Stop Paying for Calls Nobody Authorized

To restrict international calling on office phones, set dialing permissions per extension rather than per account. Signal gives each extension its own permission set — internal, external, international, emergency, and feature codes — so the lobby handset can reach the front desk and nothing else. This is spend control first and fraud defense second.

Most offices set this up after an invoice arrives with something surprising on it. The configuration takes the same time either way.

What are dialing permissions?

A per-extension rule about what that extension may dial. Signal evaluates it on every outbound call, at the phone system, before the call reaches a carrier.

The five categories map to how bills actually get generated:

• Internal — other extensions on your account. Never carries cost.
• External — local and domestic long distance.
• International — anything outside the domestic dialing plan. This is the expensive one, by orders of magnitude.
• Emergency — 911 and the other required codes. Covered below; the short version is that this one is not really a toggle.
• Feature codes — the star codes that log a queue agent in, retrieve voicemail, or park a call.

Signal treats international as closed unless you open it. The others default to allowed. That asymmetry is deliberate: a new extension that cannot yet dial a vendor is a five-minute support conversation, while a new extension that can dial a premium-rate international number at 3 a.m. is a four-figure conversation with a carrier. Dialing permissions covers the configuration.

Where does unauthorized calling actually come from?

Three sources, and only one of them is what people picture.

Compromised credentials. An attacker gets SIP credentials for one extension and dials premium-rate international numbers at volume, usually overnight or over a weekend. Fraudsters own the destination numbers and collect the termination fees. This is the scenario that generates headline invoices, and it is why international-closed-by-default is the right posture. Toll fraud covers the full mechanism.

Phones in uncontrolled space. A lobby handset, a waiting-room courtesy phone, a break room, a warehouse wall phone, a conference room anyone can walk into. None need to dial beyond your building and a local number, and every one is available to whoever is standing next to it.

Ordinary staff use nobody thought to define. Not malice. A call to family abroad on lunch, a vendor number that turns out to be premium-rate. Individually small, monthly, and invisible until someone audits the bill. Auditing a VoIP invoice covers finding it after the fact.

Which extension gets which permissions?

Start from the physical location of the handset, not from the seniority of the person using it.

The row that saves the most money is the last one. Every office has handsets that are provisioned, registered, and assigned to nobody in particular — the spare at an empty desk, the phone in the room you converted to storage. Nobody notices those being used.

International access is a per-person decision with a stated reason. If two people have a genuine need, two extensions get it. Granting it account-wide because two people need it is the same mistake as giving everyone a company card because the office manager buys supplies.

Why 911 is never restricted

Because it must not be, and Signal does not let you.

Emergency codes bypass dialing permissions entirely. 911 and 933 are ungated, and so are 988 and 711 — the suicide and crisis lifeline and telecommunications relay service, both of which carry their own FCC routing obligations. A permission set that blocks external calling on the lobby phone still passes an emergency call from that phone.

Kari's Law goes further, and it is federal law rather than a preference. Any multi-line telephone system must allow 911 to be dialed directly with no prefix — no 9 first, no access code — and must notify someone on site when 911 is dialed from the building. Signal supports both, so the front desk knows to meet the paramedics at the door rather than watching them look for a suite number.

Two things E911 does not do on its own, and both need saying:

E911 is not automatic. A dispatchable street address is registered per location and per number, and validated. A number with no validated address behind it does not route to the right dispatcher. E911 locations covers the registration and what the address has to contain.

A permission set is not a compliance program. Leaving emergency dialing untouched is necessary; registering accurate addresses for every location and number is the part that takes work.

What to do this week

Six steps, most of them fast.

1. Pull your extension list and mark every handset by where it physically sits, not by whose name is on it.
2. Set every common-area, lobby, and unassigned extension to internal-only or internal-plus-local.
3. Confirm international is closed on every extension that does not have a named business reason.
4. Review feature-code access. An extension that cannot dial out does not need to be able to log itself into a call queue either.
5. Check outbound caller ID while you are in there — a call presenting the wrong number gets returned to the wrong place. See outbound caller ID.
6. Repeat this whenever someone leaves. Offboarding is when a phone becomes a common-area phone without anybody deciding it should be.

Security on Signal covers the credential handling and platform-level fraud controls that sit alongside this.

What permissions do not protect against

Domestic fraud. An attacker dialing domestic premium-rate numbers generates cost inside a permission set that allows external calling, and no category boundary catches it. Volume monitoring catches it; category rules do not.

They also do not detect intrusion — they limit its blast radius. Strong per-extension credentials, which Signal generates server-side rather than letting anyone choose, are what keeps the credential from leaking in the first place.

Frequently asked questions

How do I block international calls on office phones? Set the international permission to off for every extension without a documented business reason. On Signal, international is already closed by default on a new extension, so the task is confirming nothing was opened during setup rather than turning things off. The rule is evaluated per extension, on every outbound call.

What are dialing permissions on a phone system? Per-extension rules covering five categories: internal, external, international, emergency, and feature codes. The phone system checks the calling extension's permissions before the call reaches a carrier, so an extension without external access cannot generate an outside call regardless of what is dialed on the handset.

Can you block 911 on an office phone? No, and you should not want to. Emergency codes bypass dialing permissions entirely on Signal — 911, 933, 988, and 711 all pass from an internal-only extension. Kari's Law separately requires direct 911 dialing with no prefix and on-site notification when 911 is dialed.

How does toll fraud happen on a phone system? Most commonly, an attacker obtains SIP credentials for one extension and places high volumes of calls to premium-rate international numbers, usually overnight or over a weekend. The fraudster collects the termination fees on the destination side. Closed international permissions cap the exposure even if credentials leak.

Which extensions should be allowed to call internationally? Only named individuals with a stated business reason, granted one extension at a time. Common-area handsets, lobby and waiting-room phones, conference rooms, and unassigned spare extensions should never have it. Revisit the list whenever someone leaves, because their handset becomes a common-area phone the moment it is unassigned.

If you have never audited what your extensions are permitted to dial, it is a short exercise with an unusually clear payoff. We are glad to walk through your extension list and where the exposure sits.