Toll Fraud Prevention: How to Protect Your Business Phone System

Toll fraud happens when criminals break into your phone system and use it to make expensive calls that you pay for. You prevent it with layers: lock down passwords and remote access, bar the destinations you never call, restrict out-of-hours calling, put spend limits in place at your provider, and read your call records often enough to spot a problem in hours rather than at the end of the month. This guide sets out each layer in the order we would tackle it for a small or mid-sized UK business.

TL;DR

• Toll fraud (also called dial-through fraud) means attackers hijack your PBX or VoIP account to route calls to premium-rate or international numbers. The NCSC says losses can reach tens of thousands of pounds.
• Start with the basics: change every default password and voicemail PIN, turn off remote voicemail access, and switch off call forwarding to outside numbers unless someone genuinely needs it.
• Bar international and premium-rate calling for everyone who does not need it, and block outbound calls when the office is closed.
• Your own settings are not enough. Ask your provider for spend limits and alerts that sit outside your system, because a compromised PBX can override its own rules.
• Review call logs weekly. Long calls, odd destinations and weekend traffic are the early signs.

Table of Contents

• What toll fraud is and how it works
• Layer one: close the doors attackers use first
• Layer two: bar what you never use
• Layer three: an external safety net
• Layer four: detection, or how to stop it fast
• Related scams that target the same businesses
• Our perspective: why we start with the contract and the call log
• Where our services fit
• A one-page toll fraud checklist
• FAQ
• Sources

What toll fraud is and how it works

In a toll fraud attack, someone gains control of your telephone system and makes calls through it. Action Fraud explains that criminals typically get in through badly configured firewalls, weak security settings, lack of maintenance or default passwords. Once inside, they can use built-in features such as voicemail, call forwarding and call diversion to send calls where they choose, often to premium-rate or international numbers.

The money works in two ways. Either the criminal owns the premium-rate number and collects a share of every pound your system spends calling it, or they resell cheap access to international destinations and your account pays the wholesale cost. Either way, the bill lands with you.

The NCSC describes the typical outcome as thousands of calls routed to high-cost numbers, with losses that can run to tens of thousands of pounds for smaller organisations, schools and medical practices. You may also hear this called PBX hacking, dial-through fraud, or International Revenue Share Fraud (IRSF). The mechanics differ slightly, but the defences are largely the same.

Why it hits small businesses hardest

A large carrier has a fraud team watching traffic around the clock. A ten-person office usually has a phone system that someone installed years ago, an admin password nobody has changed, and nobody looking at call records until the invoice arrives. Attackers know this, and they scan the internet automatically for exposed phone systems. The Communications Council’s IP-PBX guidance lists the kind of probing that precedes an attack: general and directory scanning, extension enumeration, brute-force attempts on admin interfaces, and requests that reveal equipment types and versions.

Timing matters too. According to the NCSC, attacks often come in the early hours, at weekends or on bank holidays, when staff are away and nobody is watching. A fraudster who gets in on Friday evening can run up four days of calls before anyone notices.

Layer one: close the doors attackers use first

Most successful attacks need no sophistication. They use the same few weaknesses, so fix these first.

1. Change every default credential. That means the admin login for the PBX or hosted portal, every handset or extension password, and every voicemail PIN. Default voicemail PINs such as 1234 or the extension number itself are a classic way in.
2. Use strong, unique passwords and change them on a schedule. The NCSC asks organisations to make sure users understand why this matters and to help them where necessary. A password manager removes most of the excuses.
3. Disable remote voicemail access if no one needs to dial in from outside. If people do, make it a deliberate, documented exception.
4. Keep firmware and software patched. Unmaintained systems are what Action Fraud points to as an easy target. If your installer has not touched your system in years, that is a conversation to have this month.
5. Do not expose SIP to the whole internet. Restrict who can reach your system’s signalling ports, and allow only the addresses that genuinely need to connect.

Call forwarding and transfer: the step people miss

Fraudsters abuse call forwarding and call transfer to send traffic to premium-rate or international numbers. The NCSC guidance recommends disabling forwarding and transfer to off-premises numbers. Where they are business-critical, restrict them to specific authenticated users and update those credentials regularly. A receptionist who forwards calls to a mobile is a perfectly good reason; the other 20 extensions rarely need it.

Protect the physical side too

Not every attack is remote. A comms cupboard that anyone can walk into, or a PBX sitting in an unlocked back office, hands an intruder the same access. Treat the room like any other sensitive space: lock it, log who has keys, and consider managed entry. Specialists in access control and intruder alarm installation can advise on securing the room itself, and our own piece on access control integration covers how entry systems and phone systems can work together.

Layer two: bar what you never use

The cheapest fraud to prevent is the call your business would never make. The NCSC’s guidance on limiting calls is straightforward: disable international and premium-rate calling for users who do not need it.

