Subscription fraud review at order

How do we pause an order flagged for fraud risk, run the extra verification, and get a reviewer's decision before the line or the device is activated?

Make the fraud flag a pause with a path, not a silent cancellation. When an order scores above the risk threshold (a new account, a device financing, lines added, a shipping address that differs from the service address), Callvu classifies the risk signals (an identity mismatch, a synthetic identity pattern, a velocity of orders on the identity or the address, a device-only order to a drop address, a known fraud network), pauses activation and shipment, chases the extra verification from the customer through a secure link (a document check with liveness, a one-time passcode to a verified number, a proof of address), pulls the order's evidence, routes the decision to the fraud reviewer in the Decision Desk with only the allowed outcomes, and writes the release, the modification or the cancellation to the order in the BSS, the system of record, with the customer told the outcome.

In scopeComplex: multi-party handoffsCallvu moves: classify, chase and verify, decide, write back

Talk to an expert Try it in the sandbox

Last updated November 7, 2026.

The problem today

The five phones shipped to the vacant house before the fraud queue was worked, and the first bill went to someone who had never heard of the carrier.

Today, without Callvu

Subscription fraud is an order placed with a stolen or synthetic identity to obtain devices and service that will never be paid for. The scoring catches many; what happens next is the problem: the order sits in a queue, the reviewer cannot reach the applicant, the devices ship on the fulfilment schedule regardless, or the order is cancelled silently and a genuine customer is lost. Both outcomes cost money.

The review is a bounded task: the signals that flagged the order, the verification that would resolve them (a document with a liveness check, a code to a number the carrier can trust, a proof of the address), the evidence from the order and the identity services, and a decision by a person with the authority to release or cancel. The activation and the shipment must wait for it. The customer must be told what is needed and why, in terms that do not coach a fraudster.

A paused order with a clear path is a genuine customer kept and a fraud order stopped.

How it runs

From the requestto the system of record.

An order (a new account, a line, a device financing, an upgrade shipped to a new address) scores above the fraud risk threshold at submission in any channel. Callvu pauses it and opens the review.

Applicant: Completes the extra verification on a secure link, or does not.
Sales or store agent: Sees that the order is paused and what the applicant was asked, not the risk signals.
Fraud reviewer: Decides the order in the Decision Desk.
Callvu: Classifies the signals, pauses, chases the verification, pulls the evidence, routes and writes the outcome to the order.

Classify and pause
The risk signals are classified (an identity data mismatch across the bureaus and the identity services, a synthetic identity indicator, an address or device velocity, a shipping address that differs from the service address or matches a known drop, a phone or email seen on prior fraud, a credit file inconsistent with the age, a known fraud network link); the order is paused with activation and shipment held, and the applicant is told the order is under review with what they can do.
Chase and verify
The verification the signals call for is requested from the applicant through a secure link within the review window: a government identity document captured with a liveness and selfie match, a one-time passcode to a number the identity services confirm as the applicant's, a proof of the service address, or an in-store identity check; the responses are read and checked against the order and the identity services, and the order's evidence (the channel, the device and the session data, the payment instrument, the prior orders on the identity and the address) is pulled.
Decide
The fraud reviewer decides in the Decision Desk with the signals, the verification result and the evidence, and only the allowed outcomes: release the order, release with a modification (a deposit, a lower device count, store pickup with an identity check instead of shipment), request one further item, or cancel with the reason code and the adverse action notice where a consumer report drove it; an order unverified at the end of the window is decided on the evidence, never released by timeout.
Write back
The decision is written to the order in the BSS, the system of record (activation released and shipment resumed, the modification applied, or the cancellation with the devices recalled and the identity flagged), the applicant is told the outcome in their channel, and the case with the signals, the verification and the decision is retained and fed to the fraud models.

Where it ends: The flagged order waited for the verification and a person's decision, the genuine applicant was given a path and the fraud order was stopped before the devices left, and the BSS holds the outcome with the case retained. The Decision Trace shows the signals, the verification and the decision; the Audit Trace shows the pause, the chase, the responses and the write with time.

Runtime enforcement

What is enforcedwhile the work runs.

