Answers for Canadian SIP trunking

Toll fraud is the unauthorized or fraudulent use of a phone system or voice service to place calls, usually to expensive destinations.

Modern IP-based phone systems, including PBX systems, SIP trunks, hosted phone systems, softphones, and voicemail platforms, can be targeted by attackers if they are not properly secured.

Fraudsters do not need physical access to your office, phones, or PBX. Most toll fraud is performed remotely over the internet by scanning for exposed systems, weak passwords, unsecured SIP credentials, vulnerable PBX software, open administration portals, or misconfigured calling features.

If your PBX, SIP account, extension, or voicemail system is compromised, unauthorized calls may be placed through your IXICA account. These calls can result in significant charges in a very short period of time.

Why do fraudsters target phone systems?

Fraudsters target phone systems because they can generate expensive call traffic without paying for it themselves.

A typical toll fraud incident works like this:

1. The attacker gains access to a PBX, SIP account, extension, voicemail system, or admin portal.
2. The attacker places calls to expensive destinations, premium routes, or revenue-sharing numbers.
3. The calls are billed through the customer’s account.
4. The customer is responsible for the charges.
5. The fraudster or an associated party may benefit from the traffic.

Toll fraud often happens after hours, on weekends, or during holidays, when suspicious traffic may not be noticed right away.

How serious is telecom fraud?

Telecom fraud is a major global issue. The Communications Fraud Control Association, or CFCA, reported that telecom fraud losses reached an estimated $38.95 billion USD in 2023, representing approximately 2.5% of global telecommunications revenues.

PBX hacking, compromised SIP credentials, voicemail abuse, international revenue-share fraud, and unauthorized call forwarding are all common forms of telecom fraud.

Who is responsible for fraudulent calls?

As the account holder, you are responsible for all calls made through your account, including calls generated by a compromised PBX, SIP device, extension, voicemail system, softphone, or SIP credential.

IXICA’s network security team may use monitoring, fraud detection, and traffic controls to help identify or reduce suspicious activity where possible. However, no provider can guarantee that all fraud will be detected or stopped before charges occur.

Customer-side PBX security remains the customer’s responsibility.

IXICA’s Business Terms of Service are available at:

https://www.ixica.com/legal

Can IXICA prevent all toll fraud?

No. No carrier or service provider can guarantee complete toll fraud prevention.

Fraud detection systems may help identify unusual traffic, but they are not a substitute for proper PBX security. In many cases, fraudulent calls may already have occurred before the traffic is detected.

The best protection is prevention, including strong passwords, firewall restrictions, updated software, secure SIP configuration, limited call permissions, and regular monitoring of call activity.

How do attackers usually gain access?

Common causes of toll fraud include:

1. Weak SIP extension passwords
2. Weak PBX administrator passwords
3. Default usernames and passwords
4. Exposed PBX web administration portals
5. Exposed SSH, HTTP, HTTPS, SIP, or management ports
6. Publicly reachable SIP registration without IP restrictions
7. Old or unsupported PBX software
8. Missing security patches
9. Compromised remote extensions
10. Insecure softphones
11. Misconfigured firewalls
12. Voicemail systems that allow outbound calling
13. DISA or call-through features
14. Stolen SIP credentials
15. Malware on a computer used to manage the PBX
16. Former employees or vendors retaining access
17. Poorly secured call forwarding features

Most attacks are automated. Attackers scan the internet looking for vulnerable PBX systems and then attempt to exploit them.

What are the most important PBX security steps?

Customers should review PBX security with their IT provider or PBX administrator. The following best practices are strongly recommended.

Firewall and Network Security

1. Place the PBX behind a properly configured firewall.
2. Do not expose PBX administration portals directly to the public internet.
3. Restrict web, SSH, and admin access to trusted IP addresses only.
4. Allow SIP traffic only from required trusted IP addresses where possible.
5. Use VPN access for remote administration.
6. Monitor SIP traffic for scanning or brute-force attempts.
7. Use tools such as fail2ban or equivalent intrusion-prevention tools where supported.
8. Disable unused ports and services.
9. Review firewall rules regularly.

A network-enabled PBX that is directly exposed to the internet is at much higher risk of compromise.

