How toll fraud works
The most common form is called International Revenue Share Fraud (IRSF). The people behind it rent very high-rate numbers in distant countries or on satellite networks, and pocket a share of what it costs to call them. Then they look for an account to make the calls for them: yours.
The pattern repeats almost identically every time:
- Automated programs try thousands of username and password combinations against public SIP servers, at any hour.
- When a combination works, they register a device in your place or send calls directly with those credentials.
- Calls go out in parallel, on every available channel, to expensive destinations.
- The traffic continues until someone notices, the credit runs out or a limit stops everything.
The key point is that you do not need to be a target: attacks do not pick the company, they pick the weak password. A practice with two extensions is as exposed as a call centre with a hundred desks. The good news is that the effective defences are few and take half an hour to set up, ideally when you create the accounts, as suggested in the guide to VoIP for business.
Passwords: the first and most important defence
Most abuse starts with a guessed password. On our portal a SIP account password must be 12 to 64 characters long, with at least one uppercase letter, one lowercase letter and one digit. That is the minimum: our advice is to use randomly generated passwords at least 16 characters long.
The practical rules are few and not negotiable:
- A different password for every account, never reused anywhere else.
- Never the extension number, the company name or real words.
- Passwords are typed into the phone only once: they do not need to be easy to remember, they need to be hard to guess.
- When someone leaves the company or a mobile with the app is lost, change that account's password immediately.
- Do not leave passwords in emails, on sticky notes on the monitor or in unprotected shared files.
One detail that is often forgotten: the web interface of IP phones also has a password, usually the factory default. Anyone who gets in can read the SIP credentials stored on the phone. Change it the first time you switch the phone on, as explained in the guide on VoIP phones.
Choosing the authentication type
Each SIP account can recognise who is calling in three different ways. Choosing well here means taking stolen passwords out of the picture, at least for systems at a site with a fixed address.
| Portal setting | How it works | When to choose it |
|---|---|---|
| «Username and password» | Knowing the credentials is enough | Phones, softphones and apps that move around |
| «IP address» | Calls are accepted only from authorised addresses | A PBX or dialler with a fixed public IP |
| «Username/password and IP» | You need the password and an authorised IP together | Maximum protection for a trunk |
With IP authentication you can list up to 20 IPv4 addresses or networks in CIDR format (for example 203.0.113.0/29). With the «both» option, even if someone stole the password they could not use it from an address other than yours.
For a PBX connected with a SIP trunk, the password plus IP combination is the option we recommend. For the phones of people working from home or travelling, the address changes all the time: there you stay with «Username and password», and the other defences become even more important.
Spending limits and maximum rate
Even with the best passwords, it is wise to plan as if something will go wrong sooner or later. Limits decide how much the worst case can cost. Each SIP account has three settings.
Daily spending limit
The «Daily spending limit» is the maximum amount the account can spend in one day; the counter resets at midnight, Rome time (CET/CEST). To choose it, look at how much that account normally spends on its busiest day and add a margin. A reception account that spends two euros a day does not need a limit of a hundred.
Maximum per-minute rate
The «Block calls costing more than (per minute)» option rejects any call to destinations more expensive than the threshold. It is the most effective defence against fraud, because the destinations fraudsters use are always expensive: satellite numbers, premium-rate services, small remote networks. If you call landlines and mobiles in Europe, a low threshold costs you nothing: check in the rate list how much the destinations you really use cost, and set the threshold just above.
Simultaneous outbound calls
«Simultaneous outbound calls» limits how many calls the account can make at once, from 1 to 1000 channels. A desk phone uses one or two; a PBX uses as many as there are people on the phone at the same moment. Fewer channels means fewer parallel calls if the account is abused, and therefore slower damage. The limit applies only to outbound calls: inbound calls are not affected.
Open only the destinations you call
The country filter is the simplest defence to understand: what you do not call, you close. For each account you can choose between two approaches.
- «Only the selected destinations»: you list the allowed countries and everything else is blocked. This is the right choice for almost every business, which calls its own country and a few neighbouring ones.
