We have dedicated fraud department. They are analyzing the billing data. I think they are looking for subscribers with a lot of calls and dispersed throug the whole day (24h).
The next thing is to check if the periodic location updates are in one and the same cell (no moving around the network)
I don’t know if this will help you