What toll fraud is and why it targets IP phone systems
Phone fraud, known in the industry as toll fraud, happens when a third party uses your line or your phone system to make calls that you end up paying for. An IP phone system, also called a PBX (private branch exchange) in the cloud or on premises, runs over the internet using SIP (Session Initiation Protocol), the “language” phones use to register and place calls. That makes it flexible and affordable, but it also makes it visible to anyone hunting for misconfigured systems.
This is no small problem. The Communications Fraud Control Association (CFCA), the international association that measures telecom fraud, estimated in its 2025 global survey that the industry loses about 41.82 billion dollars a year to fraud, roughly 2.46 % of its revenue. The same report notes that international traffic fraud remains an active problem, concentrated in certain regions.
The most common schemes
- IRSF (International Revenue Share Fraud): the criminal obtains high-cost international numbers, usually in a country other than the victim's, and receives a share of what is charged for every minute. They then generate thousands of calls to those numbers from someone else's phone system. Europol and Trend Micro describe in their 2019 report how PBX hacking ends up turning into IRSF.
- Wangiri: a Japanese word meaning something like “one ring and hang up.” An automated system rings your mobile just once from an international number; if you call back, you pay a high rate, part of which goes to the scammer. The FTC (the U.S. Federal Trade Commission) sums it up in simple advice: if you get a one-ring call from an unknown number, don't call back.
- Compromised extensions and voicemail: extensions with passwords like “1234” or voicemail boxes with the factory PIN that allow outbound dialing. Once inside, the intruder uses your phone system as a springboard.
- Stolen SIP credentials: automated programs try millions of username and password combinations until they find a valid one. With it, the attacker registers their own “phone” on your account and makes calls as if they were an employee.
Why it almost always happens at night and on weekends
Europol's 2019 report puts it bluntly: people who attack phone systems usually do it outside business hours so the attack lasts longer and earns them more money. A Friday night or a long holiday weekend gives them many hours with nobody checking the system or responding to an alert. That is why losses cluster in those windows, and why your controls have to work on their own, without depending on someone watching.
What it looks like on your bill
Fraud gives no warning: it shows up all at once. The typical sign is international usage many times higher than normal, concentrated in a few hours, to countries your business has no ties with. In the call detail, known as the CDR (call detail record), you will see many simultaneous calls of similar length to unusual prefixes, at times when the office was closed, often from a single extension or trunk.
For example: a logistics company with 25 extensions closes on Friday at 6 p.m. On Monday, the accounting team opens the provider's portal and finds international charges equal to several months of phone service. Reviewing the CDR, they discover that since the early hours of Saturday, an extension used by an intern who had already left made hundreds of calls to destinations on another continent, with up to ten calls at the same time. That extension's password was the extension number itself. Nobody had deactivated it, the system had no spending limit and international calling was open to every user.
Warning signs to watch for
- Outbound calls to countries you don't do business with.
- Activity at times when nobody is in the office.
- Spikes in simultaneous calls that exceed your number of active employees.
- Extensions registering from IP addresses (a device's “address” on the internet) in other countries.
- Many failed registration attempts in the system logs: someone is trying passwords.
- Users complaining that “the line is busy” when they aren't on a call.
How to protect your phone system step by step
- Strong, unique passwords: every extension, voicemail box and trunk should have a long, random password. Never use the extension number or factory defaults. Europol warns that many attacked systems were protected only by a default or weak password.
- Block destinations you don't use: if you only call Colombia, Ecuador and Peru, shut off the rest of the world. Enable international destinations only for those who need them, never by default.
- Spending and concurrent-call limits: ask your provider for a daily or monthly cap on international usage and a maximum number of channels per extension and per trunk. If someone gets in, the damage stays contained.
- Schedules: restrict international calls outside business hours, except for users who truly need them.
- Automatic alerts: set up email or text notifications when usage, call volume or destinations fall outside the norm.
- Firewall and fail2ban: a firewall should allow access to the phone system only from authorized networks. Fail2ban is a tool that automatically blocks IP addresses that fail the password several times in a row. The documentation for Asterisk, one of the most widely used IP PBX programs, also recommends limiting who can connect through access lists and protecting admin interfaces with a VPN (virtual private network).
- Separate inbound from outbound: the same documentation stresses that calls coming in from outside must never be able to use paid calling services. It is a common configuration mistake.
- Updates: keep the phone system software, phones and routers up to date; many breaches exploit flaws that have already been fixed.
- Review trunks and users: trunks are your phone system's connections to the carrier. Every quarter, review which trunks, extensions and voicemail boxes exist, and remove the ones no longer in use, like the intern's in the example.
If your phone system is in the cloud, several of these layers should come included. At 19 80 TIC Cloud, our engineering team runs its own IP telephony platform, so we know firsthand how much limits and alerts matter day to day. You can see how our cloud PBX works or review the international calling options to enable only the destinations you need.
What to do if it has already happened
- Cut off the traffic immediately: block international calls and disable the compromised extension or trunk.
- Call your provider: ask them to block the affected destinations on their side and send you the CDR for the period. Every hour counts.
- Change all passwords: not just the affected one. If an attacker got in once, they may have left other doors open.
- Keep the evidence: system logs, CDRs, emails and screenshots. You will need them for the police report and any claim.
- Report it: in Colombia you can go to the National Police's Cyber Police Center (Centro Cibernético Policial) or the Attorney General's Office (Fiscalía); in Ecuador and Peru, to their authorities' cybercrime units.
- Fix the root cause: before reopening service, apply the measures in the previous section so it doesn't happen again.
If you'd like us to review your phone system's configuration, write to us from the contact page.