Password and Account Security

1. Do not use default extension numbers as passwords.
2. Do not use default PBX administrator passwords.
3. Use strong, unique passwords for every SIP extension.
4. Use strong, unique passwords for every administrator account.
5. Avoid simple numeric passwords for voicemail.
6. Do not make voicemail PINs the same as extension numbers.
7. Require users to change voicemail PINs periodically.
8. Remove unused extensions.
9. Remove unused voicemail boxes.
10. Disable generic or shared authorization codes.
11. Deactivate accounts immediately when employees leave.
12. Change passwords after staff changes, vendor changes, or suspected compromise.

Passwords should be long, random, and not based on names, extension numbers, company names, phone numbers, or dictionary words.

Calling Permission Controls

Each extension should only have the calling permissions it actually needs.

For example:

1. Lobby phones may only need internal or local calling.
2. Fax lines may not need long-distance access.
3. Warehouse phones may not need international calling.
4. Conference room phones may need restricted access.
5. Remote extensions should have tighter controls.
6. Executive and sales users may need broader access but should still be monitored.

Restricting calling permissions reduces the damage if an extension is compromised.

Should international calling be blocked?

If international calling is not required, it should be blocked.

If international calling is required, consider:

1. Allowing only approved countries.
2. Blocking all countries not used by the business.
3. Requiring authorization codes for international calls.
4. Limiting international access to specific extensions.
5. Restricting international calling after hours.
6. Setting call spending limits where available.
7. Monitoring international call activity closely.

Do not leave international calling open by default unless there is a clear business need.

What PBX features create fraud risk?

Certain PBX features can create serious toll fraud exposure if they are not secured.

Review and restrict the following:

1. DISA, meaning Direct Inward System Access
2. Voicemail callback
3. Call-through features
4. Trunk-to-trunk transfer
5. External call forwarding
6. After-hours forwarding
7. Remote extension registration
8. Unrestricted outbound routes
9. Shared authorization codes
10. Old or hidden call forwarding rules
11. Admin access from public IP addresses

If you do not use these features, disable them.

Why is voicemail a toll fraud risk?

Voicemail systems can be abused if they allow users to call out, return calls, or access external dialing features.

Attackers may try to guess voicemail PINs and then use voicemail menus to place outbound calls.

To reduce this risk:

1. Disable outbound calling from voicemail unless required.
2. Require strong voicemail PINs.
3. Do not use the extension number as the voicemail PIN.
4. Limit failed login attempts.
5. Lock voicemail access after repeated failed attempts.
6. Delete unused voicemail boxes.
7. Change voicemail PINs when employees leave.
8. Audit voicemail settings regularly.

What should be done when an employee leaves?

When an employee leaves the company, remove their access immediately.

This should include:

1. Disabling their PBX extension if no longer needed.
2. Changing or deleting their voicemail box.
3. Removing PBX admin access.
4. Removing VPN access.
5. Removing softphone access.
6. Removing email access tied to PBX administration.
7. Changing shared passwords they may have known.
8. Reviewing call forwarding rules.
9. Reviewing authorization codes.

Employee offboarding should include phone system access, not just email and computer access.

What is social engineering?

Social engineering is when an attacker tricks someone into revealing confidential information or making a security change.

For example, an attacker may pretend to be:

1. A carrier technician
2. A PBX vendor
3. A customer
4. An employee
5. A manager
6. A support provider
7. A telecom repair agent

They may ask for passwords, SIP credentials, admin access, call forwarding changes, or system details.

Staff should never provide PBX access, passwords, SIP credentials, customer information, or system details unless they are certain they are dealing with an authorized person.

What warning signs may indicate toll fraud?

Possible warning signs include:

1. Unexpected international calls
2. Calls to countries your business does not normally call
3. Calls to Caribbean or high-cost +1 destinations
4. Calls outside business hours
5. Many short calls in a row
6. Many calls to the same destination
7. A sudden increase in usage
8. High simultaneous call volume
9. Calls from extensions that should not be active
10. Calls from unknown IP addresses
11. Unusual call forwarding activity
12. Reports that trunks or channels are busy unexpectedly
13. Unusual failed login attempts
14. Unknown extensions, routes, or forwarding rules in the PBX

If you see any of these signs, treat it as urgent.

What should I do if I suspect toll fraud?

If you suspect toll fraud, act immediately.

Recommended steps:

1. Disable international calling if it is not required.
2. Disable suspicious extensions.
3. Reset all SIP passwords.
4. Reset all PBX administrator passwords.
5. Disable public PBX admin access.
6. Review firewall rules.
7. Block unknown IP addresses.
8. Review call detail records.
9. Review all outbound routes.
10. Review voicemail callback and DISA features.
11. Review call forwarding settings.
12. Check for unknown users, extensions, trunks, and routes.
13. Contact your IT provider or PBX administrator.
14. Open a ticket with IXICA support.

