Four of India's Five Anti-Fraud Layers Stop at the Border
On 9 October 2026, at an ITU roundtable held alongside India Mobile Congress in New Delhi, India's Minister of State for Communications set out a five-layer national defence against telecom fraud and then asked for the one thing those five layers cannot supply. He backed an ITU proposal for joint operational trials of caller-identity verification between countries, beginning on selected bilateral routes.
Sigma Telecom has been in telecom since 2003 and in wholesale since 2014. From Istanbul we carry more than 150 million minutes and more than 300 million messages a month across more than 1,000 interconnections into more than 190 countries, over SIP and H.323 for international voice services and over SMPP, HTTP and SS7 for wholesale SMS, with a 24/7 NOC behind both. We have been an ITU sector member since 2018. What follows reads a national programme from the carrying layer; it is not an announcement.
The reason to read it from the carrying layer is structural. Four of India's five layers end at India's border, and the fifth reaches past it only by refusing traffic rather than by trusting it. That is not a criticism of the design — it is close to the best a single administration can do alone — but it is why the trial proposal, rather than the national figures, is the part of the week worth attention.
What India has actually built
Subscriber identity. C-DOT's ASTR platform matches subscriber records against the documents used to obtain them. The figure given at the roundtable was more than 82 lakh — over 8.2 million — fraudulently obtained mobile connections identified and disconnected.
Citizen reporting. The Department of Telecommunications reported on 5 October 2026 that its Sanchar Saathi portal had passed 30 crore visits since launching in May 2023. Through the Chakshu reporting facility it recorded 12.80 lakh inputs on suspected fraudulent communications, leading to action in 59.82 lakh cases and the disconnection of more than 50 lakh connections.
Intelligence distribution. The Digital Intelligence Platform moves fraud intelligence between the state, operators, banks and police. In December 2025 the DoT said more than 1,000 banks, third-party application providers and payment operators had been onboarded; the figure cited in October 2026 for all connected organisations was around 1,600.
A shared risk score. The Financial Fraud Risk Indicator rates a suspected mobile number as medium, high or very high risk, drawing on the national cybercrime reporting portal, Chakshu and submissions from banks and operators. It went live on 22 May 2025; six months later the DoT put prevented losses at about 660 crore rupees, and the October 2026 figure was more than 5,000 crore rupees.
The architecture behind those numbers is the point. Identity, reporting, distribution and scoring all sit inside one jurisdiction, where one authority can compel every participant to take part and every participant is reachable by the same law. No international route has ever satisfied that condition.
The one layer that reaches the interconnect
The exception is the International Incoming Spoofed Calls Prevention System, brought into service on 22 October 2024. It blocks incoming international calls presenting an Indian number as the calling line identity, on the reasoning that a call originating abroad has no legitimate claim to a +91 number outside a short list of roaming and hosted cases. In the first 24 hours operators identified and blocked about 1.35 crore such calls. By late December 2024 the government put the figure at around 6 lakh, a reduction of more than 90 per cent.
That is a large effect, and its mechanism is not the mechanism the ITU work is about. The system verifies nothing. It applies a rule about entitlement to a number range at the point of entry — the same family of control as the United Kingdom's rule, in force since January 2025, on calls arriving from abroad that present a UK number. It needs no cooperation from the far end and no agreement with the originating country. Its power comes entirely from the fact that a country can decide what it will accept at its own border.
It also shows what a refusal rule does not do. After the block took effect, the DoT's own public advice told citizens to be wary of calls from international numbers that do not begin with +91 and claim to come from Indian authorities. Close the route that presents a national number dishonestly and the traffic moves to foreign numbers presented honestly. Those calls are not spoofed. They are ordinary international calls with a fraudulent human on the other end, and no entitlement rule can tell them from legitimate ones.
Five layers, one border
The table sets out where each layer sits and what it can do about traffic originating outside India.
