39;s account has been delinquent, that customer&#39;s record status may be changed to credit denied, treatment categories may be modified to allow less usage before alerts are generated, or monitoring may be modified to monitor on a shorter period of time (i.e., weekly rather than monthly). 
     Referring to FIGS. 7A-7C, when a call is received by the IXC originating switch  10, 20! in the IXC network  1!, the switch  10, 20! sends a query via a conventional CCS7 signalling network (such as AT&amp;T&#39;s 2STP™ network) to the NAI  40!, which may be in parallel with continuing to set up the call. For 1+toll calls, the billing number (the ANI of the calling party) is transmitted to the NAI  40! along with the query from the switch  10!. For 0+calls, the billing number (LEC or commercial card, bill to third party number, etc.) is transmitted to the NAI  40! along with the query from the switch  20!. Other information may also be sent to the NAI  40!, including the destination number, whether the call is a cellular call, or whether the caller is a subscribed customer of the IXC. 
     The NAI  40! processes the query to first determine whether that particular billing number is to receive NAI treatment. The NAI  40! searches the Customer Account Table stored in its database to determine if the record associated with the billing number is stored therein (step S1). If the billing number (or possibly the destination number) does not match a record corresponding to the billing number in the Customer Account Table (step S2), then the NAI  40! may transmit a response to the switch  10, 20! via the CCS7 signalling network to allow/complete the call (step S27). However, if the billing number matches a record stored in the Customer Account Table (step S2), then the call is to receive NAI treatment (step S5). 
     Alternatively, if there is no customer record in the Customer Account Table associated with the billing number (step S2), the NAI  40! may automatically create a customer record for the caller&#39;s ANI depending upon various user-defined decision criteria (step S3). For instance, when the caller&#39;s ANI does not correspond to any ANI associated with a customer of the IXC (non-IXC customer), then a customer record for that particular ANI may be automatically created and stored in the Customer Account Table of the NAI database (step S4). The NAI  40! may identify such non-IXC customers based upon information contained in the Carrier Selection Information parameter of the SS7 Network Interconnect ISUP (ISDN User Part) Initial Address Message (IAM). Furthermore, any time that an international call is made which exceeds a predetermined criteria (such as time or cost), the ANI associated with that international call may be automatically enrolled in the Customer Account Table stored in the NAI database  40! (e.g., a customer record is created and stored for that particular ANI). 
     For those customers (billing numbers) which are to receive NAI treatment--i.e., billing number matches a record stored in the Customer Account Table and/or an account is automatically enrolled in the Customer Account Table--the NAI  40! next determines whether the account associated with the particular billing number is delinquent. To determine whether an account is delinquent, the NAI  40! searches the record associated with the particular billing number in the Customer Account Table of the NAI database to determine the status of the credit deny indicator for the particular account (step S6). If the particular account is delinquent, the credit deny indicator in the record will be set by an operator to &#34;deny&#34; (steps S7 &amp; S8) and the NAI  40! transmits a deny response back to the switch  10, 20! via the CCS7 signalling network to terminate the call or to take other appropriate action such as interrupting the call and transmitting a voice message to the customer that the account is overdue or redirecting the call to an appropriate work center of the IXC (step S9). However, if the credit deny indicator is not set to &#34;deny&#34; (step S7), then the NAI  40! continues to process the query. 
     For billing numbers other than LEC cards, the NAI  40! continues to process the call as discussed in the next paragraph. However, for calls to be billed to LEC cards, the NAI  40! validates the LEC card number and PIN by transmitting a query to LIDB  26! in the LEC network  2! via the CCS7 signalling network in a manner similar to that discussed earlier with respect to the LSA  22!. If the LEC card number or PIN are invalid or delinquent, the LIDB  26! will transmit a response back to the NAI  40! via the CCS7 signalling network to deny the call and the NAI  40! will instruct the switch  20! accordingly. However, if the LEC card number and PIN are validated by the LIDB  26!, the LIDB will transmit an &#34;allow&#34; response back to the NAI  40! via the CCS7 signalling network and the NAI  40! will continue to process the call. 