Do not wait. Toll fraud can continue until the point of compromise is closed.

If my PBX was hacked, is changing the password enough?

Not always.

If the PBX web interface or operating system has been compromised, simply changing passwords may not be enough. Attackers may have added hidden users, forwarding rules, backdoors, scripts, or database changes.

In serious cases, the safest approach may be to rebuild the PBX from a trusted backup or reinstall the system, then apply all security updates and change all passwords.

If you suspect a full system compromise, consult a qualified PBX or security professional.

Are Canada and U.S. long-distance calls always included?

Most retail accounts provided by IXICA include Canada and U.S. long-distance calling, subject to the terms of the specific call plan.

However, some destinations that appear to be part of the same +1 dialing format may be excluded or rated differently.

A number beginning with 1 is not automatically included in standard Canada or continental U.S. calling. The North American Numbering Plan includes Canada, the United States, U.S. territories, and several Caribbean countries and territories under country code +1.

Which Canada and U.S. destinations may be rated differently?

Some Canada and U.S. destinations may not be included in standard Canada/U.S. retail calling plans or may carry higher rates.

Common examples include:

These destinations should not be assumed to rate the same as standard Canada or continental U.S. calls.

Why are Caribbean and territory numbers a toll fraud risk?

Many Caribbean countries and U.S. territories use the same +1-NPA-NXX-XXXX dialing format as Canada and the United States. This can make the numbers look like ordinary North American numbers.

However, many of these destinations are rated separately and may be excluded from standard Canada/U.S. included calling plans.

This creates a fraud risk because attackers may place high volumes of calls to expensive +1 destinations that appear domestic at first glance.

Common +1 destinations that may be rated differently

The following area codes may be rated differently from standard Canada or continental U.S. calling. Customers should confirm rates before allowing these destinations.

These should not be described as “non-NANPA” destinations. A better description is:

These are +1 numbering-plan destinations that may be rated differently from standard Canada and continental U.S. calling and may not be included in your call plan.

Should I block high-cost destinations?

If your business does not need to call certain destinations, you should restrict them.

At minimum, consider restricting:

1. International calling
2. Premium-rate destinations
3. Caribbean +1 destinations
4. Alaska, Hawaii, and Canadian territories if not required
5. Any country or area code not normally used by your business
6. After-hours long-distance calling
7. Long-distance access from extensions that do not need it

Blocking unnecessary destinations is one of the most effective ways to reduce toll fraud exposure.

What should I ask my IT provider or PBX administrator to review?

Ask your IT provider or PBX administrator to review:

1. SIP password strength
2. PBX admin password strength
3. Firewall rules
4. Public internet exposure
5. Allowed SIP source IPs
6. PBX software version and security patches
7. International calling permissions
8. Caribbean and high-cost destination permissions
9. After-hours calling rules
10. Maximum call duration settings
11. Concurrent call limits
12. Voicemail callback permissions
13. DISA or call-through features
14. Remote extension security
15. Unknown extensions or users
16. Unknown forwarding rules
17. Trunk-to-trunk transfer settings
18. Call detail records for unusual traffic
19. Employee offboarding procedures
20. Billing or usage notification settings

What information should I provide when opening a fraud-related ticket?

If you believe your account has been compromised or you see suspicious usage, please include:

1. The affected SIP account
2. The date and time the suspicious calls started
3. Example destination numbers
4. Example call times
5. Any affected extensions
6. Whether the PBX is hosted on-site or in the cloud
7. Whether the PBX admin portal is reachable from the public internet
8. Whether SIP access is restricted by IP
9. Whether any passwords were recently changed
10. Whether international calling is required
11. Whether any employees or vendors recently left
12. Any recent PBX, firewall, routing, or remote access changes

This information helps IXICA and your IT provider identify the likely source of compromise and reduce further exposure.

Summary

Toll fraud is the unauthorized use of your phone system or voice account to place calls, often to expensive destinations. It is usually performed remotely and can result in significant charges very quickly.

Customers are responsible for all calls made through their account, including calls caused by compromised PBX systems, extensions, SIP credentials, voicemail boxes, or insecure configurations.

IXICA may help detect and reduce suspicious activity where possible, but PBX security is ultimately the customer’s responsibility.

To reduce risk, secure your PBX, use strong passwords, restrict public access, block unnecessary destinations, limit calling permissions, disable risky features, and monitor call activity regularly.