In modern VoIP and call center architectures, the greatest threat is no longer just server downtime. Instead, the real danger lies in scenarios where an attacker, without drawing attention, turns your telephony infrastructure into a machine for generating massive costs. Toll Fraud attacks, or the abuse of voice traffic, have become one of the most specialized and at the same time most expensive types of attacks against VoIP systems, SIP trunks and call centers. If your infrastructure is not properly hardened against such threats, a single weekend can result in telecommunications charges equivalent to several months of operational costs.
What Is Toll Fraud in VoIP and Why Is It Dangerous?
In Toll Fraud attacks, the attacker exploits your telephony resources – such as SIP trunks, PSTN lines, international numbers, and SIP accounts – to place calls to destinations of their choosing. These are typically premium-rate numbers, high-tariff destinations, or scenarios involving International Revenue Share Fraud (IRSF).
An important point for professionals to understand is that Toll Fraud is not merely the misuse of credentials; rather, it is the result of a combination of the following weaknesses:
- Incorrect or poorly designed dial plans and routing rules
- Lack of rate limiting and usage quotas for extensions and trunks
- Absence of real-time monitoring over traffic patterns
- Weak security at the signaling (SIP) and management layers (Web GUI, API, SSH)
As a result, an attack can originate both from outside the network (internet-facing SIP services) and from within the internal network (compromised extensions, malicious internal users, or leaked credentials).
Common Toll Fraud Patterns in VoIP Networks
In call center environments and enterprise PBX systems, the following scenarios are among the most common attack patterns:
1. Brute-Force Attacks on Extensions and SIP Accounts
- Scanning ranges of extensions (for example, 1000 to 1999)
- Testing weak or default passwords (such as the extension number itself, 1234, 0000, or the company name)
- Upon success, registering (REGISTER) and placing calls using the compromised account
2. Abuse of DISA, IVR, and Voicemail
- Gaining access to internal menus that allow outbound dialing without strong authentication
- Compromising voicemails with weak PINs and abusing callback or outdial capabilities
- DTMF injection in improperly secured IVR scenarios
3. SIP Session Hijacking or Trunk Abuse
- Gaining access to an IP-PBX or SBC that is published on the internet without proper ACLs
- Abusing site-to-site trunks that are defined without restrictions on prefixes or caller IDs
- Sending direct INVITE requests to an SBC or media gateway and bypassing the PBX due to weak session policies
4. Misrouting and Dial Plan Weaknesses
- Routes that accept all destinations instead of being restricted to specific prefixes
- Lack of time-based restrictions (for example, allowing international calls outside business hours)
- Absence of route separation based on tenant, queue, or group in multi-tenant environments
For professionals responsible for dial plan design, Toll Fraud is fundamentally a routing and policy issue, not merely a security problem.
The Role of SBC and Session Management in Reducing Toll Fraud Risk
In professional VoIP architectures, the first and most critical point for controlling Toll Fraud is the Session Border Controller (SBC). Some of the key SBC capabilities in this area include:
- Topology hiding and stateful inspection on SIP
Preventing attackers from directly viewing the internal PBX structure, internal IP addresses, and numbering patterns. - Granular policies based on destination, prefix, time, and caller profile
- Defining maximum call duration for high-risk traffic (for example, international mobile destinations)
- Restricting specific countries or prefixes through country-based blacklists and whitelists
- Enforcing concurrent call limits per trunk, DID or tenant
- Rate limiting and anomaly detection at the signaling layer
- Detecting abnormal volumes of INVITE requests from a single IP address or user agent
- Dropping suspicious traffic before it reaches the PBX
- Integration with IDS/IPS and SIEM systems for event correlation
Without an SBC—or at least intelligent session management—any enforcement applied at the PBX level is implemented one step too late, at a point where many attacks have already gained access to trunks and billing resources. One of the key capabilities of Chekavak SBC is topology hiding: by leveraging a Session Border Controller, it conceals the internal PBX structure, internal IP addresses, and numbering patterns, effectively preventing related attacks. In addition to enhancing security, this feature provides full visibility and control over call sessions and prevents unauthorized access. With support for up to 10,000 concurrent SIP signaling sessions, Chekavak SBC ensures that your VoIP network remains stable and reliable even in complex environments.
Designing an Organization-Wide Anti–Toll Fraud Strategy
To achieve effective Toll Fraud prevention—not merely a theoretical one—policies must be applied simultaneously across multiple layers of the organization.