     For those billing numbers other than LEC cards and for LEC cards validated by the LIDB  26!, the NAI  40! next searches the record associated with the particular billing number to identify the Treatment Category Code for this particular account which is stored in the record (step S10). The Treatment Category Code defines the type of blocking and/or thresholding for the particular customer and may be assigned on a per customer basis according to the customer&#39;s individual characteristics, such as credit score, region of the country, calling plan, entity responsible for billing, etc. 
     Based upon the specific Treatment Category Code for the customer, the IXC may selectively block calls that are to be charged to that billing number. For instance, the IXC may geographically restrict a customer&#39;s ability to place an international or domestic call from a particular billing number to a specific telephone number or to a country or city to which fraudulent calls are known to be made by setting a deny indicator for that particular destination number (step S11) or to that particular country or city code (step S12). In this manner, the NAI  40! is able to search the record associated with the particular billing number to determine if that specific destination number, country code or city code is set to &#34;deny.&#34; If so, then the NAI  40! transmits a deny response back to the switch  10, 20! via the CCS7 signalling network to block the call or to take other appropriate action (step S9). Otherwise, if the indicator for the destination number, country code or city code is not set to &#34;deny,&#34; then the NAI  40! continues to process the query. 
     In continuing to process the query, the NAI  40! again searches the record for the particular billing number to determine if the call is to receive thresholding (step S13). In each record stored in the Customer Account Table of the NAI database is a Call Treatment Category Code which defines, among other things, the type of thresholding assigned for the particular customer. This thresholding is user defined and it is not intended that the examples discussed herein limit in any way the use of other parameters known in the art for monitoring telephone patterns to detect fraudulent calls. 
     For instance, referring to the table illustrated in FIG. 5, there is shown a Treatment Category assigned to a medium risk customer. This Treatment Category defines which call types are to included in each of the four threshold counters or buckets. For the Treatment Category assigned to the medium risk customer illustrated in FIG. 5, for instance, the first threshold counter (as indicated by the presence or absence of an &#34;X&#34; beneath the threshold counter) is defined for calling cards (CC) and is set to accumulate and store the total amount of dollars and cents or minutes charged to international and domestic LEC cards (INTL LEC CARD and DOM LEC CARD). 
     The second threshold counter illustrated in FIG. 5 is defined for billed number screening (BNS) and is set to accumulate and store the total amount of dollars and cents or minutes charged to international collect (INTL COLLECT), domestic collect (DOM COLLECT), international bill to third party (INTL BT3) and domestic bill to third party (DOM BT3) calls. 
     The third threshold counter illustrated in FIG. 5 is defined for direct dialed international toll calls (1+INTL) and is set to accumulate and store the total amount of dollars or minutes charged to international sent paid (INTL SENT PAID), international toll calls including 1+900 numbers (INTL TOLL, INCL 900) and international commercial credit card (INTL COMM CREDIT CAR) calls. 
     Finally, the fourth threshold counter illustrated in FIG. 5 is defined for direct dialed domestic toll calls (1+DOM) and is set to accumulate and store the total amount of dollars or minutes charged to domestic sent paid (DOM SENT PAID), domestic toll calls not including 1+900 numbers (DOM TOLL, NOT INCL 9), domestic 1+900 toll calls (DOM TOLL 900) and domestic commercial credit card (DOM COMM CREDIT CARD) calls. 
     To further illustrate the flexibility of NAI  40!, an example of a Call Treatment Category which might be assigned to a high risk account is illustrated in FIG. 6. The call types are similar to those illustrated in FIG. 5, but the four user defined counters are defined to accumulate and store the amount of dollars or minutes charged to bill to third party (BT3), collect (COL), international (1+INTL), and the total of all calls (TOTAL), respectively. 
     Based upon the record stored in the Customer Account Table of the NAI database, the NAI  40! is capable of determining whether a call is to be denied/blocked or allowed with thresholding. If a call having thresholding assigned to the account is to be allowed (step S14), the NAI  40! sends a response back to the appropriate switch  10, 20! through the CCS7 signalling network to allow the call (step S15). On predetermined intervals during the progress of the call, the NAI  40! sends a query through the CCS7 signalling network to the switch  10, 20! to determine whether the call is still in progress and the switch transmits a signal back to the NAI  40! back through the CCS7 signalling network an appropriate response (step S16). If the call is still in progress, the NAI  40! calculates the usage or billable time in minutes of call duration (which corresponds approximately to the time elapsed since the NAI&#39;s transmission of the allow response) (step S17). The NAI  40! stores the total usage time in the threshold counter or bucket corresponding to the type of call (as defined by the Call Treatment Category). This usage time is added to the amount previously stored in that threshold counter and the new total is stored in the threshold counter. 