- «All destinations except the selected ones»: everything is open except the countries you exclude. It only makes sense if you really call many countries, for example an international customer service team.
A concrete example: a car repair shop in Italy that calls customers and suppliers in Italy and a parts dealer in Germany enables Italy and Germany and nothing else. A fraud attempt towards a Pacific island is rejected on the first call, whatever the password.
Automatic address blocking
Our SIP server runs fail2ban, a system that watches failed login attempts. If an address gets the credentials wrong 5 times in 10 minutes, it is blocked; if it starts again, the blocks get longer and longer. This is what stops programs that try passwords in rapid succession.
The flip side is that one of your own phones, if misconfigured, can also get blocked, for example after a password change that was not updated on the device. In that case, the portal's «IP address security» page shows the blocked addresses and you can unblock yours, after correcting the password on the device.
If you run your own PBX exposed to the internet, the same rules apply: set up a similar system there too, do not leave port 5060 open to the whole world when you do not need to, and keep the software updated. The guide on NAT, firewalls and ports explains which ports are really needed.
Caller ID and protection against abuse
Every outbound call must present an authorised caller ID: a number bought on the platform or a number of yours verified with a code by SMS, WhatsApp or voice call. If the number is not verified, the call is rejected and the report shows «Caller ID not allowed». There are no anonymous outbound calls.
For you this is an extra safeguard: anyone who managed to use one of your accounts could not present arbitrary numbers in your company's name. All the details on formats and verification are in the guide on caller ID.
What to check every week
Five minutes a week are worth more than any alarm. Here is what to look at in the portal:
- Calls outside working hours, especially at night, at weekends and on public holidays.
- Destinations you have never seen before in the call report.
- Unusual durations: many long calls to the same foreign number.
- The SIP logs of each extension, available for the last 7 days: repeated failed registrations mean someone is trying.
- Your balance: if it is dropping faster than usual, even slightly, look at the details straight away.
The portal also warns you when your credit is low, by email and on WhatsApp. Prepaid credit, together with daily limits, means fraud cannot turn into a bottomless bill.
What to do if it happens
If you see calls you do not recognise, do not wait until you understand everything: stop it first, investigate later. Follow these steps in order.
- Change the password of the account involved immediately, to a new random one, and update it only on legitimate devices.
- If the account is used by a PBX on site, switch to «Username/password and IP» authentication with only the site's address.
- Lower the limits: minimum daily spending limit, low maximum rate, only the essential countries, a single simultaneous channel.
- Check the other accounts: whoever cracked one password may have found others.
- Look at the SIP logs and the call report to see where and when it started: IP addresses, times, destinations.
- If the way in was your PBX, check its extensions, admin users and updates; if in doubt, have the system checked by whoever installed it.
- Write to us from the contact page with the times and numbers of the suspicious calls: we will help you reconstruct what happened.
Frequently asked questions
How can I tell if my PBX has been hacked?
The typical signs are calls at night or on public holidays, foreign destinations you never use, many simultaneous calls and a balance that drops suddenly. In the extension's SIP logs you will also see registrations from addresses you do not recognise.
How long should a SIP account password be?
The portal requires at least 12 characters with uppercase letters, lowercase letters and digits, up to 64. We recommend a randomly generated password of at least 16 characters, different for each account: you only type it into the phone once.
Is IP authentication more secure than a password?
For a system at a site with a fixed IP, yes, because calls are accepted only from that address. The strongest protection is the «Username/password and IP» combination, which requires both. For people on the move the IP changes, so a password is used.
Why has my phone stopped registering after I changed the password?
It probably retried with the old password and was blocked by fail2ban after 5 failures in 10 minutes. Update the password on the phone, then unblock your address from the «IP address security» page.
Does the spending limit also block inbound calls?
No: the daily spending limit and the channel limit apply only to outbound calls. Calls to your numbers keep arriving as normal.
Who pays for calls made during a fraud?
Calls made from your account use your prepaid credit like any other call, because for the telephone network they are real calls. That is why the limits you set beforehand matter: they decide how much the worst case can cost.