Book a demo
Detect. Decide. Defend.

Catch the fraud your BSS can't.

The real-time decision-control platform for telecom operators.

Tellaris turns fragmented telecom events into real-time, governed decisions for fraud, revenue protection and business assurance. One behavioural model across signalling, CDR, roaming and billing, catching today's fraud and tomorrow's anomalies.

Book a 30-min demo See how it works
  • Sub-150ms decisions, end-to-end
  • Built for operators that need Tier-1 fraud capability without building a Tier-1 data engineering team.
  • On-prem by default, GDPR-aligned
<150ms
end-to-end
Every CDR scored by every active rule, in parallel to the call flow
Unified
fraud model
SIM box, Wangiri, IRSF, roaming, high-usage, and SMS
Passive
and parallel by default
Actions only through endpoints you control. If Tellaris stops, every call still completes
2-3 wk
to deployment
Customer-isolated passive-mode. Half a day to first alert on a CDR replay
The problem

Mid-size operators lose 2-5% of revenue to fraud every year. Enterprise fraud suites are often too slow, expensive, or heavy for them.

Tier-1 carriers run Subex, Mobileum, or custom-built fraud stacks staffed by 20-person teams. If you're an operator serving 1-20M subscribers, the licensing alone prices you out. Meanwhile SIM box bypass is draining your international termination revenue, Wangiri bots hit your subscribers overnight, and IRSF quietly inflates wholesale invoices you pay 60 days later.

  • Revenue leakage is invisible until the wholesale invoice lands. By then the ROI to contest is marginal and the fraud ring has moved on.
  • Static rules miss adaptive fraud by design. Attackers now rotate routes, slow their rates, and mimic normal usage to stay under thresholds tuned for yesterday's threat model.
  • "AI fraud detection" from big vendors ships in 18 months. You need something in production this quarter, not after the next board review.
The platform

Ingest. Detect. Act. Learn.

One pipeline from stream ingestion to governed enforcement, and back again. The loop is what keeps detection current as fraud shifts.

  1. 01
    Ingest

    Stream every CDR, signal, and subscriber event

    Kafka-compatible ingestion from your mediation layer, rated-CDR exporters, and signalling probes. Flexible ingest adapters with governed Avro contracts once feeds are onboarded, so we adapt to your data rather than the other way around.

    Tier-2/3 CDR rates, load-tested beyond
  2. 02
    Detect

    Correlate across streams in real time

    Our stateful core joins voice, signalling, and subscriber-profile signals in a single pass. Rule engines catch known fraud patterns, ML scoring surfaces the novel ones.

    Sub-150ms end-to-end
  3. 03
    Act

    Governed response. Audited handoff.

    Trigger a block, rate limit, step-up review, network-policy action or case-management workflow, under the policy the operator published. Every decision is logged with the signals that triggered it, so analysts can see why.

    Explainable by default
  4. 04
    Learn

    Every disposition sharpens the model

    Analyst outcomes feed back as labels, so rule quality is judged on real traffic rather than assumption. Scoring retrains on the operator's own data, and updated models reload onto the hot path without a redeploy.

    Closed loop, single-operator
System overview

Where Tellaris sits in your network.

Tellaris reads your signalling and rated CDRs and keeps a live behavioural profile per subscriber, entirely on your own infrastructure. Most events are scored and monitored silently. When a case crosses the action threshold, Tellaris fires an enforcement decision to your BSS, and the cases your team confirms sharpen detection over time.

Tellaris on-prem telecom fraud detection: signalling, CDRs and subscriber profiles stream into the core, which monitors silently and escalates to the BSS on a threshold breach Animated diagram. Orange streams flow from Signalling & CDRs and Rules & Intelligence into the central Tellaris core, which maintains a live per-subscriber profile store. Sky-blue streams flow out to Dashboards & Alerts, the BSS/OSS, and your SOC/SIEM. Most events are monitored silently; when a case crosses the action threshold a red fraud event escalates and a flag is dispatched to the BSS. A green feedback loop shows confirmed fraud reported by the BSS sharpening detection. Everything runs on the operator's own infrastructure. enforce on threshold breach confirmed fraud sharpens detection Signalling & CDRs Rated CDRs, signalling, roaming and network events Subscriber profiles Rules & Intelligence Versioned rules enriched with threat intel Dashboards & Alerts Analyst console, real-time insights and case review BSS / OSS Enforcement webhook on high-confidence fraud FRAUD FLAGGED SOC / SIEM Stream alerts to your security operations and case tools Observability & Evaluation Monitor. Detect. Investigate. Continuously improve. Security & IT Infrastructure Secure by design. Built for scale. Decisioning engine On-prem by design No data leaves your network Passive integration Runs parallel to the call flow Broad fraud coverage IRSF, Wangiri, roaming, SIM-box, high-usage… Sub-150ms Decisions, end-to-end Tellaris on-prem telecom fraud detection: signalling, CDRs and subscriber profiles stream into the core, which monitors silently and escalates to the BSS on a threshold breach Animated diagram. Orange streams flow from Signalling & CDRs and Rules & Intelligence into the central Tellaris core, which maintains a live per-subscriber profile store. Sky-blue streams flow out to Dashboards & Alerts, the BSS/OSS, and your SOC/SIEM. Most events are monitored silently; when a case crosses the action threshold a red fraud event escalates and a flag is dispatched to the BSS. A green feedback loop shows confirmed fraud reported by the BSS sharpening detection. Everything runs on the operator's own infrastructure. Signalling & CDRs Rules & Intelligence Decisioning engine Subscriber profiles Dashboards & Alerts BSS / OSS FRAUD FLAGGED SOC / SIEM On-prem by design Passive integration Broad fraud coverage Sub-150ms
Governance & auditability

