WordPress category: blog
Overview
Toll fraud occurs when an unauthorized user gains control of a business phone account, extension, or calling route and places calls that generate charges for the business.
The activity can start with compromised SIP credentials, an exposed phone system, or unauthorized call forwarding. A single call may look normal. A series of calls to unfamiliar international or premium-rate destinations may indicate fraud.
Monitoring connects VOIP security with network security. SIP activity, call records, network traffic, and usage patterns are reviewed together. This can help identify suspicious activity early and support a faster response.
X-Tek provides 24/7 monitoring for business IT environments. The monitoring scope and response actions depend on the systems and controls in place.
How toll fraud develops
A VOIP call uses signaling to establish a connection and media traffic to carry the audio. SIP is commonly used for call signaling.
If an attacker obtains valid credentials or finds a system exposed to unauthorized access, they may be able to place calls through the business account. They may also change forwarding rules or abuse transfer features to route calls through the organization’s phone system.
Potential indicators include:
- Calls to destinations the business does not normally use
- High call volume outside operating hours
- Multiple simultaneous calls from one extension or account
- Repeated calls to a single number or destination prefix
- Unexpected call forwarding or transfer activity
- Repeated failed SIP authentication followed by successful calls
- Sudden increases in trunk use or carrier charges
The New Jersey Cybersecurity and Communications Integration Cell identifies unusual, high-volume calling, particularly outside business hours, as a warning sign of VOIP attacks.
Why VOIP and network monitoring belong together
A phone system does not operate in isolation. It depends on the network, firewall rules, identity controls, internet connection, servers, and provider services.
Monitoring only call records may show what happened, but not how access was gained. Monitoring only network traffic may show unusual activity, but not whether the pattern created costly calls.
A combined view helps connect events such as:
- A login attempt from an unfamiliar source IP
- A burst of SIP registration or authentication failures
- A successful login to an extension
- A sudden increase in outbound calls
- Calls to destinations not used by the business
- Unexpected network traffic to or from the VOIP system
This joined context can help administrators distinguish ordinary usage from activity that needs investigation. It can also help establish whether an issue is limited to one account, one phone system, or a broader network security event.
What should be monitored
Monitoring is most useful when it tracks both system events and call behavior.
SIP and access events
Review authentication attempts, registration activity, call setup requests, and source addresses. Repeated failed attempts can indicate credential guessing. A new source IP or an unexpected account login may need review, particularly when followed by outbound calling.
SIP traffic should be restricted to authorized systems and network paths. Firewalls and session border controllers can help limit exposure and enforce rules for traffic entering or leaving the phone environment.
Call patterns
Call detail records can be reviewed for changes in:
- Call volume by extension, user, trunk, or source IP
- Destination country, prefix, or number
- Call duration and frequency
- Concurrent calls and channel usage
- Calls made outside normal business hours
- Forwarded and transferred calls
Baselines matter. A company with regular international calling has a different normal pattern from one that rarely calls outside its region. Monitoring should account for business-specific usage rather than rely on one threshold for every organization.
The OpenSIPS fraud-detection documentation describes tracking factors such as calls per minute, call duration, total calls, concurrent calls, and repeated calls to a destination. These are examples of measurements that can help identify unusual activity.
Network indicators
Network monitoring adds information about devices, traffic, and access. It can identify unexpected connections to the VOIP server, changes in network traffic, or activity involving a system that should not be communicating with the phone platform.
This context helps answer practical questions: Did the call spike begin after an authentication event? Did it come from an approved phone or an unfamiliar device? Did traffic cross a network boundary where it should have been blocked?
How 24/7 monitoring supports early detection
Toll fraud can accumulate charges while a business is closed or staff are unavailable. A monitoring process that operates only during office hours may leave a longer gap between the first suspicious event and the response.
With 24/7 monitoring, alerts can be reviewed when the business is closed. Depending on the monitoring configuration, events can be escalated for investigation or trigger defined response steps.
A useful detection process typically includes:
Collect relevant events
Gather SIP and authentication logs, call detail records, network events, and available trunk or provider usage data.Establish normal patterns
Record expected call volume, common destinations, typical operating hours, and normal concurrency levels.Set alert thresholds
Flag new high-cost destinations, unusual after-hours activity, sudden call-volume increases, and repeated authentication failures.Correlate events
Review call activity alongside network and access logs. Multiple indicators together can provide stronger evidence than one alert alone.Escalate and contain
Notify the responsible contact. If authorized and configured, suspend an account, restrict a route, or block further calls while the activity is investigated.Document and review
Preserve timestamps, call records, source addresses, and relevant system logs. Review the cause and update controls to reduce the chance of recurrence.
Monitoring does not automatically stop every fraudulent call. Alerting, blocking, and account suspension depend on available controls, system configuration, and response procedures.
Securing SIP traffic
Monitoring should be paired with controls that reduce the chance of unauthorized access.
Recommended measures include:
- Restrict SIP access to approved addresses and services
- Use unique, strong credentials for accounts and extensions
- Disable unused accounts and services
- Apply firmware and software updates
- Disable anonymous or guest calling when not required
- Limit international and premium-rate dialing to business needs
- Set appropriate call-rate, concurrency, and spending limits
- Review forwarding and transfer permissions
- Protect the VOIP system behind properly configured network controls
The CISA guide to Voice over Internet Protocol describes security considerations for internet-connected voice systems. Like other network-connected services, VOIP requires access controls and ongoing attention to configuration and exposure.
Caller ID authentication is also relevant, but it addresses a different issue. The FCC’s call authentication overview explains how STIR/SHAKEN supports caller ID authentication. It does not replace monitoring of outbound account activity, SIP access, or unusual call patterns.
Response when an alert appears
When monitoring identifies a suspicious pattern, the response should be prompt and controlled.
- Confirm the alert against call records and system logs
- Identify the affected user, extension, device, route, or trunk
- Stop or restrict suspicious outbound calling if authorized
- Reset compromised credentials and review account permissions
- Check forwarding, transfer, and routing settings
- Contact the VOIP provider or carrier when required
- Preserve records for investigation and billing review
- Review network access and patching for the affected system
A business should define who receives after-hours alerts and who can approve actions such as disabling an extension or restricting a trunk. A response plan reduces uncertainty during an active incident.
How X-Tek supports business VOIP environments
X-Tek provides cloud and on-premise VOIP services, along with network design, maintenance, and IT support. These systems can be considered as part of a broader security and monitoring plan.
A review can include:
- VOIP system exposure and network placement
- SIP access rules and authentication controls
- Call routing, forwarding, and transfer settings
- Logging and alert availability
- Network monitoring coverage
- Escalation and response responsibilities
Existing VOIP deployments may also need changes as staff, locations, and calling needs evolve. Reviewing the phone platform alongside network controls helps keep monitoring relevant to current operations.
For information about your business environment, use the Business Solutions Information Request.
Key points
- Toll fraud can begin with compromised credentials, exposed services, or abused call-routing features
- Call records and network events provide complementary evidence
- Monitoring call volume, destinations, concurrency, and authentication activity can help identify anomalies
- 24/7 monitoring helps address alerts outside normal business hours
- Monitoring works best with restricted SIP access, strong credentials, and defined response procedures
- Blocking and escalation actions depend on system configuration and authorization
Monitoring also depends on a healthy connection. If you want a baseline before tightening up your VOIP security, run a quick quality test to see how your network is performing right now.
Contact Information
Business Solutions Information Request:
https://xtekit.com/business-solutions-information-request/
815-516-8075