A method of identifying fraud in a telecommunications system. The method includes receiving data related to a current call placed from an originating automatic number indicator (ANI), where the received data includes at least the originating ANI, a billing number and an identification code. A threshold number and a time interval corresponding to the identification code for the originating ANI are retrieved, for example, from a memory. In addition, billing numbers for prior calls from the originating ANI, if any, and corresponding indicia of the times of the calls are retrieved. A determination is made of whether the number of billing numbers used for the current and prior calls from the originating ANI over a prior period of time equal to or less than the time interval exceeds the threshold number. If the threshold number is exceeded, a fraud alert is generated.