1. User and Extension Layer
- Enforcing strong password policies for SIP accounts (minimum length, complexity, and expiration)
- Dedicated restrictions per user or group, including:
- Daily and monthly spending limits
- Maximum number of concurrent calls
- Restricting international and premium-rate destinations to authorized users only
2. Dial Plan and Routing Layer
- Defining separate routes for low-risk and high-risk traffic
- Creating blacklists and whitelists based on prefixes, country codes, and number patterns
- Enabling time-based conditions for high-risk traffic (for example, blocking international calls at night and on weekends)
3. Monitoring and CDR Analytics Layer
- Real-time monitoring of CDRs and SIP logs to detect abnormal patterns, such as:
- Sudden and abnormal changes in ASR or ACD metrics
- A high volume of short-duration calls to a specific prefix
- A sudden spike in outbound call volume within a specific time window
- Defining alerts based on explicit rules rather than relying solely on global traffic thresholds
4. Perimeter and Network Security Layer
- Restricting access to SIP and RTP ports to specific IP addresses using ACLs
- Using VPNs for remote extensions instead of exposing SIP services directly to the internet
- Leveraging tools such as Fail2Ban to block IP addresses exhibiting brute-force behavior against SIP services
In combating Toll Fraud attacks, intelligent routing and load balancing are critical pillars—capabilities that Chekavak SBC specifically supports. These features help distribute traffic load across the network and prevent degradation in call quality. Additionally, by supporting IPtables and enabling IP-based access restrictions, Chekavak SBC provides an extra security layer that reduces the risk of unauthorized access. With support for the RFC 5853 standard, this system can be deployed across all telecommunications environments.
A Practical Toll Fraud Scenario in a Call Center
Imagine a call center with 200 operators and several active international SIP trunks:
- Extensions are registered on remote softphones, and SIP services are exposed to the internet.
- No prefix restrictions are applied on the international trunk, and only a generic “International Allowed” setting is enabled.
- CDRs are reviewed manually, and only on a daily basis.
In this scenario, an attacker scans port 5060 and tests several extension ranges, eventually discovering valid credentials. The attacker then proceeds to:
- Generate a large volume of outbound calls to international premium destinations during off-hours (for example, between 2:00 and 4:00 a.m.).
- Maintain each call for 30 to 45 minutes in order to maximize revenue for the destination.
- By morning, tens of millions in costs have accumulated on the trunk, while the system has no active alerts in place.
If the same organization had implemented the following controls:
- An international calling credit limit per extension
- Limits on the number of concurrent calls
- Time-based routing policies for international traffic
- CDR-based alerts for high-risk destinations
The attack would have been stopped within the very first minutes.
Toll Fraud in the Era of Cloud PBX and SIP Trunking
As infrastructures migrate to the cloud and the use of cloud-based SIP trunks becomes widespread, the attack surface for Toll Fraud has expanded significantly:
- Inadequately isolated multi-tenant cloud PBX environments can enable cross-tenant abuse.
- Poorly secured PBX management and billing APIs may allow attackers to modify policies and credit limits.
- Improperly designed hybrid connections (on-premises and cloud) can allow Toll Fraud to originate on one side and generate costs on the other.
In such environments, securing the IP-PBX alone is no longer sufficient; the entire chain—from endpoints to cloud SBCs, billing systems, and CRM—must be treated as a single attack surface.
Benefits of Implementing an Anti–Toll Fraud Solution in Organizations
1. Cost Control and Billing Predictability
- Defining hard limits and soft limits on traffic and costs, segmented by trunk, queue, tenant, and user.
2. Increased Trust Between Technical and Financial Teams
- Providing transparent and technical reports on how policies and restrictions are applied, in a format that is understandable for financial teams.
3. Reduced Operational Risk in Large-Scale VoIP Projects
- Enabling secure rollouts for new branches without concerns about abuse during the early deployment phases.
4. Integration with Existing Security Systems
- Sending Toll Fraud–related alerts and events to the organization’s SIEM, NOC, and SOC systems for correlation with other security incidents.
Conclusion
Toll Fraud is no longer a “peripheral” threat in VoIP environments. For organizations that rely on SIP trunks, cloud PBX platforms, multi-site call centers, and international communications, this type of attack represents a direct business risk.
Addressing Toll Fraud is not a matter of installing a single module or enabling a checkbox in the PBX; it requires designing a multi-layered strategy that spans dial plans, SBCs, CDR analytics, and security policies. Organizations that take this risk seriously not only achieve a significant reduction in cost and exposure, but also gain the confidence to expand their telephony infrastructure and introduce new services.
About Chekavak
With hands-on experience in designing and implementing enterprise-scale VoIP, call center, SIP trunking, and SBC infrastructures, Chekavak delivers specialized solutions for detecting, preventing, and monitoring Toll Fraud attacks.
From dial plan design and anti–Toll Fraud policy definition to deploying professional SBCs, integrating billing systems, and implementing real-time monitoring dashboards, Chekavak helps technical teams elevate their communications infrastructure to a level that is resilient against complex and costly Toll Fraud attacks.
If you would like Chekavak to prepare a technical assessment and solution design tailored to your network and business scenario, we would be happy to arrange a consultation session and a dedicated demo. Please share your contact details, or get in touch with our technical team by calling +98 21 29700600.