Methods and apparatus for detecting fraudulent traffic associated with a user of a telecommunications system. A system comprises a monitoring network node comprising a traffic monitor configured to monitor traffic transmitted to or from a user in the telecommunications system, a fraud detector configured to apply to the monitored traffic a fraud profile associated with the user to determine whether the monitored traffic comprises fraudulent traffic, a transmitter configured to transmit data to a receiver of a profiling network node notifying whether the monitored traffic comprises fraudulent traffic. The profiling network node further comprises a fraud profiler configured to determine an updated fraud profile associated with the user based at least on the received data and a transmitter configured to transmit data identifying the updated fraud profile to one or both of a receiver of a subscription profile repository and a receiver of the monitoring network node.