VoIP Toll Fraud Prevention

1. How VoIP toll fraud works

Toll fraud occurs when attackers gain unauthorized access to your SIP infrastructure and use it to make calls — typically to premium rate numbers they control, international destinations, or numbers they sell access to. The calls are billed to you.

The typical attack flow: attacker scans the internet for SIP servers on port 5060, attempts to register with brute-forced credentials, gains access to an extension or trunk, then immediately begins making calls to high-cost destinations. Attacks often happen overnight or on weekends when monitoring is minimal. A single compromised account can generate tens of thousands of dollars in calls within hours.

2. Common toll fraud attack types

3. Detecting toll fraud in SIP traces

In a SIP trace, fraud looks like:

• High volume of REGISTER attempts from foreign IPs in rapid succession
• Multiple 401/403 responses followed by eventual 200 OK — successful brute force
• INVITE requests to international or premium rate numbers shortly after registration
• Calls at unusual hours (overnight, weekends) from registered extensions
• High concurrent call counts from a single extension

4. Prevention controls

Authentication hardening

• Use strong passwords — minimum 16 characters, random alphanumeric
• Never use extension number as username or password
• Enable IP allowlisting — only allow REGISTER from known IP ranges
• Disable unused extensions and trunks

Rate limiting with fail2ban

Call routing controls

• Block international calling by default — enable per extension on request
• Block premium rate number ranges (900, 976, international premium)
• Set per-extension and per-trunk concurrent call limits
• Set daily spend limits with carrier — most SIP trunk providers offer this
• Block calls to high-fraud destinations (specific country codes)

Network controls

• Put SIP on a non-standard port (not 5060) — reduces scan exposure
• Restrict SIP access by IP at the firewall level
• Use VPN for remote phone access instead of exposing SIP directly
• Disable direct internet access to PBX admin interface

5. Real-time monitoring for toll fraud

Detect fraud before the bill arrives:

• CDR monitoring — alert on calls to unusual destinations or at unusual hours
• Concurrent call limits — alert when an extension exceeds its normal concurrent call count
• Daily spend limits — set hard limits with your SIP trunk provider
• Geographic anomaly detection — alert when calls originate from unexpected countries
• Registration alerts — notify when an extension registers from a new IP

6. Incident response

If you suspect active toll fraud:

1. Immediately disable outbound calling — block outbound routes at the firewall or PBX level
2. Identify the compromised extension — check CDRs for the source of fraudulent calls
3. Rotate all credentials — change passwords on all extensions, not just the compromised one
4. Contact your SIP trunk provider — they can see real-time CDRs and may be able to cap the damage
5. Review and block — add the attacker IPs to your firewall blacklist
6. Audit dialplan and configuration — check for any changes made by the attacker

Frequently asked questions

What is VoIP toll fraud?

VoIP toll fraud is when attackers gain unauthorized access to your SIP infrastructure and use it to make calls at your expense — typically to premium rate numbers they control. Attacks usually start with SIP brute force scanning on port 5060, credential guessing, and then immediate high-volume calling to expensive destinations.

How do I prevent toll fraud on my SIP server?

Prevent VoIP toll fraud by: using strong passwords on all extensions (16+ character random strings), enabling fail2ban to block IPs after failed registration attempts, restricting SIP access by IP at the firewall level, blocking international and premium rate destinations by default, setting per-extension concurrent call limits, and using a non-standard SIP port.

How do I detect VoIP toll fraud in progress?

Signs of active toll fraud: high volume of failed REGISTER attempts from foreign IPs, calls to international or premium rate numbers at unusual hours, unusually high concurrent calls from a single extension, and sudden spikes in CDR call volume. Set up real-time CDR monitoring and daily spend limits with your SIP trunk provider to catch fraud before costs escalate.