The business model
Toll fraud is not vandalism, it is a revenue operation. The attacker controls or has an arrangement with a premium-rate destination — typically an international number that pays a share of every minute terminated to it. They compromise a phone system, place enormous volumes of calls to that number, and collect their cut.
The victim discovers it when the carrier bill arrives. Because the calls were placed with valid credentials through a legitimate trunk, you generally owe the money. Carriers occasionally waive part of it as goodwill, but there is no entitlement, and the amounts are not small: an unattended weekend with a compromised extension routinely produces five-figure bills.
Two characteristics make this worse than it sounds. It is automated and continuous — scanners sweep the entire internet for port 5060 constantly, so exposure is measured in hours, not months. And it happens out of hours deliberately: Friday night, so there are two full days before anybody notices.
How they get in
Weak SIP credentials. The overwhelming majority. A scanner enumerates extensions, then tries passwords. Extension 1001 with the secret 1001, or 1234, or the extension number reversed, is found within minutes of being exposed.
Dialplan misconfiguration. This one needs no password at all. If the context that inbound calls from the internet land in also contains your international dialling rules, anyone who can reach your SIP port can dial out through you. No compromise required — the system is simply configured to allow it.
Exposed management interfaces. An AMI port on a public address with a guessable secret, or a FreePBX admin panel reachable from the internet with default credentials.
Compromised endpoints. A phone with default admin credentials, or a softphone on a machine with malware, hands over working credentials without touching the PBX at all.
The layered defence
No single control is sufficient. The goal is that any one failure is contained.
1. Strong secrets, always
Long, random, unrelated to the extension number. This alone eliminates the most common attack. Never deploy a phone with a secret that resembles its extension — that combination is the first thing every scanner tries.
2. Restrict what each context may dial
This is the control that limits damage after a compromise, and it is the most underused. Structure your dialplan by privilege so international dialling exists only in contexts that need it:
[internal-local] ; most phones live here
exten => _1XX,1,Dial(PJSIP/${EXTEN},20)
[internal-international] ; only the few who need it
include => internal-local
exten => _00.,1,Dial(PJSIP/trunk/${EXTEN})A compromised extension in internal-local cannot place an international call at all, because the rules do not exist in its context. Most staff never dial internationally; give the capability only to those who do.
3. Block the destinations you never call
Fraud concentrates on a relatively small set of high-payout international ranges. If your business never calls them, refuse them explicitly. Ask your carrier to bar international destinations you do not need — a carrier-side block cannot be bypassed by a compromise of your PBX, which makes it stronger than any local rule.
4. Cap concurrency and set a spend alarm
This is the control that turns a catastrophe into an incident. Fraud requires volume: hundreds of simultaneous calls for hours. Limit concurrent calls on the trunk to slightly above your genuine peak, and the ceiling on possible damage drops enormously.
Then ask your carrier for a spend threshold that alerts or suspends. Most offer this and most customers never enable it. It is the difference between a £300 surprise and a £30,000 one.
5. Restrict by IP where possible
If your carrier authenticates by IP, limit port 5060 to their addresses rather than the whole internet. For remote workers, a VPN removes SIP exposure entirely. An attacker who cannot reach the port cannot attack it.
6. Fail2ban on the security log
Ban addresses that repeatedly fail authentication, watching Asterisk's dedicated security log for InvalidPassword, ChallengeResponseFailed, InvalidAccountID and FailedACL events. This raises the cost of brute-forcing considerably.
7. Lock down management interfaces
Bind AMI to localhost. Keep admin panels off the public internet. Grant AMI users only the permission classes they need — never command or system for a routine integration.
Detecting it early
Everything above reduces likelihood and blast radius. Detection determines how long it runs, and duration is what sets the size of the bill.
Watch your CDRs for the signature. Fraud looks unmistakable in the data once you know the shape: a surge of calls to one destination or country, activity outside business hours, unusually long average duration, and high concurrency from a single extension.
A simple hourly check catches most of it:
SELECT accountcode, dst, COUNT(*) AS calls, SUM(billsec)/60 AS mins
FROM cdr
WHERE calldate >= NOW() - INTERVAL 1 HOUR
GROUP BY accountcode, dst
HAVING mins > 60
ORDER BY mins DESC;Alert on anything crossing a threshold that is impossible for normal use. An extension generating sixty minutes of international traffic in an hour at 3am is not a person.
If it is happening now
- Disable the affected extension or block the source IP immediately. Stop the bleeding first.
- Call the carrier and ask them to bar outbound international traffic on the trunk. This is faster and more reliable than fixing your own configuration under pressure.
- Change every secret, not just the one you found compromised.
- Preserve the logs and CDRs before anything rotates — you will need them for the carrier conversation.
- Then work out how they got in, and fix it before re-enabling.
Frequently asked questions
Who pays for fraudulent calls?
Usually you. The calls were placed with valid credentials through your trunk, so carriers generally hold the account responsible. Some negotiate, but there is no guarantee.
What is the single most effective control?
Strong random secrets prevent the most common entry. But the control that limits the damage once someone is in is restricting which contexts may dial international destinations — most extensions never need it.
Why does fraud happen at weekends?
Deliberately. Attackers want the maximum time before anyone notices, so they start on a Friday night. A spend alarm is what closes that window.
Can fail2ban alone protect me?
No. It raises the cost of brute-forcing but does nothing against a dialplan that permits outbound calls from an untrusted context, or against stolen credentials. It is one layer among several.