I'm investigating an IVR-based fraud scenario where the verification call to a customer's registered mobile number was being forwarded to another number.

We use an IVR call as an additional verification step after a successful payment. In a few fraud cases, the attacker was able to receive the IVR call because call forwarding was active on the customer's number.

I'm trying to understand the possible technical mechanisms behind this and reproduce the behavior in a controlled Android lab.

I previously tested Android device compromise using Kali Linux and AndroRAT on Android 13/14. In that environment, I was able to access SMS, photos, videos and other device data after compromising the device. However, I could not reproduce or establish call forwarding through the same setup.

This makes me unsure whether the forwarding is actually a consequence of Android device compromise or whether it is happening at another layer.

Specifically, I'm trying to understand:

1. What mechanisms can enable call forwarding on Android?

2. Can an application or malware enable/modify call forwarding through Android telephony APIs, permissions, accessibility services, USSD/MMI commands, or other mechanisms?

3. Which parts of call forwarding are controlled by Android itself versus the SIM/carrier/network?

4. If a device has been compromised, what logs or artifacts could indicate that call forwarding was enabled or modified?

5. What would be the relevant indicators for distinguishing:

   • Android malware/device compromise

   • SIM swap or SIM-related compromise

   • carrier-account compromise

   • social engineering

   • forwarding configured directly through the device/carrier

6. Are there Android security testing tools or research papers that would be useful for reproducing and investigating this in a lab?

I'm not looking to compromise real devices or accounts. My goal is to understand the underlying mechanism and reproduce it only on devices/accounts that I control, so that we can identify the attack path and improve our fraud detection and mitigation.

Any pointers from people familiar with Android telephony, mobile security, telecom security, or mobile forensics would be greatly appreciated.