400,000 Flash Calls per Month: How a Burundi Operator Recovered OTP Traffic for SMS

While deploying EW SMS Firewall, we also introduced the Voice Firewall module into the operator’s network. In just one month of testing, the solution uncovered 225,193 flash calls carrying OTP codes to subscribers outside paid SMS channels. The findings prompted the operator to activate full flash call blocking. Today, the solution consistently detects around 400,000 flash calls every month.

How Flash Calls Divert Revenue from A2P SMS

Flash Calling is a two factor authentication method that delivers OTP codes through incoming caller numbers instead of SMS. When a user requests a code in an app, they receive a short call. The last digits of the caller’s number serve as the OTP, which the app can read automatically or the subscriber can enter manually.

Because the call is never completed, there is no charge for it. This makes Flash Calling a cheaper way for businesses to deliver OTPs compared with A2P SMS.

If an operator has no visibility into voice OTP traffic on its network, senders gradually move more authentication traffic to this channel. The operator then terminates fewer high margin SMS messages than expected, resulting in lost revenue.

How We Deployed Voice Firewall Within the SMS Firewall Infrastructure

We had previously deployed EW SMS Firewall on the African operator’s network, increasing international A2P traffic by 183%. Testing the Voice Firewall module was the next exploratory step, designed to determine whether flash calls were present on the network and measure their volume.

Within one month, the system detected more than 200,000 calls. This showed that a significant share of OTP codes that could have generated revenue for the operator were being delivered to subscribers free of charge. Based on these findings, we moved forward with a pilot project to block flash calls.

EW Voice Firewall was deployed within the same infrastructure already running EW SMS Firewall. A single team manages both voice and SMS traffic, while analytics for both channels are available through one interface.

The first step was a joint analysis by Eastwind specialists and the operator’s team. They examined the structure of voice traffic, including which international routes carried short calls, the Caller ID patterns used by OTP senders, and the times of day when activity peaked. Based on these findings, they configured signatures to identify flash calls.

How the System Processes Calls

Every incoming call on an international route is checked against flash call signatures. If no match is found, the call continues normally without any changes.

When a match is detected, the system triggers an action predefined by the operator:

• Forward the call to voicemail;
• Remove the Caller ID;
• Modify the Caller ID.

This approach allows the operator to choose how to handle flash calls rather than simply terminating the connection. For example, if the Caller ID is removed or modified, the call still reaches the subscriber, but the app can no longer extract the OTP from the number, and the subscriber cannot see the actual caller number. This forces the sender to return to the SMS channel.

Pilot Results

During the second half of July 2026, EW Voice Firewall detected between 5,000 and 19,000 flash calls per day on the operator’s network. By September, the system was blocking an average of 400,000 flash calls each month.

At the same time, the operator saw A2P message volumes increase. Between July 18 and July 29, daily volume grew from 16,840 to 26,056 messages.

The increase cannot be attributed entirely to the deployment of Voice Firewall. SMS Firewall is running on the network at the same time and also contributes to the growth of legitimate traffic. However, the correlation between the activation of flash call blocking and higher A2P SMS volumes suggests that some OTP traffic has returned to paid SMS routes.

For the operator, this means:

• OTP delivery has been restored through monetizable channels;
• Existing A2P SMS infrastructure has been utilized more efficiently;
• Authentication traffic on the voice network has been brought under operator visibility and control.

What’s Next

The pilot also revealed other scenarios in the operator’s voice traffic that warrant further investigation, including wangiri, Caller ID spoofing, and international premium rate fraud. The next step is to expand protection to cover these threats.