How Much Does Telecom Fraud Software Cost in 2026?

What fraud detection costs by scope

The economics of this category are unusual. Most software is bought to save labour. This is bought to avoid a single catastrophic event, which means the right question is not what it costs but what one bad weekend costs you.

• Real-time detection and blocking, $80,000 to $175,000, 12 to 18 weeks. Live event ingestion from your switch or session border controller, rolling counters, per-customer behavioural baselines, a rule engine your operations team can edit, graduated automated actions wired into your controls, a case queue with full audit, and shadow mode for validating rules against live traffic before arming them.
• Broader fraud programme, $220,000 to $350,000, 8 to 11 months. Learned scoring on top of rules, subscription and identity fraud detection, and reconciliation against wholesale invoices so detection and revenue assurance share one view.
• Multi-network correlation, $350,000 to $500,000, 11 to 14 months. Correlation across interconnects and networks you do not fully control, deep reseller hierarchies, and automated action across multiple control points.

Module pricing inside the detection layer

• Live event ingestion from one traffic source: $14,000 to $28,000
• Rolling counters and per-customer behavioural baselines: $12,000 to $25,000
• Rule engine editable by operations rather than engineering: $14,000 to $28,000
• Graduated automated actions into controllers and provisioning: $12,000 to $26,000
• Case queue with full audit and reconstruction: $10,000 to $20,000
• Shadow mode and rule tuning against live traffic: $8,000 to $18,000
• Alerting, escalation and on-call handoff: $4,000 to $10,000
• QA, arming plan and staged live cutover: $6,000 to $20,000

The rule engine line is the one buyers try to cut, and it is the one to protect. If changing a threshold requires a developer and a release, your detection logic will always lag the fraud by exactly your release cycle. Paying $28,000 once so a fraud analyst can edit rules at nine on a Saturday morning is a better trade than paying less and waiting until Monday.

Why shadow mode is a budget line, not a nicety

Arming automated blocking against live customer traffic without validating the rules first is how a fraud system takes down a legitimate business customer on its first weekend. Shadow mode runs every rule against live traffic and records what it would have done without doing it, so you can tune against real behaviour for a few weeks before anything is armed. It costs $8,000 to $18,000 and it is the difference between a system operations trusts and a system operations switches off after the first false positive. Any quote that omits it is quietly transferring that risk to you.

What pushes the number up

• Multiple traffic sources. Each source is a separate ingestion pipeline with its own event shape, timing and reliability characteristics. This is the largest single multiplier in the category.
• Writing actions into a live controller. Reading traffic is comparatively cheap. Changing production controls automatically needs safety design, rate limits, a rollback path and an approval model, and all of that is engineering rather than configuration.
• Multi-tenant reseller structures. When the account that must be suspended sits three levels below the account you bill, both the detection scope and the action scope have to understand the hierarchy.
• Correlation across networks you do not control. Data sharing, timing skew and identifier mismatch turn a clean detection problem into a data engineering problem.
• Retaining event history for investigation. Keeping enough raw detail to reconstruct an incident months later is a storage and query cost that grows quietly with traffic.

What pulls the number down

• Outbound international only, on one platform. Almost all catastrophic single-event loss in this category is outbound international. Scoping the first release to exactly that cuts the build substantially and covers the case that would actually hurt you.
• Shadow mode before arming. Counterintuitively this saves money, because tuning against live traffic avoids the expensive rebuild that follows a system nobody trusts.
• Rules before learned scoring. A well-tuned rule engine handles the large majority of the loss. Learned scoring is a later phase funded by the first one, not a launch requirement.
• Reusing your existing event feed. If your mediation platform already produces near-real-time records, ingesting from it rather than from the switch can remove $10,000 or more and a fortnight.

A worked example that adds up

A hosted voice provider with roughly 6,000 seats, one softswitch, outbound international exposure and no fraud tooling beyond a monthly invoice review.