     This process continues and repeats steps 16-20 while the call is in progress until such time as the call is terminated. Upon termination of the call by the customer, the switch  10, 20! transmits an end-of-call signal to the NAI  40! through the CCS7 signalling network and the NAI  40! updates the total stored in the threshold counter up to the time the call was terminated. 
     Alternatively, the NAI  40! may calculate the estimated cost of the particular call by multiplying the measured usage time by the applicable rates contained in the Domestic and International Rate Tables stored in the database of the NAI  40! (step S18). The NAI  40! stores the total estimated cost in the threshold counter corresponding to the type of call (as defined by the Call Treatment Category). When the cost of a particular call is estimated by the NAI  40!, that cost is added to the amount previously stored in that threshold counter and the new total is stored in the threshold counter (steps S19 and S20). 
     For each user defined threshold counter, the customer&#39;s assigned treatment category also defines at least one threshold level to alert the NAI  40! and the IXC when the particular customer has exceeded the user defined threshold. Preferably, more than one threshold limit may be defined for each threshold counter. Therefore, irrespective of whether the NAI  40! stores usage time (minutes) or the estimated cost of the call (dollars and cents) in the threshold counters, the NAI  40! compares the total (minutes or dollars) to the predefined threshold limits for the particular threshold counter (step S21). When a threshold limit is exceeded (step 122), the NAI  40! identifies the customer as a potentially fraudulent caller (step S23) and takes certain precautionary/investigatory actions, such as denial of the call, interrupting the call in progress, or redirecting the call to an appropriate work center of the IXC (step S24). As such, the NAI  40! may monitor a specific customer&#39;s calling patterns on a real time basis to determine if the customer&#39;s telephone usage is indicative of potentially fraudulent activity. 
     The NAI  40! may also be provided with a velocity threshold counter which would store the total number of calls charged to a particular billing number in a predetermined period of time. Each time a call is made within that predetermined period of time that is to be charged to a particular billing number, the NAI  40! increments the velocity threshold counter by one and stores the new total in the velocity threshold counter. When the total stored in the velocity threshold counter exceeds a predefined threshold limit indicative of fraudulent activity, the NAI  40! identifies the customer (billing number) as a potentially fraudulent caller and may take additional user-defined investigatory actions. 
     In addition to the above-described thresholding function, the NAI  40! is also able to detect potentially fraudulent calls billed to a cellular telephone number. Since cellular telephone calls are readily identifiable based upon the billing number (MIN) and/or Original Line Identification (OLI) information transmitted to the NAI  40! in the initial query from the IXC switch  10, 20!, the NAI  40! is able to determine whether the call is made from a cellular telephone (step S25). 
     For cellular calls (step S26), the NAI  40! further checks whether there is another call in progress from that billing number (MIN) to determine whether more than one call is being billed simultaneously to the same billing number (MIN) (step S28). Since only one call may be charged to a cellular billing number (MIN) at a given time, the NAI  40! has identified potentially fraudulent activity (step S23) and takes certain user-defined precautionary or investigatory actions when more than one cellular call is simultaneously billed to the same billing number (MIN) (step S24). 
     Additionally, the NAI  40! is able to monitor the time and originating switches from which a cellular call is placed. When more than one cellular call is charged to the same billing number (MIN) in a relatively short period of time (step S29), each of which is from different originating switches (indicating potentially different geographic locations), the NAI  40! again has identified potentially fraudulent activity (step S23) and may take certain user-defined precautionary or investigatory actions (step S24). 
     Although illustrative preferred embodiments have been described herein in detail, it should be noted and will be appreciated by those skilled in the art that numerous variations may be made within the scope of this invention without departing from the principle of this invention and without sacrificing its chief advantages. The terms and expressions have been used herein as terms of description and not terms of limitation. There is no intention to use the terms or expressions to exclude any equivalents of features shown and described or portions thereof and this invention should be defined in accordance with the claims which follow.