The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.

Regulations

FCRA and the Red Flags Rule (15 USC 1681m(e); 16 CFR 681 for creditors; the FTC's identity theft program requirements): A carrier that extends credit (device financing, postpaid service) must maintain an identity theft prevention program that detects red flags at account opening, responds appropriately (verification, refusal, notification), and updates the program; a decision based in whole or part on a consumer report requires the adverse action notice with the report's source and the consumer's rights.
FCC CPNI rules (47 CFR 64.2010) and the SIM swap and port-out rules: An order that adds lines or changes credentials on an existing account is an account change that must follow the authentication and notification rules; a subscription fraud review on an existing account coordinates with the takeover process.
Carrier fraud policy and the identity verification standards (NIST SP 800-63A identity proofing): The policy sets the risk thresholds, the verification methods by signal, the review window, the reviewer authority and the modifications allowed (deposits, pickup, limits), and the retention; the document and liveness checks meet an identity assurance level the policy sets.

Company policies

A flagged order is paused with activation and shipment held; nothing ships on the fulfilment schedule while a review is open.
The applicant is given a verification path and told the outcome; no order is cancelled silently or released by timeout.
The decision is the reviewer's, with the signals, the verification and the evidence, and only the allowed outcomes.
The BSS is the system of record for the order and the outcome; the case feeds the fraud models.

Controls

Risk signal classification.
Activation and shipment hold.
Secure verification chase with reading and checks.
Evidence pull from the order and the identity services.
Decision Desk decision with required outcomes and the adverse action notice.
BSS write, customer notice and retention.

Clocks and deadlines

Review window: The policy's period from the pause for the applicant to verify, shown to the applicant.
Shipment hold: From the pause until the release decision; never lifted by the fulfilment schedule.
Adverse action notice: Where a consumer report drove the cancellation, within the FCRA's reasonable period.

Documents and checks

The order and the risk signals
The verification requests and responses
The evidence pulled
The decision with the reason code
The BSS write and the customer notice

In the Decision Trace

The signals and their classification.
The verification result.
The decision, the reason and the person.

In the Audit Trace

The pause with time.
Each chase and response with time.
The decision and the write with time.

The handoff

Between the front doorand the back office.

The front door

The order in any channel; the applicant verifies on a secure link or in a store.

The back office

The fraud reviewer decides paused orders with the evidence; fulfilment waits for the release.

The Decision Desk

Every flagged order goes to the fraud reviewer in the Decision Desk with the signals, the verification and the evidence, and only release, release with a modification, request one item, or cancel with the reason code.

Proof

In scope.Proof at scale, not one process at a time.

The kind of process Callvu runs in production for customers in this industry. Ask for a reference on this exact process. The results below are the industry's published proof; each claim code links to its record on agents.callvu.com.

More than 1,000 processes are live across Callvu customers.

Across Callvu customers

AT&T runs close to 100 processes on Callvu, used by 55,000 agents.

TEL-02

Callvu classifies each request into a unit of work (work type, skill, effort, due date) the moment it lands.

HND-02 · Self-asserted · verified 2026-11-02

When a person must decide, the case goes to the right reviewer in the Decision Desk, with only the allowed choices, and the run waits for the decision.

CAP-07 · Self-asserted · verified 2026-11-02

Every run produces a Decision Trace (why each AI action was allowed) and every workflow execution an Audit Trace (the chronological governance record).

ENF-03 · Self-asserted · verified 2026-11-02

Questions

What buyers ask next,answered plainly.

What happens to a flagged order?

Activation and shipment are held, the applicant is told the order is under review and given a secure verification path, and a reviewer decides before anything is released.

What verification is asked for?

What the signals call for: an identity document with a liveness check, a one-time passcode to a number the identity services confirm, a proof of address, or an in-store check.

Can the order be released by a timeout?

No. An order unverified at the end of the window is decided by the reviewer on the evidence, with the reason recorded.

Related processes

Identity theft and fraudulent account claim New consumer account opening Credit check, deposit and spending limit Account takeover report Try it in the sandbox All telecom processes

Bring this process, or the one that costs you most.

We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.