port_fraud_shield

The port_fraud_shield command is a specialized security feature available in select countries. It provides an advanced layer of protection by performing a dual-layer validation: it correlates historical network data with real-time signaling checks to identify porting events that have occurred in the immediate past.

This command is specifically designed to bridge the "data gap" that often exists between a physical porting event and the update of central national porting databases. By identifying changes that have occurred in the very recent past (i.e., since the last central registry update), Plumma® CONNECT offers a near-instantaneous view of network transitions.

Similar to the logic applied in sim_swap, the vast majority of porting events are legitimate subscriber moves between network providers. However, an unexpected or rapid porting event can be a primary indicator of "Port-Out Fraud," where a fraudster illegally transfers a number to a new carrier to intercept sensitive communications.

The primary objective of port_fraud_shield is to provide complete visibility into these events, empowering customers to make informed, data-driven risk decisions and apply additional verification steps when a high-risk transition is detected.

Response Reference

Field Name	Data Type	Output Values	Description
portfraud	String	Low, Medium, High, Very High, n/a, Omitted	Risk assessment based on porting recency: Low: Ported > 30 days ago or never ported. Medium: Ported within 96 hours – 30 days. High: Ported within 25 – 96 hours. Very High: Ported within the last 24 hours. n/a: Unsupported destination or operator. Omitted if Plumma® Connect returns "Status": 1 or 2.
present	String	yes, no, n/a, Omitted	Indicates live subscriber presence on the network: yes: Subscriber is currently present. no: Subscriber is not present. n/a: Signaling congestion or destination not covered. Omitted if Plumma® Connect returns "Status": 1 or 2.

Summary Table

Command	Description	Response Values
`port_fraud_shield`	Performs dual-layer validation to detect near-instantaneous network porting events.	port_detected: Boolean or Risk Level (low to very high) indicating a recent network move. port_timestamp: The specific date and time the porting event was identified. current_mno: The Mobile Network Operator currently serving the number.

API reference

Request

curl -X POST "https://api.connect.plumma.it/services/api" \
-H "Content-Type: application/json" \
-H "x-plumma-connect-api-key: YOUR_API_KEY_HERE" \
-H "x-plumma-connect-app-id: YOUR_APP_ID_HERE" \
-d '{
  "number": "+16469817679",
  "commands": [
    "port_fraud_shield"
  ]
}'

Response (low risk)

{
  "number": "+16469817679",
  "present": "yes",
  "portfraud": "Low",
  "status": 0,
  "status_message": "Response from one supplier - This response is for demo purpose only [cmd_enc=1048576] [{port_fraud_shield=SUPPLIER0 : Success}]",
  "version": "1.0.2-20260608095239"
}

Response (very high risk)

{
  "number": "+447700900456",
  "present": "yes",
  "portfraud": "Very High",
  "status": 0,
  "status_message": "Response from one supplier - This response is for demo purpose only [cmd_enc=1048576] [{port_fraud_shield=SUPPLIER0 : Success}]",
  "version": "1.0.2-20260608095239"
}

Response (subscriber not present)

{
  "number": "+34611222333",
  "present": "no",
  "portfraud": "Medium",
  "status": 0,
  "status_message": "Response from one supplier - This response is for demo purpose only [cmd_enc=1048576] [{port_fraud_shield=SUPPLIER0 : Success}]",
  "version": "1.0.2-20260608095239"
}

Response (unsupported destination)

{
  "number": "+491701234567",
  "present": "n/a",
  "portfraud": "n/a",
  "status": 0,
  "status_message": "Response from one supplier - This response is for demo purpose only [cmd_enc=1048576] [{port_fraud_shield=SUPPLIER0 : Success}]",
  "version": "1.0.2-20260608095239"
}

Read this in the portal, with search and the reference beside it: Port Fraud Shield