A method of detecting telephony fraud in the case of a mobile telephony device roaming at a visited network, the visited network being other than a home network of said mobile telephony device, cross-network triggering being available between said visited network and said home network. The method comprises detecting a non-correlation between said cross-network triggering and activity of said mobile telephony device, testing to find out if profile manipulation has taken place of a profile of said mobile telephony device held at said visited network, and upon detecting that profile manipulation has taken place taking remedial action such as blocking current calls and overwriting the manipulated profile.