Mobile Network Operator Protects Its Mobile Money Service Paths With Ollandi

Summary

A mobile network operator deployed Ollandi across its core network, gateways, wallet platform and partner bank links. Failed transfers are now traced to the responsible layer while they occur, and SIM-swap-led account takeover attempts are detected as a single sequence in time to protect the wallet.

Before Ollandi

• Each layer of the mobile money service, from radio and core to USSD gateway, wallet platform and partner banks, was owned by a different team or vendor.
• When transfers failed, each team saw only its own layer.
• SIM swaps, device changes and wallet PIN resets were recorded in separate systems.
• Partner bank and vendor link failures surfaced as customer complaints.

After Ollandi

• The mobile money service is modelled as one dependency chain; failures are located to the responsible layer.
• A SIM swap, new device registration and PIN reset on the same subscriber are correlated into one threat sequence.
• The fraud team is notified so transfers on the affected wallet can be held during review.
• Partner bank and vendor connections are monitored for availability and changes in use.
• Containment actions, such as suspending a session or pausing a compromised integration credential, are executed after operator approval.

Deployment

• Product: Ollandi, deployed as a reasoning layer over existing network, wallet and identity tooling.
• Operating control: Assisted Response.
• Network and wallet configuration changes remain under the operator's authority.

By the numbers

Measured across Glemad's production deployments and published in the the earlier model research research paper:

• Mean time to respond: 2.1 minutes, against an industry average of 420 minutes.
• Threat coverage: 40 to 60% more multi-step attack chains identified than siloed detection tools.

These figures come from environments with mature telemetry and defined policy baselines. Results depend on the quality of the telemetry available.