What are flash calls and how do they work?
Flash calls offer a cost-effective and frictionless way of authenticating mobile numbers, but there is more than one catch. Here we discuss how they work and what network operators need to do to ensure they are fairly compensated for the role they play.
What is a flash call?
A flash call is a near-instant dropped call that is automatically placed to a mobile number, usually as part of an authentication process known as flash call verification. By default, there is no termination fee charge for the call as it is not answered and is simply recorded as a missed call in the phone’s log.
Flash call verification is used as a cost-effective authentication solution and is particularly popular in countries where SMS and mobile phone calls are comparatively expensive.
How does flash call verification work?
Flash call verification is a way of authenticating a mobile phone number without the mobile user having to take any action.
It is used when a mobile user is registering for a service, installing an app, or doing anything that requires them to provide a valid mobile phone number to complete the process.
Unlike most conventional 2FA solutions that require the person to sometimes manually enter a code that is sent to them by SMS, the process uses some of the digits from the incoming calling number as the passcode. This is all done programmatically using APIs, so the customer doesn’t have to do anything and will be notified almost immediately that the verification process has been successful.
What are the benefits of flash call verification?
For businesses and their customers there are two primary benefits:
- Cost: With the reduced costs of flash call verification businesses can marginally make savings and therefore cover more use cases, including appointment booking, online payments, and even public Wi-Fi connections.
- Convenience: In most cases the process is silent and doesn’t require any action on the part of the user.
That all sounds good – what is the catch?
For end users there really is no catch – they get a quick, free, and painless authentication process.
Mobile Network Operators (MNOs) are the ones that stand to lose out. Flash calls are delivered via their infrastructure, but unlike SMS and text-to-speech calls they historically don’t make any revenue from them. Understandably they might consider this a bit unfair.
According to forecasts published by Juniper Research, flash calls as part of authentication solutions are forecast to grow from 60 million in 2021 to 130 billion by 2026. Much of this traffic will be shifted from existing SMS authentication, which is a significant revenue generator for MNOs.
What can MNOs do about flash calls?
To be able to monetize this traffic, MNOs need to act fast and get two things in place:
- They must be able to reliably identify flash calls made via their infrastructure.
- They need to be able to process voice call set-up traffic in real-time to allow them to control flash calls – either treated (via blocking or disruption) as revenue leakage of the A2P SMS traffic or to monetize flash calls with an exclusive or small set of partners.
To be able to treat flash calls in real-time, the first step is to introduce voice firewalls. Not only do these detect flash call traffic but they are also a key tool in preventing fraudulent activity like robocalling and grey routing of A2P SMS traffic. Not only do voice firewalls safeguard MNOs revenues but they can also be used to protect their subscribers from other voice frauds such as Wangiri.
Flash calls v A2P SMS for verification
Beyond simple pricing, there three import factors to consider when deciding if you should support your verification process with Flash Call or use A2P SMS to deliver a verification code.
1. Customer experience
It is true that flash calls do offer a frictionless number verification method where the customer doesn’t need to copy/paste the received OTP. However, you could also argue that people might get confused and perhaps a bit suspicious when they see the missed call entry in the call log.
This can be mitigated by informing them about the impending missed call, but that immediately starts adding friction to the process. Also, customer consent is required during app installation to access the call log. This means the method only effectively works with android apps that offer telephony services.
The A2P SMS method can also support the same seamless verification step when the customer provides permission for the app to access their SMS inbox. This allows the app to auto-find the OTP in the A2P SMS message.
2. Service quality
A2P SMS is regarded as offering better quality, especially if is delivered on direct connect routes. Unless of course the A2P messaging providers attempt to deliver the OTP SMS via grey routes.
Flash Call would need direct voice connects to the MNO network (e.g., SIP interconnect between the MNO and the FC provider) to achieve the same quality. As it is, Flash Call delivery occurs over the international voice network which can consist of many hops between the FC provider and the destination MNO network, which leads to quality issues on call termination.
Furthermore, it is well known that the CLI can become manipulated (also known as “CLI refiling”) or suppressed with multi-hop routing.
3. Security
There are often claims that SMS is not secure. We know that (unlike most OTT messaging) there is no end-to-end encryption for SMS services (mainly as MNOs are obliged to provide lawful intercept services). However, this same limitation applies to Flash Call as the CLI (which contains the sensitive OTP digits) is not end-to-end encrypted either.
With further analysis we can see that Flash Call has additional weaknesses when compared to A2P SMS.
| Fraud type | Impact | A2P SMS | Flash call |
|---|---|---|---|
| SIM swap | Fraudsters can sign-in to an app on the swapped SIM and hijack the victims social media / OTT account. | Vulnerable | Vulnerable |
| Intercept | Fraudsters can use an SS7 vulnerability that allow SMS and voice termination calls to be redirected to their system. | Vulnerable | Vulnerable |
| Call forwarding attack | Fraudsters can conduct an illegal call forwarding attack on a victim’s MSISDN, so all calls are forwarded to a phone controlled by the attacker. | Protected | Vulnerable |
| Grey route | Grey route threats emerge once an OTP delivery method is monetized by the MNO | Vulnerable | Vulnerable |
| CLI spoofing | Fraudsters conducting CLI spoofing attacks may offer Flash Call services and use spoofed CLIs. | Protected | Vulnerable |
| SIM box | Fraudsters operating SIM Box or SIM Farm as grey route for SMS and voice, may also offer Flash Call services | Vulnerable | Vulnerable |
Flash Call delivers the OTP as part of the CLI metadata whereas OTP is delivered as part of the message text for A2P SMS. Thus, the OTP has better protection from unauthorized discovery in jurisdictions where SMS message content is protected by data privacy regulations.
Should an MNO wish to monetize Flash Call delivery, then there is an equal threat of them being delivered via grey routes (e.g., international interconnect, SIM box devices, etc.). Such grey routes can only be eliminated by an effective voice filtering solution, and with the creation of “white routes” via dedicated connections between MNOs and legitimate Flash Call providers.
How we can help MNOs benefit from flash calls
Weighing up the benefits of flash calls, potential threats and the need for firewalls (covering at least SMS and voice), MNOs need to strategically examine their value for the whole ecosystem of phone number (MSISDN) verification. In their favor, they provide the network assets that can be ubiquitously used on any device to implement the verification process in a secure and trusted manner.
If MNOs tactically decide to provide multiple channels for phone number verification, then they need to consider the merit and use case for each channel and market this accordingly. For example, a text to speech call can be used in areas where the literacy rate is low. In the case of multiple channels, pricing needs to be designed such that the maximum revenue is gained overall. For example, one channel can be used as a secondary method in case of failure of the primary channel – meaning that the revenue associated with phone number verification is booked in case of failure on the primary channel.
Crucially, we have both the technical and compliance expertise to prevent fraud and identify billable calls, without mistakenly blocking legitimate traffic and therefore eroding revenues. While most SMS Firewalls only protect text messages, in order to offer verification over multiple channels, MNOs need to plan and deploy an “omnichannel” firewall supporting SMS, Voice, Signalling and other MNO native channels such as MMS and RCS.
White Paper: Flash Calls – a new source of revenue for MNOs?
DownloadRelated content:
