Toll fraud
What toll fraud is, how attackers get into a phone system, the warning signs, and how to protect your account.
Toll fraud is when someone who isn’t allowed to use your phone system gets into it and makes calls, usually to expensive international or premium-rate numbers. The calls are charged to your account, so a single attack can cost a lot before anyone notices.
How attackers get in
Section titled “How attackers get in”The most common way is by getting hold of SIP credentials: the username and password a desk phone, softphone or other PBX uses to connect. With them, anyone can make calls from anywhere. Attackers find credentials by:
- breaking into an office network or computer that isn’t well protected;
- signing in to the portal with a stolen or guessed password;
- finding passwords sent by email, saved in plain text files or written on paper;
- guessing weak PINs, such as on voicemail or Dial tone access.
Warning signs
Section titled “Warning signs”- Your balance drops much faster than usual, or you get an unexpected low balance alert.
- Call charges show calls to countries you don’t call, or calls at night and on weekends.
- Devices, SIP trunks, call diversions or administrators you don’t recognise.
Check Billing › Account balance › Call charges history and Reports › Call history from time to time. See Spend tools.
What already protects you
Section titled “What already protects you”- Calls to high-risk destinations are blocked by default.
- If something tries to connect to a SIP trunk in SIP registration mode with the wrong credentials, its IP address is blocked for 5 minutes.
- 2FA protects the portal if someone learns an administrator’s password.
What you can do
Section titled “What you can do”| Step | Where to find out how |
|---|---|
| Turn on 2FA for every portal administrator. | Two-factor authentication |
| Use strong, unique passwords and PINs. Never send them by email or store them in plain text. | Sign in and reset your password |
| Lock SIP devices and SIP trunks to your office IP address with Allow connection from one IP address only. | Devices, SIP trunk |
| Ask the support team to block international destinations you don’t call. | International restrictions |
| Keep balance notifications on, so unusual spending reaches you quickly. | Low balance notifications |
| Protect your office network: keep computers updated, use a firewall, and don’t open phone system ports to the internet unless you need them. | Your IT provider |
| Change passwords and PINs regularly, and when someone leaves your business. | After a security incident |
If it happens to you
Section titled “If it happens to you”Act straight away: contact the support team, change your passwords and check your account. Follow the steps in After a security incident.