Toll Fraud: How Phone Systems Get Hijacked

VoIP toll fraud is theft of your calling capacity, and the bill lands on you. Attackers register stolen SIP credentials, then pump traffic to premium-rate international numbers that pay them a cut of the per-minute rate. The carrier bills the account holder, and there is no chargeback. Prevention is a spend control.

A compromised extension can generate a five-figure invoice over a long weekend. That is the scale worth designing against.

Who pays when a phone system is used for toll fraud?

You do, in nearly every case. The calls were placed with valid credentials from your account and terminated by real carriers who expect to be paid.

The chain is the problem. Your provider owes its upstream carrier, that carrier owes the transit provider, and at the far end a partner in a high-rate jurisdiction has already collected. Nobody absorbed a loss, so nobody has a mechanism to reverse one.

Most provider agreements say so explicitly: the customer is responsible for charges incurred through their account, including charges from unauthorized use. Read yours. That asymmetry is why the useful question is not "will my provider cover it" but "how much can a stolen credential spend before anyone notices."

How do attackers actually get into a phone system?

Rarely through anything sophisticated. The entry points are dull and consistent.

• Weak or reused SIP passwords. Scanners sweep the internet for SIP endpoints continuously and try credential lists. An extension with a guessable secret is found in hours.
• Shared credentials across devices. One secret on five handsets means one leak compromises five.
• Default or trivial voicemail PINs. Voicemail that permits outdialing lets an attacker call in, authenticate with 1234, and dial out from inside your system.
• Portal password reuse. An administrator password that appeared in a breach dump gives away the configuration, not just a line.
• Departed staff. Credentials never revoked are the quietest version, and the one nobody scans for.
• No rate limiting. Repeated failed registrations from one source should get it banned, not politely retried forever.

None of these require a vulnerability in the phone system. They require a credential, and credentials leak.

Why do fraudulent calls always go to obscure countries?

Because that is where the money is. The scheme is called International Revenue Share Fraud, and the destination is the product.

Certain international ranges carry very high termination rates, and whoever controls those ranges shares revenue with whoever sends traffic to them. A fraudster acquires access to such a range, then finds a phone system willing to dial it thousands of times.

That explains the two signatures of a fraud event: volume, because revenue scales with minutes, and timing — Friday evening through Sunday, or 2 a.m. midweek — because the goal is to run as long as possible before someone looks. It also explains why destinations look random. They are targeting a rate table, not your business.

What single control stops the most toll fraud?

International dialing off by default, enabled per extension only where it is genuinely needed. Nothing else in this article comes close.

The logic is blunt. A stolen credential is worth what it can dial. If an extension cannot place international calls, that credential is worth approximately nothing to an IRSF operator no matter how thoroughly they compromised it. You have not made the breach less likely; you have made it unprofitable, which from a spend perspective is the same outcome.

On Signal, international dialing is off by default on every extension and enabled individually. Most offices discover during setup that the number of people who need it is one or two, or zero. The dialing permissions guide covers the full per-extension set: internal, external, international, emergency, and feature codes.

One caveat matters: emergency dialing is never gated by any of this. 911 routes ahead of the permission checks on every extension, including the most locked-down lobby phone.

The full control set, in order of value:

1. International dialing off by default, on per extension by exception.
2. Unique generated SIP credentials per extension, never shared across devices.
3. Voicemail PINs that are not the extension number.
4. Portal roles scoped tightly — owner, admin, agent, read-only — with credential access limited to a short list.
5. Same-day revocation when staff depart.
6. A weekly look at call history, specifically overnight and weekend outbound.
7. An isolated per-client server, so a compromise elsewhere is not a compromise of yours.

The last is architectural rather than configurable. Signal gives each client their own phone server rather than a shared platform, so the blast radius of any incident stops at one account — shared platform or your own server covers why that matters beyond fraud.

How do you notice it in progress?

Faster than the invoice, which is the only bar that matters. By the time a bill arrives, the money is spent.

The signals are visible in call reporting if anyone is looking: outbound calls at hours nobody works, repeated dialing to one international prefix, concurrent calls exceeding your headcount, an extension generating volume that does not match its owner, and registrations from an unfamiliar network. The weekly call report Signal emails keeps a human eye on the pattern without anyone remembering to log in.

What should I ask a provider about fraud protection?

Seven questions. The answers are more revealing than any marketing page.

1. Is international dialing off by default on a new extension? If not, every account you open starts exposed.
2. Can I restrict it per extension, not just account-wide? All-or-nothing forces a choice between the control and the one person who needs it.
3. Are SIP credentials generated per extension, or shared?
4. What happens on repeated failed registration attempts? "Nothing" is an answer.
5. Am I on a shared platform, or my own instance?
6. What does the contract say about charges from unauthorized use? Ask them to point at the clause.
7. Will you alert me on anomalous outbound volume, and to whom?

Ask the sixth before you sign. What to ask before you sign a VoIP contract covers the rest, and the security reference documents how Signal answers three through five.

The first hour after you suspect a compromise

1. Reset the affected extension's SIP password — this drops every active registration immediately.
2. Turn international dialing off account-wide as a temporary blanket.
3. Pull call history for the extension; note destinations, times, and volume.
4. Rotate portal passwords for administrator accounts.
5. Contact your provider with the call detail extract, not a description.
6. Once contained, work out how the credential leaked before re-enabling anything.

Step six is the one people skip, and it is why some businesses experience this twice.

Frequently asked questions

Who pays when a phone system is used for toll fraud?

The account holder, in nearly all cases. Calls placed with valid credentials are carried by real networks that expect payment, and most provider agreements assign responsibility for unauthorized use to the customer. Any partial credit is a commercial gesture, not an entitlement.

How do attackers actually get into a phone system?

Through credentials, not exotic vulnerabilities: weak or reused SIP passwords found by automated scanners, secrets shared across devices, default voicemail PINs that permit outdialing, reused administrator portal passwords, and accounts belonging to departed staff that were never revoked.

What single control stops the most toll fraud?

International dialing disabled by default and enabled per extension by exception. A stolen credential is worth what it can dial, and one that cannot reach premium destinations is worth nearly nothing. Emergency dialing stays ungated on every extension regardless.

What should I ask a provider about fraud protection?

Whether international dialing is off by default, whether it restricts per extension, whether SIP credentials are unique per extension, what happens on repeated failed registrations, whether you share a platform with other customers, and what the contract says about unauthorized use.

If you are on a system today and do not know whether international dialing is enabled on every extension, that is worth finding out this week. Tell us what you find and we will tell you what a tighter configuration would look like.