Layer | What it does | What it can see | Acts on foreign-origin traffic |
|---|---|---|---|
ASTR | Identifies and disconnects fraudulently obtained connections | Indian subscriber records and the documents behind them | No |
Sanchar Saathi and Chakshu | Citizen reporting, handset blocking, connection audit | Reports from Indian users | No |
Digital Intelligence Platform | Distributes fraud intelligence between state, banks, operators and police | Indian institutions that have joined it | No |
Financial Fraud Risk Indicator | Scores an Indian mobile number for fraud risk | Indian numbers and the transactions attached to them | No |
Spoofed-call prevention system | Blocks inbound calls presenting an Indian number | The calling line identity at the point of entry | Only by refusing it |
Why the corridor is the unit
The ITU set out its standards position on 1 October 2026: the mechanisms for signing a call are published, while the Recommendations settling who may issue a certificate and whose certificate another operator should believe are still in their approval process. India's contribution eight days later was not another standards argument but a deployment proposal — joint operational trials between willing countries, starting with bilateral corridors and across different network architectures, to refine the protocols before any wider rollout.
Choosing the route pair as the starting unit is the honest part of that proposal and the hard part. Verification only pays where both ends do it, so no country can make a signature meaningful on its own the way it can make a refusal rule meaningful on its own. Trust has to be rebuilt corridor by corridor — familiar territory for a wholesale carrier, because a corridor is a commercial object before it is a technical one. Three things follow.
It is an agreement, not a standard. A published Recommendation tells two administrations what to build. It does not tell them to build it, on which routes, by when, or at whose cost. A trial is a negotiation with a work plan attached.
A corridor is rarely two parties. Traffic between two countries routinely crosses transit carriers that are party to nothing either administration has signed. A trial designed around two endpoints has to decide what it expects of the carriers in between.
Someone has to own the failure policy. A trial must say in advance what happens to a call that fails the check — passed with an indicator, tagged, or dropped. That is a revenue decision as much as a security one, and it is the question most likely to stall a corridor that is otherwise technically ready.
What this does not establish
India's figures are national figures, achieved under conditions that do not travel: one regulator, one legal system, one set of institutions that can be compelled to participate. Treating them as a forecast for international routes would be a misreading.
Nothing announced on 9 October came into force; a proposal for trials is a proposal. Nor does any of this reach messaging, since caller-identity work does not touch alphanumeric SMS sender identity, which is governed country by country through separate registries. And verification, when it arrives, answers a narrow question — who presented this number — not whether the person behind it intends anything honest. That is a real gain and a limited one, and no operating posture, including our ISO and PCI DSS certifications, changes that arithmetic.
The conclusion is undramatic. The most complete national anti-fraud programme in the industry has reached the limit of what one jurisdiction can do and said so in public, at a standards body. The next unit of progress is the corridor, and corridors are built by the people who carry the traffic.
Frequently asked questions
What did India actually propose on 9 October 2026?
At an ITU roundtable held alongside India Mobile Congress in New Delhi, India backed an ITU proposal for joint operational trials of caller-identity verification across international networks, beginning bilaterally on selected routes. It is a proposal for trials, not a rule, and no obligation follows from it.
Does India's spoofed-call blocking system verify callers?
No. It blocks incoming international calls that present an Indian number as the calling line identity, which is an entitlement rule rather than a verification mechanism. It needs no cooperation from the originating country, which is why one administration could deploy it alone — and why it cannot distinguish a fraudulent call made from a genuine foreign number from a legitimate one.
Why can a country refuse a number range on its own but not verify one?
Refusal is a decision about what you accept, and you can make it unilaterally at your own border. Verification is a decision about whom you believe, and a signature is worth nothing unless the far end both produces it and validates it. The first needs one party, the second needs two, which is why deployment has to proceed corridor by corridor.
Does any of this apply to A2P SMS?
Not directly. Caller-identity work concerns voice calls. Alphanumeric sender identity in messaging is handled separately, country by country, through national sender-ID registries with their own rules. A carrier manages both, but a development in one says little about the other.
What would make a corridor count as covered?
Both ends performing the check is the minimum, but a country pair is normally reached over several paths, and some of those cross transit carriers that are party to nothing. Coverage is therefore a measurement per direction and per path rather than a yes or no for the country pair.
What should a buyer of international voice do while this is unsettled?
Ask route-level questions that have answers today rather than waiting on a standards outcome. How signalling information is handled on a given route, how a destination is reached and over how many paths, and how quickly a change on that route is noticed and explained are all answerable now, and they are what our services and 24/7 NOC are organised around.
Learn more: international voice · wholesale SMS · credentials · industry events · contact
