Route integrity
Detecting false answer supervision with delayed playback
False answer supervision (FAS) is route fraud that keeps minutes billing without the conversation. In the delayed-playback form the vendor answers legitimately, then a minute or two in swaps the callee leg for a recording. Open Voice Shield reads the callee channel, catches the switch, and flags the route.
The fraud
What delayed-playback FAS looks like
Delayed-playback FAS, LDFAS from here on, is the patient variant of false answer supervision. The classic forms are crude: answer before the callee does, or play fake ringback into a call that never connected. LDFAS is harder to catch because the call starts genuine.
- The call connects for real
- Real ringback, a real answer, sometimes a real human and a real opening conversation. Every early signal an operator checks (answer supervision, audio in both directions) is legitimate.
- The switch-over
- Roughly one to two minutes in, the vendor silently swaps the callee leg for a recording: a loop, canned prompts, speech unrelated to what the caller is saying. Signalling does not change, and the call stays up and stays billable.
- Who it robs
- A real caller, mid-conversation, now talking to a recording, and the operator buying the route, who pays for every one of those minutes. The victims are the callers engaged enough to be worth stringing along.
Test calls vs live traffic
Why manual route testing misses it
A test call confirms that a route answers and carries audio. LDFAS is built to survive that check.
| Property | Manual test call | Sampled live traffic |
|---|---|---|
| Call length | Seconds: long enough to confirm answer and audio | Real conversations, including the long calls the fraud needs |
| Who is talking | A script, a tone, or a silent tester | A real caller with a reason to stay on the line |
| The switch-over | Happens after the test call has already hung up | Lands mid-call, on the callee channel of the recording |
| What it proves | The route answers and carries audio | What the callee leg was doing in minute three |
| What the vendor sees | A short call that looks like a test | Nothing to game: a sampled call is ordinary traffic |
Continuous monitoring of live calls beats synthetic test calls for this class of fraud. It is the only method that sees real long calls, and a randomly sampled call is indistinguishable from the rest of the traffic.
The mechanism
How Open Voice Shield detects it
Detection needs no new probe or test number. It uses what every analyzed call already produces.
- Two legs, two channels
- Every analyzed call is recorded with the caller on one channel of a stereo WAV and the callee on the other, reconstructed from the media capture. The legs never blur into one track.
- Per-channel transcription
- Each channel is transcribed separately, then merged by start time, so every line is attributed to caller or callee. What the callee leg said, and when, is readable on its own.
- The check
- The analysis reads the callee channel for a mid-call switch from interactive conversation to looping or non-responsive playback: repeated phrases, canned prompts, speech that stops answering what the caller is saying.
- The route alert
- A call showing that switch carries a route alert, distinct from the caller verdict, recommending that the vendor serving that route be taken out of rotation before the next caller is scammed. The recording and per-channel transcript are attached as the evidence.
Limits
Detection is not a guarantee. A route with no alert has not been certified clean, and we publish no detection or accuracy figure for this check. None has been measured against a labelled corpus. What the alert gives you is a recorded, transcribed, channel-attributed call to judge for yourself.
The on-ramp
You do not have to route everything
Open Voice Shield is an ordinary SIP hop, so your switch decides how much traffic goes through it. Spot-checking a random share is a supported pattern.
A dial plan that can distribute calls across carriers can send a random percentage of them through Open Voice Shield (one call in ten, one in twenty, whatever your switch supports) and route the rest directly. The sampled calls still reach their destination through your own routing. They pass one extra hop on the way.
A switch that cannot split traffic by percentage does not have to. Route everything through the hop and set the destination to analyze 1 in N calls. Open Voice Shield picks the sample deterministically and relays the rest untouched. The calls outside the sample are still recorded and can be analyzed on demand from the call page, and a caller under a control, a caller in an open case, or a route with a recent alert is always analyzed.
- You pay for the calls you sample. Pay-as-you-go has no monthly fee and no concurrency limit. A call is charged for its minutes plus one flat analysis fee. Sampling a tenth of your traffic incurs a tenth of the calls.
- Every sampled call is a complete evidence pack. Recording, per-channel transcript, verdict, pcap and SIP ladder: the same artefacts as a fully routed call, because it is one.
- Both directions of fraud show up in a sample. A scam caller and a playback-swapped route are both patterns across calls, so a random sample surfaces either without watching everything.
The trade-off
Sampling trades coverage for cost. A ten-percent sample catches patterns (a route swapping calls to playback, a campaign of scam calls), not every single fraudulent call. The catch still compounds: when a sampled call trips an automation rule, the caller's next attempt is blocked at authorization, whether or not that attempt would have been sampled.
Sampling and route alerts pair into continuous route QA on live traffic: a random share of real calls through the hop, and any callee leg that switches to playback flags its vendor. That beats synthetic test calls for LDFAS because it sees the real long calls the fraud is aimed at.
Questions
Delayed-playback FAS, asked directly
What is false answer supervision (FAS)?
False answer supervision is route fraud in which a vendor in the call path signals answer, or keeps a call up, so that billable minutes run without the conversation the caller is paying for. The classic forms answer before the callee does or play fake ringback; the delayed-playback form starts as a genuine call.
What is delayed-playback FAS?
Delayed-playback FAS (LDFAS) is a variant in which the call is answered legitimately (real ringback, often a real person) and then, typically a minute or two in, the vendor silently switches the callee leg to a recorded loop or canned prompts to keep the minutes running. The caller keeps talking to a recording.
Why do manual test calls miss delayed-playback FAS?
Because test calls are short and scripted: they confirm answer, check audio and hang up before the switch-over ever happens. The victims are real callers deep enough into a genuine conversation to be worth stringing along, so only live long calls show the pattern.
Do I have to route all my calls through Open Voice Shield to catch it?
No. Open Voice Shield is an ordinary SIP hop, so your dial plan can route a random share of traffic through it, one call in ten or twenty, and every sampled call is fully analyzed. Sampling catches patterns on a route, not every single call.
Is a route alert the same as the fraud verdict?
No. The verdict scores the caller. The route alert flags the route that carried the call, recommending the vendor serving it be taken out of rotation. One call can have a legitimate caller and still expose a fraudulent route.
Put a sample of your traffic through it
Whitelist your SIP server's IP, add a sampled route in your dial plan, and read what the callee leg of your routes is doing. The call path in detail shows where the hop sits.
No card is needed to create an account, and there is nothing to install. A route-quality question this page does not answer goes to the team.