Techniques of detecting telecom fraud involve applying a combination of real-time data analysis and risk models typically used in authentication applications to phone call metadata that is streamed to a database server on a continual basis to derive phone usage patterns as the database server receives the phone usage data. The database server then compares the derived phone usage patterns to patterns of fraudulent phone usage in order to detect SIM box or SIM cloning fraud in the streamed data. A comparison result that indicates the likelihood of such fraud in a vast set of phone calls may take the form of a risk score derived using risk models typically found in authentication applications.