In short
Compare the Global Titles, interconnect partners and routes carrying inbound commercial traffic against the operator's actual A2P agreements. Traffic arriving from a network with no A2P arrangement, or at volumes far above a partner's contracted level, indicates unauthorised termination — confirmed by correlating Sender IDs, destinations and route-test evidence.
Start from the agreements, not the traffic
The most reliable starting point is the commercial record: which partners have A2P agreements, for what volumes, at what rates, covering which senders. Everything else is measured against that list.
Many operators find this step harder than the technical analysis, because the agreements live in wholesale spreadsheets while the traffic lives in network systems, and nobody has previously reconciled the two.
The comparisons that expose it
Four comparisons do most of the work:
- Source authorisation — commercial traffic from Global Titles or partners with no A2P agreement at all
- Volume envelope — a partner delivering ten times its contracted volume, indicating resale to third parties
- Sender correspondence — Sender IDs belonging to enterprises that have no relationship with the delivering partner
- Destination profile — traffic patterns inconsistent with the partner's own subscriber base or declared business
The resale problem
The most common form is not an unknown attacker but a known partner reselling its interconnect. The Global Title is legitimate, the agreement exists, and the traffic arrives through the expected path — but the originating enterprises are customers of an aggregator the operator has never approved.
This is why volume envelopes and Sender ID correspondence matter more than address filtering. A partner whose traffic mix changes abruptly, or that suddenly carries the Sender IDs of banks in a third country, is reselling.
Building a defensible case
Before raising it commercially, correlate three things: the signaling evidence showing where the traffic entered, the classification evidence showing it is commercial, and route-testing evidence showing what actually arrives at handsets on that path.
A partner presented with all three, including a test message showing a substituted Sender ID, generally moves to a commercial discussion. A partner presented only with a volume chart generally disputes the classification.