The Rise of Phone Verified Account (PVA) Fraud: A New Threat to Telecom Operators

Last month, I had the opportunity to attend the GSMA FASG #31 meeting in Johannesburg, where industry leaders discussed emerging fraud threats. One of the key topics was Phone Verified Account (PVA) fraud, now formally recognized in GSMA’s Fraud Manual FF.21. While some may associate this with SIM farms, the reality is that PVA fraud has evolved into a global, highly profitable business model—one that presents significant risks for telecom operators and digital platforms alike.

One thing we can clearly see… SIM Box Fraud evolved into PVA Fraud.

Historically, SIM Boxes were used for bypass fraud, where fraudsters capitalized on disparities in international call termination rates. Their profitability was inherently limited by the volume of calls routed through these illegal gateways. However, the digital economy has transformed the landscape, and fraudsters have adapted.

Instead of merely routing calls at reduced rates, fraudsters now monetize SIM Boxes by enabling PVA services. This allows them to sell verified social media and digital service accounts, using legitimate mobile numbers to bypass authentication mechanisms. These fraudulent accounts become a gateway to phishing, smishing, mass spam, and other malicious activities, causing reputational and financial damage.

Fraudsters use multiple tactics to facilitate PVA fraud:

• SIM Boxes: Used to manage large volumes of SIM cards that receive OTPs for account verification.
• Operator Numbers: Fraudsters leverage random subscriber numbers, routing OTPs through illicit aggregators.
• Malware-Enabled OTP Forwarding: Infected mobile devices secretly forward OTPs, allowing fraudsters to create and verify fake accounts.

Unlike traditional bypass fraud, PVA fraud scales globally from a single fraudster (seller), making it significantly more profitable and harder to detect due to the low amount of traffic it generates.

Beyond direct revenue loss, PVA fraud introduces severe risks for the operator:

• Subscriber Trust Erosion: Operators become inadvertently complicit in enabling fraudulent activities.
• Regulatory Scrutiny: Governments worldwide are introducing stricter regulations to combat fraud and online anonymity.
• Security & Compliance Risks: Fraudulent accounts facilitate cybercrime, impacting data security and compliance mandates.

At Mobileum, we continuously evolve our fraud detection and risk management solutions to stay ahead of emerging threats like PVA fraud. Our Risk Catalogue in RAID 9 provides operators with:

• Comprehensive risk mapping for PVA fraud
• Advanced fraud detection controls
• Real-time monitoring and mitigation strategies

With PVA fraud posing a growing threat, telecom operators must act decisively. At Mobileum, we remain committed to delivering innovative and intelligent fraud prevention solutions, empowering our clients to detect, analyze, and eliminate fraud efficiently.

Want to learn more? Let's discuss how we can help your organization tackle PVA fraud.