How toll fraud actually happens — and what stops it

Toll fraud is the reason VoIP security matters more than most small businesses expect. The attack is almost entirely automated, it is not targeted at you specifically, and the first sign is usually a bill nobody can explain. Understanding the sequence makes the defences obvious.

The scan is constant and indiscriminate

Put a SIP service on a public IP address and automated scanning begins within minutes. Not hours — minutes. These tools sweep entire address ranges continuously looking for anything responding on SIP ports.

This is worth internalising because it defeats the most common objection: we are too small to be a target. You are not a target. You are an address that answered. A five-extension system is found exactly as fast as a five-hundred-extension one, and is usually defended far worse.

Then it guesses extensions and passwords

Once a system responds, the tooling enumerates extension numbers — starting with the obvious ranges, because almost every install numbers extensions 100, 101, 1001 and so on. It then attempts registration against each with common passwords.

The passwords that succeed are depressingly predictable: the extension number itself, 1234, the company name, or a vendor default that survived the install. One weak extension out of forty is enough.

The money is made on premium-rate destinations

With valid credentials the attacker registers a softphone and begins dialling — typically international premium-rate numbers they control or earn revenue from. Traffic is generated at volume, often across many simultaneous channels.

Timing is deliberate. Attacks overwhelmingly start on a Friday evening or the start of a public holiday, because that buys the longest possible window before anyone looks at an account. Two or three unattended days at scale is where the large numbers come from.

What actually stops it

No single control is sufficient. The systems that survive have several, so that one failure does not become an incident.

• Access control lists. The strongest single measure. If your PBX only accepts SIP traffic from your carrier and your known office IPs, the scanning never reaches the registration stage at all.
• Strong per-extension credentials. Long, random, unique per extension, and never matching the extension number. Vendor defaults removed, test accounts deleted.
• Brute-force banning. Automatic blocking of hosts that fail repeated registrations, so credential guessing is cut off within seconds rather than running all night.
• Destination restrictions. Most businesses never legitimately dial premium-rate international ranges. Block them by default and unblock on request — this alone removes the profit motive.
• Spend caps and prepaid balance. A hard financial ceiling. Prepaid credit means an attacker can never spend more than you have deposited.
• Alerting. Notification on unusual concurrent call counts or spend, so a Friday-night incident does not run until Monday.

If you think it is happening now

1. Block outbound international and premium-rate dialling immediately — stop the bleeding before investigating.
2. Rotate every SIP credential, including ones you believe are unused.
3. Pull the call detail records and identify which extension originated the traffic and from which IP.
4. Close the entry point properly before restoring service, or it will simply resume.
5. Tell your provider straight away — some can halt traffic at the trunk while you work.

The uncomfortable truth is that most compromised systems were not sophisticated breaches. They were a default password on an extension nobody remembered creating, on a system reachable from the entire internet.