Q22026
Where fraud can still be stopped
Fraud controls draw on three signal types. Only connection data is available before the fraud reaches its target.
Connection signals arrive first
A fraudulent number is visible on the network before it reaches a bank, a marketplace or an enterprise. That interval is where prevention is possible.
Why telco intelligence is critical
Operators are best placed to see fraud at the connection layer, before a victim is contacted. Shared across the network, that visibility becomes a preventive control for every digital business.
Observed fraud, not static reference data
Numbering and IP registers record what a network asset is. They do not record how it is being used.
No operator sees enough alone
Flashcalling was recorded in 227 countries this quarter. An individual network sees a small share of that, which is insufficient to identify a pattern before it lands.
Distributed contribution, shared benefit
Members contribute what they observe and retrieve what all other members have observed. Ledger value to each participant increases with participation.
Q2 2026 headlines
1 April to 30 June 2026. Contributions basis unless stated.
Contributions rose 349% against a 144% rise in identifiers, indicating wider participation rather than a small number of large submissions.
All five active types rose in absolute terms. Flashcalling's share increased because it grew faster than the others, not because any type declined.
Our fraud intelligence now spans more than 95% of countries worldwide.
Forty countries account for 90% of contributions, against thirty-one two quarters ago.
Cumulative fraud signals
Identifiers on the Fraud Intelligence Blockchain, all time.
Up from 36,596,958 at the end of Q1
The ledger doubled in a quarter
The ledger holds 92,788,207 verified fraud signals, up from 36.6 million three months earlier. Q2 additions exceeded the entire ledger balance at the end of 2025.
Positive growth across all fraud types
Every active fraud type grew in absolute terms. No category contracted; the shift in mix reflects differing growth rates rather than decline.
Country coverage
Origin countries seen in quarter, against the 249 codes in ISO 3166-1.
American Samoa · Cayman Islands · Cook Islands · Equatorial Guinea · Faroe Islands · Greenland · Grenada · Guernsey · Jersey · Kosovo · Saint Vincent and the Grenadines · Samoa · San Marino · São Tomé and Príncipe · Turks and Caicos · US Virgin Islands
Coverage accumulates rather than rotates
Sixteen countries were added and none were lost. Q2 closed 48.5% of the gap remaining at the end of Q1, the second consecutive quarter above 46%.
The additions are termination estates
Almost all new entries are small island or territory number ranges, the asset class Wangiri and IRSF monetise.
Fraud type mix
Share of contributions, Q1 2026 to Q2 2026. Every type grew in absolute terms.
| Type | Q1 | Q2 | Change |
|---|---|---|---|
| Flashcalling | 69.1% | 74.8% | +5.7pp |
| Scam | 16.0% | 15.1% | −0.9pp |
| Wangiri | 8.9% | 5.7% | −3.2pp |
| IP Fraud | 5.8% | 4.3% | −1.5pp |
| IRSF | 0.1% | 0.2% | +0.1pp |
Falling share is not falling volume
All five types recorded growth. Wangiri lost 3.2 percentage points of share while growing 181%, as flashcalling grew at a higher rate.
Flashcalling continues to dominate
Reported flashcalling rose 379% and accounts for three quarters of all contributions, extending a lead held for three consecutive quarters.
Signals per second
Rate at which fraud identifiers reach the ledger.
Faster than an internal escalation
At 7.15 signals per second, an identifier submitted by one member reaches all others within the time most operators require to complete an internal escalation.
The trajectory, not the point
0.17 to 2.96 to 7.15 across three quarters. Detect-to-share latency continues to fall.
Flashcalling
74.8% of Q2 contributions. The most widely dispersed fraud type on the ledger.
Flashcalling was recorded in 227 of the 232 active countries. In 45 of those it accounts for more than 90% of fraud records, and in Azerbaijan, Kuwait, New Zealand, Turkmenistan, Tokelau and the Falkland Islands it is effectively the only type observed. No single operator sees sufficient volume to model it.
Scam
15.1% of Q2 contributions. Concentrating and spreading at the same time.
Scam is concentrating and dispersing simultaneously. Origin countries rose from 82 to 150 while one country accounts for 86% of volume. June carried 61,268 contributions against 16,258 in April.
Wangiri
5.7% of Q2 contributions. Constant and granular. Read alongside IRSF on slide 13.
Six countries are near-total Wangiri monocultures: Congo (DRC) 98%, Zimbabwe 97%, Cameroon 95%, Maldives 95%, Suriname 94% and Lesotho 91% of all records from those origins. All are high-tariff callback destinations. Austria at 18.9% does not follow that pattern.
IP Fraud
26,544 contributions across the quarter.
Growth of 228% is calculated on the full quarter. China accounts for 38% of IP Fraud contributions, with the Netherlands, United States, Germany and Pakistan a further 34% combined.
IRSF
0.2% of contributions, 91.6% of identifiers — rare and enormous. Compare with Wangiri.
IRSF was reported from 119 countries, up from 48 — the largest increase in origin coverage of any type. The United Kingdom leads at 13.7%, with Estonia, Latvia and Lithuania a further 16.7% combined.
Join the fightagainst fraud
- Real-time fraud identifier sharing across 232 countries
- Blockchain-verified intelligence at network speed
- Fraud firewall integration for automated blocking
- 92.8M fraud signals on the ledger