• Discovery, exposure assessment and rule design, 2 weeks: $13,000
• Live event ingestion from the softswitch, 3 weeks: $22,000
• Rolling counters and per-customer baselines, 2 weeks: $17,000
• Rule engine with an operations-facing editor, 3 weeks: $24,000
• Graduated automated actions into the session border controller, 3 weeks: $22,000
• Case queue, shadow mode and staged arming, 2 weeks: $16,000

Total $114,000 across 15 weeks. Set that against the arithmetic that matters: a single unattended weekend of international revenue share fraud on one compromised customer account can produce a wholesale bill in the same order of magnitude, and you still owe it whether or not you can recover it from the customer.

Where the money goes, phase by phase

• Weeks 1 to 2, around 11 percent of the total. Exposure assessment. What can actually be lost, how fast, and through which destinations. Cheap, and it determines the whole scope.
• Weeks 3 to 7, roughly 34 percent. Ingestion and baselines. Unglamorous data engineering that everything else depends on.
• Weeks 8 to 13, roughly 40 percent. Rule engine and automated action. The heaviest phase and the one with the most safety design in it.
• Weeks 14 to 15, roughly 15 percent. Shadow running and staged arming. Extend it rather than compress it. Rules armed before they are tuned generate false positives against your best customers.

Pricing the loss you are insuring against

Most software is justified against labour saved. This is not, and the arithmetic you need is different. Do it before you request a quote.

• Calculate your worst unattended window. Take your highest cost destination rate, multiply by the maximum concurrent channels a single compromised customer account could use, and multiply by the hours between Friday evening and Monday morning. That number is your exposure. For most operators it is the first time anyone in the business has seen it written down.
• Subtract what you could realistically recover. You owe the wholesale carrier regardless. What you can recover from a customer whose phone system was compromised is a separate question with a frequently disappointing answer.
• Count the near misses. A spike you caught by luck is not a clean record. It is an unpriced risk that happened to land during working hours.

Compare the residual figure against $80,000 to $175,000. In our experience the exposure number settles this decision for most hosted voice and wholesale operators within about ten minutes, and it also tells you which destinations the first release needs to cover.

The running costs nobody quotes

• Maintenance and change, 15 to 20 percent of build cost a year. Roughly $17,000 to $23,000 on a $114,000 system, and this one genuinely is ongoing because fraud patterns move.
• Quarterly rule tuning. Budget engineering or analyst time every quarter. A rule set frozen at go-live degrades, and the degradation is invisible until it is expensive.
• Destination cost data upkeep. Detection depends on knowing which destinations are expensive, and that list changes. Keep it current or the rules go blind in the exact places that matter.
• Event storage and query, $6,000 to $30,000 a year. Driven by traffic volume and how far back you need to reconstruct an incident.
• On-call coverage. Automated action reduces the need for a human at 3am, it does not remove it. Somebody has to be reachable when the system suspends an account that turns out to be legitimate.
• Analyst training and handover. The rule engine is only worth what it cost if more than one person can safely edit it.

When not to spend this money

If your total outbound international exposure is genuinely small, do not build anything. A hard destination whitelist, a low per-customer credit ceiling and international barring by default with opt-in is crude, costs almost nothing, and eliminates the catastrophic case entirely. If your customers rarely call internationally, that is the correct answer and it is free.

If you are a large carrier with a staffed fraud function, multiple networks and appetite for a multi-quarter deployment, buy a specialist platform instead. Their domain depth is worth what it costs at that scale and writing your own is not a good use of your engineering.

The build case sits in between: a hosted voice or wholesale operator sitting between customers you do not control and upstream carriers you owe, with traffic diverse enough that global thresholds are unusable, and a need to change detection logic faster than a vendor release cycle allows. That is a real position and a lot of providers are in it.

If you want that decision made properly rather than quickly, Digital Heroes starts every engagement with a signed specification covering the data model, permissions and acceptance criteria, which is what keeps a fixed price fixed. You keep the specification either way.