# Toll fraud

> What toll fraud is, how attackers get into a phone system, the warning signs, and how to protect your account.

- URL: https://kb.voipcloud.online/security/toll-fraud/
- Section: Security and compliance
- Type: overview
- Applies to: All countries
- Last reviewed: 2026-11-09

Toll fraud is when someone who isn't allowed to use your phone system gets into it and makes calls, usually to expensive international or premium-rate numbers. The calls are charged to your account, so a single attack can cost a lot before anyone notices.

## How attackers get in

The most common way is by getting hold of SIP credentials: the username and password a desk phone, softphone or other PBX uses to connect. With them, anyone can make calls from anywhere. Attackers find credentials by:

- breaking into an office network or computer that isn't well protected;
- signing in to the portal with a stolen or guessed password;
- finding passwords sent by email, saved in plain text files or written on paper;
- guessing weak PINs, such as on voicemail or [Dial tone access](https://kb.voipcloud.online/pbx/accept-make-divert/dial-tone-access/).

## Warning signs

- Your balance drops much faster than usual, or you get an unexpected low balance alert.
- Call charges show calls to countries you don't call, or calls at night and on weekends.
- Devices, SIP trunks, call diversions or administrators you don't recognise.

Check **Billing** › **Account balance** › **Call charges history** and **Reports** › **Call history** from time to time. See [Spend tools](https://kb.voipcloud.online/security/spend-tools/).

## What already protects you

- Calls to [high-risk destinations](https://kb.voipcloud.online/security/international-restrictions/#high-risk-destinations-blocked-by-default) are blocked by default.
- If something tries to connect to a SIP trunk in **SIP registration** mode with the wrong credentials, its IP address is blocked for 5 minutes.
- 2FA protects the portal if someone learns an administrator's password.

## What you can do

| Step | Where to find out how |
| --- | --- |
| Turn on 2FA for every portal administrator. | [Two-factor authentication](https://kb.voipcloud.online/security/two-factor-authentication/) |
| Use strong, unique passwords and PINs. Never send them by email or store them in plain text. | [Sign in and reset your password](https://kb.voipcloud.online/getting-started/sign-in-to-the-portal/#password-rules) |
| Lock SIP devices and SIP trunks to your office IP address with **Allow connection from one IP address only**. | [Devices](https://kb.voipcloud.online/pbx/settings/devices/), [SIP trunk](https://kb.voipcloud.online/pbx/accept-make-divert/sip-trunk/) |
| Ask the support team to block international destinations you don't call. | [International restrictions](https://kb.voipcloud.online/security/international-restrictions/#restrict-international-calls) |
| Keep balance notifications on, so unusual spending reaches you quickly. | [Low balance notifications](https://kb.voipcloud.online/billing/low-balance-notifications/) |
| Protect your office network: keep computers updated, use a firewall, and don't open phone system ports to the internet unless you need them. | Your IT provider |
| Change passwords and PINs regularly, and when someone leaves your business. | [After a security incident](https://kb.voipcloud.online/security/after-a-security-incident/#4-change-your-sip-passwords) |

## If it happens to you

Act straight away: contact the support team, change your passwords and check your account. Follow the steps in [After a security incident](https://kb.voipcloud.online/security/after-a-security-incident/).

## Related

- [After a security incident](https://kb.voipcloud.online/security/after-a-security-incident/)
- [International restrictions](https://kb.voipcloud.online/security/international-restrictions/)
- [Spend tools](https://kb.voipcloud.online/security/spend-tools/)
- [Scam guidance](https://kb.voipcloud.online/security/scam-guidance/)