Toll fraud is when someone gains access to a phone system, SIP account or trunk and uses it to place expensive calls, usually to international high cost numbers, at the owner's expense. It mostly exploits weak passwords and open services, and it is prevented with strong authentication, IP restrictions, destination limits and real time spend alerts.
Why it is so costly
Attacks usually start on a Friday night or before a holiday, when nobody watches. A compromised system can run dozens of simultaneous calls to high cost destinations for hours. Because the calls are technically valid, the carrier bills them, and in most service agreements the account holder is responsible for traffic sent from its credentials. The calls typically feed international revenue share fraud.
Common weak points
| Weak point | Defence |
|---|---|
| Weak or default SIP passwords on extensions and trunks | Long random passwords, unique per device; never use the extension number as password |
| SIP ports open to the whole internet | Allow only known IPs; put an SBC or firewall in front of the PBX |
| Web admin panel exposed | Reach it only through VPN; enable two-factor login; keep software updated |
| Voicemail with default PINs and remote call forwarding | Change PINs, disable outbound features from voicemail |
| Remote access features (DISA) | Disable unless needed; strong PIN and destination limits if used |
| Unpatched PBX software and devices | Regular updates, remove unused modules and accounts |
| Leaked credentials from old staff or provisioning files | Rotate passwords, protect provisioning servers |
Limits that cap the damage
- Destination control: allow international calls only to the countries the business calls. Block premium and high cost ranges by default.
- Time rules: no international calling outside business hours unless needed.
- Concurrent call limits per extension and per trunk, close to real use. See channels and CPS.
- Spend limits: daily caps and prepaid balances on the trunk. Ask your provider for credit limits and alerts, see prepaid vs postpaid terms.
- Block brute force: tools that ban IPs after repeated failed registrations, and alerts on registration attempts from unknown countries.
Detection
Monitor outbound calls in near real time, not on the monthly invoice. Alert on spend per hour, new destinations, calls at night, and many simultaneous calls from one extension. These are the same CDR rules used for route monitoring, see monitoring with CDRs. Watch for sudden spikes in short calls too: fraudsters often test numbers before the main attack, as described in short duration calls.
If you are hit
- Block international calling on the system or ask your provider to suspend the trunk.
- Change all passwords and PINs, and check for accounts or forwarding rules you did not create.
- Keep logs and CDRs, and inform your provider in writing at once. Speed matters: providers can sometimes stop payment along the chain only if they are told early.
- Find how access was gained before reopening international calls.
For carriers and resellers
If you sell SIP trunks or wholesale access, your customers' compromised systems become your exposure. Set default limits on new accounts, open destinations on request, agree in your terms who pays for fraudulent traffic and your right to suspend service when fraud is suspected, and keep the same rules with your own suppliers. The interconnect agreement checklist lists the relevant clauses.
VoIPMatcher sources wholesale VoIP termination for the destinations you name, which keeps your route limited to what you use. Request a VoIP route.
Frequently asked questions
Who is liable for toll fraud?
In most service agreements the account holder pays for calls made with its credentials, even when an attacker placed them, because the calls are technically valid and every carrier in the chain is owed money. Some providers offer fraud limits or partial credits. Check your contract, and set spend and destination limits rather than relying on goodwill.
Does a firewall prevent toll fraud?
It helps a lot but is not enough alone. A firewall or session border controller that allows SIP only from known IPs blocks most scanning and password guessing. Toll fraud also comes through exposed web panels, voicemail features, leaked passwords and remote access, so combine network controls with strong credentials, destination limits and spend alerts.
What is SIP scanning?
SIP scanning is automated probing of internet addresses for open SIP ports, followed by attempts to register with common or guessed usernames and passwords. It runs constantly against any exposed system. The sign is many failed registrations from unknown IPs in your logs; defend with IP allow lists, strong unique passwords and tools that ban repeat offenders.
How fast can toll fraud losses grow?
Very fast. A compromised system can run dozens of simultaneous calls to high cost destinations for hours, often starting on a Friday night or before a holiday when nobody is watching. Losses can become large within a single weekend, which is why near real time alerts and hard spend caps matter more than checking the monthly invoice.
Need a route?
Send the destination, route type and target rate. We reply with what we can deliver.