Put operator policy at the centre of every decision.

A decision an operator cannot explain is a decision an operator cannot defend. Tellaris treats policy as the control surface: your rules, your thresholds, your exceptions, applied consistently and recorded end to end.

See what the operator decided, and why. Every event is traceable through the full chain.

  1. Entity
  2. Journey
  3. Policy
  4. Decision
  5. Action
  6. Outcome

Policy ownership stays with the operator

Rules are authored, versioned and published by your team, not configured behind a vendor support ticket. Thresholds, actions and scope are yours to set and yours to change.

Approvals and exceptions are first-class

Rule changes move through an explicit review and promotion path, and enforcement can be held pending approval instead of firing automatically. Protected subscribers stay out of enforcement entirely.

Every decision carries its receipt

Publication history, the signals that fired, the tier applied and the dispatch result are all retained. Analysis, audit and compliance review read the same record.

How we fit in

Make your existing systems work as one decisioning environment.

Tellaris does not replace your fraud-management, revenue-assurance, BSS, charging or network-control platforms. It connects their signals, enriches them with cross-domain context and applies consistent, governed policy before coordinating the appropriate response.

Tellaris is passive and parallel by default. It can initiate selected actions through endpoints you control, once your policies have been validated. We don't touch the call flow.

Use your existing intelligence

Consume alerts, risk scores and events from the fraud, assurance and network systems you already run, plus clearing-house feeds and in-house tooling. Nothing gets decommissioned to make room for us.

Add cross-domain context

Combine network activity with subscriber, billing, roaming and commercial information. Rated and mediation CDRs today; GGSN / PGW, Diameter on the DRA and SS7/SIGTRAN light up as you publish them.

Govern decisions consistently

Apply shared policies, thresholds and exceptions across otherwise disconnected systems, so the same subscriber is not treated three different ways by three different tools.

Coordinate action

Send explainable decisions to the right operational system or analyst workflow. Decisions map to your own endpoints via the Triggers page, on a fail-closed allowlist with bearer or HMAC auth.

A convergent platform

Many fraud typologies. One behavioural model. One decisioning foundation.

Convergent means one behavioural model across mobile, fixed, voice, SMS, data, roaming, interconnect, subscriber and commercial events. Fraud typologies share substrate features (velocity, fan-out, destination risk, subscriber deltas), so a single streaming pipeline covers them all and extends across domains as feeds onboard, alongside your existing systems and not one project per fraud type. Fraud is the entry point. The same foundation carries the policy decisions operators want next.

SIM-BOX

SIM box bypass

International voice traffic re-terminated over GSM gateways to evade settlement. We detect by correlating call patterns with HLR location, velocity, and CDR signatures.

Primary signal Velocity + location + traffic-pattern anomaly
WANGIRI

Wangiri callback fraud

Missed-call bots seeding callbacks to premium-rate numbers. We catch the campaign footprint in seconds, not after complaints land at customer care.

Primary signal Fan-out pattern + premium-rate destination
IRSF

International revenue-share fraud

PBX compromise → high-value calls to IPRN destinations. We rate-limit and alert before the first full-hour session completes.

Primary signal Destination risk + unusual session duration
ROAMING

Roaming fraud

Impossible-velocity country flips and high-cost roaming abuse. We correlate location, velocity, and destination risk to catch it before the roaming invoice lands.

Primary signal Velocity + location + destination risk
HIGH-USAGE

High-usage abuse

Runaway consumption from PBX hijack, compromised SIMs, and tariff arbitrage. We cap spend before the loss compounds, rather than after the bill is cut.

Primary signal Usage spike + spend velocity
SMS-SPAM

SMS spam & smishing

Phishing campaigns and A2P grey-route abuse. Metadata-first detection on originator reputation and velocity, with optional content classification where legally enabled, flags new campaigns within minutes.

Primary signal Originator + velocity + optional content
Architecture

Boring, proven infrastructure. No vendor lock-in.

Every layer of Tellaris is open-source or open-standard. The streaming fraud-detection blueprint (Kafka-compatible ingest, stateful operators, ML scoring) is a proven carrier-grade pattern. Tellaris productizes it: deployable in weeks for operators who don't have a 20-person streaming team.

