Toll fraud follows a predictable script. An attacker finds an exposed SIP endpoint, brute-forces a weak extension password, and at 18:00 on a Friday begins placing calls to international premium-rate numbers they control. By Monday morning the business has a five-figure bill and a very difficult conversation with its provider. The Communications Fraud Control Association puts annual global telecom fraud losses in the tens of billions of dollars, and small and mid-size businesses are disproportionately affected because their systems are easier to reach and their bills are checked less often.
The good news is that this is a solved problem. The nine controls below, applied together, make a successful toll fraud attack extremely unlikely — and cap the damage if one does happen.
1. Put Every Trunk Behind an IP Access Control List
This single control eliminates the majority of attacks. If your SIP trunk only accepts signalling from the specific IP addresses of your PBX, an attacker who guesses a password still cannot use it. Static IP addressing on your PBX site is worth the small monthly cost purely for this. Where a static IP genuinely is not available, use registration-based authentication with a strong credential and pair it with the geographic restrictions in control 4.
2. Enforce Real Passwords on Every Extension
The extension whose password is the extension number is the one that gets compromised. SIP scanners cycle through common extension ranges and weak credentials continuously — an internet-facing SIP port will see registration attempts within hours of coming online. Every extension needs a random password of at least 16 characters, generated rather than chosen, and never reused between extensions. Auto-provisioning makes this painless, because nobody has to type the password.
3. Block International Destinations You Never Call
Toll fraud is profitable because attackers own the destination numbers and collect a share of the termination rate. Those destinations concentrate in a well-known set of high-cost country codes. If your business never calls those countries, denying them removes the profit motive entirely. The right default is deny-all with an explicit allow list of the countries you actually do business with — not allow-all with a block list you update after each incident.
4. Set Hard Spend Caps and Concurrent Channel Limits
Controls 1 to 3 are about prevention; this one is about blast radius. A daily spend cap and a hard concurrent channel limit turn a potential $40,000 weekend into a $500 incident, because the trunk suspends itself once the threshold is hit. Set the cap at a level that comfortably exceeds your genuine peak — then leave it there. Almost no business legitimately triples its call spend overnight.
5. Turn Off What You Do Not Use
Several PBX features are attacker favourites and are frequently enabled by default on systems nobody has hardened:
- DISA (Direct Inward System Access) lets a caller dial in and get outbound dial tone. If you do not need it, disable it. If you do, protect it with a long PIN and restrict it by caller ID.
- Call forwarding to external numbers from voicemail menus — a classic vector, since the attacker compromises a mailbox and forwards to a premium number.
- Unauthenticated conference bridges that allow dial-out.
- Voicemail with default PINs, which is how the mailbox gets compromised in the first place.
6. Encrypt Signalling and Media
TLS for SIP signalling and SRTP for media do not stop credential brute-forcing, but they prevent an attacker on a shared network path from harvesting credentials by passively capturing registration traffic. On any trunk carrying sensitive conversations, encryption is a baseline expectation rather than an upgrade — and it is included as standard on every PBX SIP Trunking trunk.
7. Fail2Ban Every SIP Port
Automated banning of IPs that fail repeated registration attempts turns brute-forcing from a viable strategy into a waste of the attacker's time. A threshold of a handful of failures within a short window, with an escalating ban duration, blocks scanners without inconveniencing a legitimate user who mistypes a password. This is standard on managed platforms; on self-hosted systems it is the single most valuable thing you can install.
8. Monitor for Anomalies, Not Just Totals
Fraud is visible in the shape of traffic long before it is visible on the invoice. The signals worth alerting on are: calls to countries with no prior history, call volume outside business hours, a spike in concurrent channels, a sudden rise in short-duration calls to a single destination prefix, and registrations from a new geographic region. Any one of these deserves an automatic alert; two together deserve automatic suspension.
9. Know Your Provider's Fraud Policy Before You Need It
This is the control businesses skip, and it is the one that determines who absorbs the loss. Ask three specific questions of any provider: Do you monitor for fraud proactively, or only bill for it? What is the maximum exposure before automatic suspension triggers? And in a confirmed fraud event, what portion of the charges do you absorb? Get the answers in writing before you sign, not while you are arguing about an invoice.
A Realistic Priority Order
If you can only do three things this month, do IP access control lists, strong extension passwords, and a hard spend cap. Those three cover prevention, credential security and blast radius, and together they close off nearly every practical attack path. Everything else is defence in depth on top of a foundation that already works.
PBX SIP Trunking applies IP ACLs, encrypted signalling, automated IP banning, geographic restrictions and 24/7 anomaly monitoring to every trunk by default, with configurable spend caps you control from the portal — because fraud protection that costs extra is fraud protection most businesses will not have switched on.