What is SIMBOX:

A SIM box is device that maps the call from VoIP to a SIM card (in the SIM box) of the
same mobile operator of the destination mobile.So that international call
terminating as home call to subscriber country and usually cheap compared to the
cost of terminating the international call.This is to just bypass international
traffic.Commonly, SIM boxes are used to perpetrate bypass fraud, so we shall use
this technique for illustration.

Normal call flow from Visitor country to home country Subscriber

In case of SIM BOX, call routing like

In this figure sim box is working as a plug-in and work box that contains a mobile SIM card
that is connected to a PBX or router. It can automatically reroute a call that would take place on a
mobile network to a lower cost fixed or IP network.
Detection of fraud can be some what tricky because in some cases.
Some SIM boxes uses IMEI management.. which changes their IMEI constantly making it
dificult to detect.
MSISDNS are also chnages regularly.
In general we detect the fraud with constantly looking various calling parameters. We further
classified these parameters into Indicators. By looking indicators we can analyse frequent usage
MSISDN and IMSI for RA perspective.

The Indicators are based on;

High volume of calls from the same MSISDNs and IMEIs.
High volume of calls from the same cell id (this boxes are located in an office).
Last recource would be to call terminating customers and try to find out about the quality of the
calls.
For shake we divide indicators.
Indicator 0 flags high incoming calls from other carriers for potential simbox terminating to
Aparty.
Indicator 1 flags high outgoing calls for potential simbox operators and other form of
fraud/abuse in usage
Indicator 2 flags high sms for potential abuse in usage or virus mobile phones
Indicator 3 use to detect high usage subscribers for potential fraud/abuse in usage
Indicator 4&5 related imei/imsi stuffing
https://telecomconcepts.wordpress.com/2010/02/01/simbox-fraud-detection-andbilling/