Toll Fraud Can Cost Your Business $20,000 in a Weekend. Here's How Attackers Do It — and How to Stop Them

There is a category of cybercrime most businesses have never heard of until the invoice arrives: toll fraud, also called International Revenue Share Fraud (IRSF). Industry estimates put global telecom fraud losses in the tens of billions of dollars every year — and unlike a hacked email account, this attack converts directly into money, billed to you, over a weekend when nobody's watching the phones.

We operate PBX infrastructure for businesses across the U.S. and we see the attack traffic every single day. Here's how it works and how a properly run phone system shuts it down.

The business model of toll fraud

1. Fraudsters lease premium-rate international numbers (or collude with corrupt small carriers) where they earn a per-minute cut of inbound call revenue.
2. They compromise a business phone system — yours.
3. They pump thousands of calls to those numbers, typically starting Friday night to maximize hours before anyone notices.
4. Your carrier bills you for the calls. The fraudsters collect their revenue share. By Monday morning, a small business can owe five figures.

The calls are real, so from the carrier's perspective the charges are real. Recovering the money afterward ranges from difficult to hopeless — the only good outcome is prevention.

How they get in

Weak SIP passwords

Every hour of every day, automated scanners sweep the entire internet for SIP services (port 5060) and brute-force extension passwords. An extension registered with password 1234 or ext101 will be found — not "might be," will be, usually within hours of being exposed. We've responded to real incidents where an internet-exposed service with a trivial password was compromised and repurposed within weeks.

Exposed PBX admin panels

A PBX web interface open to the whole internet is one weak admin password away from an attacker who can create their own extensions, set up their own trunks, and route calls wherever they want. Older unpatched PBX software (there are widely exploited vulnerabilities in old FreePBX/Asterisk-based systems) can be taken over with no password at all.

Voicemail-system dial-through

Legacy voicemail systems with "dial out" or call-return features can be abused: attackers guess a 4-digit voicemail PIN, then use the voicemail menu itself to place outbound international calls.

Compromised handsets and ATAs

IP phones and analog adapters with default web passwords, sitting on the open internet, hand over their SIP credentials to anyone who asks.

The defense stack (what "secured" actually means)

No single control stops toll fraud. A properly hardened phone system layers all of these:

1. International calling off by default. Most U.S. businesses never call Somalia, São Tomé, or premium satellite prefixes. Outbound international should be disabled per-tenant and enabled only to the specific countries you actually call. This single control converts a $20,000 incident into a blocked call.

2. Strong, machine-generated SIP credentials. Every extension gets a long random password. No exceptions for "temporary" test extensions — test extensions with weak passwords are how real compromises start.

3. Fail2ban / intrusion blocking at the PBX. Failed registration attempts should earn the source IP an automatic ban. On our infrastructure, scanners get a handful of guesses, then the firewall eats them. Login protection has to cover every door — SIP and the web admin interface, which many stock PBX setups quietly fail to monitor.

4. Admin panels never open to the internet. PBX administration belongs behind a firewall, allow-listed to known IPs, or on a VPN. Period.

5. Rate limits and spend alerts. Caps on concurrent international calls, per-day spend ceilings, and alerts on unusual after-hours calling patterns mean that even a successful compromise is contained in minutes, not days.

6. Encrypted, authenticated provisioning. Phone auto-provisioning files contain SIP passwords. They must be served over HTTPS with per-device authentication — a provisioning server that hands configs to anyone who knows the URL pattern is a credential vending machine.

7. Patching. The exploits used against phone systems are mostly old and public. A PBX that's years behind on updates is an appliance-shaped liability.

Questions to ask your current provider

1. Is international dialing restricted by default on my account? To which destinations right now?
2. What happens after repeated failed SIP registrations from one IP?
3. Is the PBX admin interface reachable from the public internet?
4. Would anyone notice 500 calls to Sierra Leone at 2 a.m. Saturday — and who gets woken up?
5. Who pays if my account is compromised because of a weakness on your side?

If the answers are vague, the honest translation is: you are the fraud detection system, and you run monthly.

How we handle it

Yondertele runs its own multi-tenant PBX fleet, and security is operational, not aspirational: international destinations are allow-listed per customer, intrusion banning covers both SIP and web logins, admin surfaces are IP-restricted, provisioning is HTTPS-only with per-device auth, and we watch calling patterns fleet-wide because an attack on any tenant teaches us to protect every tenant. Your phone bill should never be the way you find out about a breach. Talk to us about a secure phone system.