Layer Technology Note
Orchestration Helm on k3s or vanilla Kubernetes Self-host or managed
Detection engine Stateful in-process decisioning · rules + ML scoring Sub-150ms end-to-end
Ingestion Kafka-compatible streaming · Avro schemas + registry Backward-compatible CDR contracts
Enrichment PostgreSQL + in-memory cache Subscriber + destination risk features
Observability Prometheus · Grafana · OpenTelemetry Per-rule SLO dashboards
Why the approach works

Grounded in proven detection, not promises.

Tellaris productises a detection approach with a track record in research and at carrier scale, on infrastructure operators already trust. The evidence, not a pitch.

FAME research project
<5% false positives

Independent benchmark for ML-based international bypass detection. An industry reference, not a Tellaris result, and the accuracy bar our scoring is built to clear.

Real-time by design
Real-time continuous, not batch

Every event is scored and acted on as it streams in, not surfaced in tomorrow's batch report. That is the gap static, after-the-fact tooling leaves open.

CFCA industry estimate
~$40B lost per year

The scale of the problem, climbing yearly while prevention spend stays structurally underfunded. The case for getting ahead of it, not chasing it.

Security & compliance

Built to pass your procurement review.

Belgian-incorporated. No third-party data brokers. Every decision is logged for analysis, audit and compliance review.

  • GDPR-aligned
    Pseudonymised at the ingest edge (HMAC-SHA256)
  • Deploys in your infrastructure
    No SaaS dependency at runtime
  • ISO/IEC 27001:2022
    12-month certification track
  • Hardened supply chain
    Signed images, SBOMs, CI-gated scanners
Questions

What operators ask first.

The questions that open every first call, answered before you have to book one. Anything specific to your network is a better conversation over a replay of your own CDRs.

What is Tellaris?

Tellaris is a real-time decision-control platform for telecom operators. It turns fragmented events across signalling, CDR, roaming and billing into governed decisions on fraud, revenue protection and business assurance, using one live behavioural model rather than one tool per fraud type.

Does Tellaris replace our existing fraud management system?

No. It runs alongside the fraud-management, revenue-assurance, BSS, charging and network-control platforms you already operate. Tellaris consumes their alerts, risk scores and events, together with clearing-house feeds and in-house tooling, adds cross-domain context, and applies consistent policy across all of them. Nothing gets decommissioned to make room for it.

Does Tellaris sit in the call path?

No. It is passive and parallel by default, and it does not touch the call flow. Selected actions can be initiated through endpoints you control, on a fail-closed allowlist that refuses to dispatch anywhere else, once your policies have been validated. If Tellaris stops, every call still completes.

Which fraud types does Tellaris cover?

SIM box bypass, Wangiri callback fraud, IRSF, roaming fraud and high-usage abuse run on the shared behavioural model today. SMS spam and smishing follow as SMS feeds onboard. Typologies share substrate features such as velocity, fan-out, destination risk and subscriber deltas, so coverage extends across domains without a separate project per fraud type.

How fast is a decision?

Under 150ms end to end, from CDR to alert, at p95. Every CDR is scored by every active rule as it streams in, in parallel to the call flow, rather than surfacing in tomorrow's batch report.

What data do you need to get started?

Kafka-compatible ingestion from your mediation layer, rated-CDR exporters and signalling probes. The mix is yours to choose: Tellaris consumes whichever feeds you authorise, and GGSN / PGW, Diameter on the DRA and SS7/SIGTRAN widen what the rules can see as you publish them. Ingest adapters carry governed Avro contracts once a feed is onboarded, so the platform adapts to your data rather than the other way around.

How long does deployment take?

Two to three weeks to a customer-isolated deployment in passive mode, and about half a day to the first alert on a replay of your own CDRs.

Who writes and owns the rules?

Your team does. Rules are authored, versioned and published by the operator rather than configured behind a vendor support ticket, and changes move through an explicit review and promotion path. Thresholds, actions and scope are yours to set and yours to change, and protected subscribers stay out of enforcement entirely.

Can an analyst see why a decision was made?

Yes. Every event is traceable through entity, journey, policy, decision, action and outcome. Publication history, the signals that fired, the tier applied and the dispatch result are all retained, so analysis, audit and compliance review read the same record.

Where does Tellaris run, and who holds the data?

In your infrastructure, on-premises or in your private cloud, with no SaaS dependency at runtime. Subscriber identifiers are pseudonymised at the ingest edge with HMAC-SHA256, the deployment is GDPR-aligned, and there are no third-party data brokers. Tellaris is Belgian-incorporated and on a 12-month ISO/IEC 27001:2022 certification track.

Next step

See Tellaris running on a replay of your CDRs.

Bring one hour of anonymized CDRs to the demo call. We'll show you the fraud patterns our pipeline finds, which rules trigger, and which ML scores surface the non-obvious cases. 30 minutes, no slides.

By submitting you agree to be contacted about Tellaris. We don't share your email. Privacy.