Based on the ATI response, routing node 100 creates an entry of the old VLR in the dynamic profile table and creates a dynamic roaming table entry for the old and new VLR. The second row in Table 1 above is an example of the entry for the old VLR having the identity 5678 that may be added to the dynamic profile table. Table 2 shown below illustrates an example of the dynamic roaming table populated with the information of the old and new VLR for the example in Figure 2 . In Table 2 , routing node 100 creates an entry with the old and new VLR addresses, a time threshold, a learning counter, and a status field. The time threshold recorded in Table 2 is the minimum recorded time between registrations at the old VLR address and the new VLR address in the entry for whitelisted VLRs only. The learning of time thresholds for messages received from graylisted or blacklisted VLRs is not performed, as doing so could allow attackers to set invalid minimum threshold values. The data in Table 2 may be used to perform velocity validation of messages related to roaming mobile subscribers, as will be described in more detail below. Returning to the flow diagram in Figure 2, in line 4 , routing node 100 sends a send authentication information/location update message to home HLR 200 . Line 4 reflects the passing of the received message to its destination, which is performed for all messages received when operating in the learn mode. Figure 3 is a message flow diagram illustrating exemplary steps that may be performed by routing node 100 when operating in the test mode. As stated above, in the test mode, node validation is performed but messages are still forwarded to the home HLR regardless of the results of the validation testing. Referring to Figure 3, in line 1, visited VLR 202 sends a send authentication information or location update request message to routing node Table 2 : Dynamic Roaming Table