NFSU Journal of Forensic Science

Due to the ubiquity of mobile devices for digital identity verification, SIM swapping has emerged as an unintended high-stakes vector for cybercrimes. With the advancement of telecommunications technology from GSM to 5G, reliance on the Subscriber Identity Module (SIM) for two-factor authentication (2FA) has become a critical vulnerability. In this paper, fraudsters employ a variety of techniques, ranging from social engineering to technological exploitation, across both traditional and contemporary network infrastructures. We investigate identity takeover methods that circumvent traditional security mechanisms and cause significant financial and personal losses. In addition, this study assesses telecom infrastructure weaknesses where unique vulnerabilities of GSM, LTE, and UMTS interworking exist, and covers new attacks, including AdaptOver. Eventually, we propose a model for forensic countermeasures and mitigation by focusing on location-based verification, devicespecific authentication binding, and increased ceremony modelling to protect subscriber identities.

As financial ecosystems migrate toward an architecture composed of autonomous software agents representing banks, telecom operators, payment processors, and end users. The communication channels between these agents become high-value targets for adversarial exploitation. Conventional fraud detectors operate on transaction-level attributes such as amount and type, and are blind to the behavioural signatures embedded in inter-agent message exchange. This paper proposes a detection framework that extracts twelve communication behavioral features (response time, message length, retry count, session anomaly score, authentication failure rate, interaction frequency, and others) from agentto-agent (A2A) traffic and feeds them through a two stage pipeline: (i) an autoencoder trained exclusively on legitimate interactions to produce an eight dimensional latent embedding and a scalar reconstruction error anomaly score, and (ii) an XGBoost classifier that operates on the 21 dimensional fusion of raw and autoencoder derived features. We evaluate the system on PaySim, a widely used financial dataset containing 6.36 million records, under a deliberately balanced protocol (50/50 fraudlegitimate split) that avoids the metric inflation common in imbalanced evaluations. Across six distinct attack types : (i) impersonation (ii) prompt injection (iii) collusion (iv) trust-chain exploitation (v) data exfiltration, and (vi) transaction manipulation. The proposed framework attains an F1-score of 0.933, AUC-ROC of 0.983, and per-attack F1 ranging from 0.928 (collusion, the stealthiest category) to 1.000 (transaction manipulation). A complementary four-tier graduated mitigation strategy (Monitor/Throttle/Quarantine/Block) achieves 93.52% fraud prevention, marginally exceeding binary blocking (93.27%) while reducing friction for legitimate users by 30%. We discuss the implications for emerging agent-to-agent (A2A) ecosystems expected in 2028 and beyond, in which autonomous AI agents will negotiate, transact, and settle on behalf of human principals without direct human oversight.

One of the most critical emerging threat to India's digital economy is the Telecom-enabled fraud with estimated losses exceeding ₹50,000 crore over the past six years. The paper provides a functional model of forensic network reconstruction, which is based on field level investigations at Criminal Investigation Department (CID). The paper not only explores the technical anatomy of SMS interception malware, but also investigates the dynamics of fraud in the real world, specifically utilizing the cryptocurrency vectors, and offers a specialized forensic tool, CDRAnalyz, to analyze Call Detail Records (CDRs). These technical findings are contextualized in the research with references to the legal provisions on Section 63 of the Bharatiya Sakshya Adhiniyam (BSA) 2023 [1], which pertains to the admissibility of electronic evidence. The proposed system incorporates malware reverse engineering, network topology analysis, and legal compliance systems to improve investigation systems in fighting high-tech telecom based fraud ecosystems.