Mobile Network Operator Protects Its Mobile Money Service Paths With Ollandi
Summary
A mobile network operator deployed Ollandi across its core network, gateways, wallet platform and partner bank links. Failed transfers are now traced to the responsible layer while they occur, and SIM-swap-led account takeover attempts are detected as a single sequence in time to protect the wallet.
Before Ollandi
- Each layer of the mobile money service, from radio and core to USSD gateway, wallet platform and partner banks, was owned by a different team or vendor.
- When transfers failed, each team saw only its own layer.
- SIM swaps, device changes and wallet PIN resets were recorded in separate systems.
- Partner bank and vendor link failures surfaced as customer complaints.
After Ollandi
- The mobile money service is modelled as one dependency chain; failures are located to the responsible layer.
- A SIM swap, new device registration and PIN reset on the same subscriber are correlated into one threat sequence.
- The fraud team is notified so transfers on the affected wallet can be held during review.
- Partner bank and vendor connections are monitored for availability and changes in use.
- Containment actions, such as suspending a session or pausing a compromised integration credential, are executed after operator approval.
Deployment
- Product: Ollandi, deployed as a reasoning layer over existing network, wallet and identity tooling.
- Operating control: Assisted Response.
- Network and wallet configuration changes remain under the operator's authority.
By the numbers
Measured across Glemad's production deployments and published in the ADT research paper:
- Mean time to respond: 2.1 minutes, against an industry average of 420 minutes.
- Threat coverage: 40 to 60% more multi-step attack chains identified than siloed detection tools.
These figures come from environments with mature telemetry and defined policy baselines. Results depend on the quality of the telemetry available.
