A scheme in which fraudsters generate large volumes of calls to high-cost international or premium numbers and collect a share of the resulting termination revenue.
IRSF exploits the way international termination is settled. A fraudster obtains, often through a reseller, a range of numbers that pay out a portion of the termination fee for every minute of traffic. They then pump calls into those numbers from compromised accounts, hacked PBXs, stolen SIP credentials, or subscription fraud on new accounts.
The originating provider bills its customer, or more often cannot collect from the compromised customer, but still owes the downstream carrier for the minutes. Because settlement happens later, the fraudster is often paid before anyone notices the problem. In many cases the compromised customer disputes the bill, leaving the provider to absorb the loss or pursue a difficult collection.
Typical signs include sudden spikes in calls to unusual destinations, many short or exactly repeated call durations, traffic outside the customer's normal hours, and sequential dialing through number ranges. Destinations that are frequently abused shift over time as carriers tighten controls on familiar ones. Reviewing these signals per account and per destination, rather than only in aggregate, is what allows an attack to be stopped while it is still small.
Why it matters to carriers
IRSF losses usually land on the originating provider or its customer, and they accumulate in hours, not weeks. Real-time monitoring of destination mix, spend velocity, and concurrent calls per account, combined with sensible default limits on international dialing, is the most effective protection a SIP trunk or UCaaS provider has.