Work through it like this:

If you do trade internationally, bar everything and then open only the countries you actually ring. A sales team that calls Germany and Ireland does not need Cuba or the Maldives enabled.

Out-of-hours restrictions

Because attacks cluster when the office is empty, configure outbound barring for evenings, weekends and public holidays. If a few people genuinely work late, give them a specific exception rather than leaving the whole system open. Remember to review the schedule when your hours change.

Layer three: an external safety net

This is the layer that most small businesses lack, and it is the one that saves them when everything else fails. The NCSC notes that if an attacker gains control of your PBX, restrictions set inside it can be bypassed, because the attacker can change the configuration. That is why protection has to exist outside the system, at provider level.

In practice, ask your provider these questions:

• Can you set a commercial spend limit on my account, so calls stop or are flagged once a daily or monthly threshold is reached?
• Do you offer alerts for unusual destinations, volume or call duration, and who receives them out of hours?
• Can international and premium-rate barring be applied at network level, not just on my PBX?
• What happens if fraud is found? Who do I call, and how quickly can calling be suspended?
• Who is liable for fraudulent calls under my contract? Read this clause before you need it.

Session Border Controllers for SIP

If you run SIP trunks or an on-site IP-PBX, an SBC adds a protective layer at the edge. The Communications Council’s guidance explains that an SBC inspects SIP connections, blocks malformed packets and helps stop registration storms. It also acts as a back-to-back user agent, which hides your internal network topology and protects against denial-of-service attacks and rogue media fraud. With a hosted service, the provider should run this for you; it is worth asking to confirm.

The industry standard for IP voice security is set out in NICC ND 1443, which covers platform, customer equipment, signalling and media security. You do not need to read it cover to cover, but a good provider will know it.

Keep routing in the UK where you can

The government’s Fraud Sector Charter for telecommunications reflects closer working between the Home Office and UK providers to trace the origin of fraudulent traffic. One practical point for businesses: ask your provider where your calls are routed. Traffic that originates or is routed outside the UK is harder to track and protect.

Layer four: detection, or how to stop it fast

No set of controls is perfect, so assume that something will eventually get through and plan to notice quickly. The NCSC says reviewing your call logs for anomalies is the most reliable way to catch a breach before it becomes a big financial loss. Look for:

• Calls that run unusually long
• Sudden jumps in calls to expensive destinations
• Heavy freephone or premium-rate usage you cannot explain
• Any outbound traffic overnight, at weekends or on bank holidays
• Many short calls from one extension in a tight burst

Set a rhythm. A weekly look at the top ten destinations and the longest calls takes minutes. Do a quick check on the first working day after every bank holiday. If your provider or phone system produces call-accounting reports, schedule them to arrive by email rather than hoping someone logs in.

What to do if you think you have been hit

1. Call your provider immediately and ask them to suspend or bar outbound international and premium-rate calls.
2. Change all credentials: admin logins, extension passwords, voicemail PINs.
3. Disable forwarding and remote access until you understand how the attacker got in.
4. Preserve your call records and any logs from the system or firewall.
5. Report it to Action Fraud and tell your installer so the root cause can be fixed. If it is a business-critical incident, your insurer may need to hear quickly too, so check your policy wording.

If you are unsure whether a bill is fraudulent, ask a telecoms professional to review the logs with you rather than waiting for the next invoice. Action Fraud also recommends consulting an IT telecoms professional when you are not certain your system is secure.

Related scams that target the same businesses

Toll fraud is one of several ways criminals try to get money from business phone lines. Two are worth knowing about.

Wangiri, or one-ring scams. A missed call from an unfamiliar number tempts you to ring back, and the number turns out to be premium rate. Ofcom’s guidance says to avoid calling back numbers you do not recognise, and lists prefixes that can be premium rate, including 070, 076, 084, 087, 090, 091 and 118. Tell reception and anyone who handles missed-call lists.

Number porting and impersonation. If someone persuades a provider to move your number, they can intercept calls and verification codes. Keep your account PIN and portal access limited to named people, and tell your provider promptly if your service drops without explanation.

Our perspective: why we start with the contract and the call log

When a business tells us about a fraud bill, the story is rarely about clever hacking. It is about a default PIN, an old system nobody maintained, and nobody seeing the traffic until the invoice. That is why we put as much weight on how a phone service is bought and monitored as on the technology.

We work with businesses across Essex, London and the South East, and we are independent of any single vendor, so we can talk about the right protection for the system you actually have. Our view is simple. Bar everything by default and open what you need. Insist on controls at provider level, because your own settings are the first thing an attacker changes. Make sure someone has the job of looking at call records, even if it is only ten minutes on a Monday. And pick a provider that you can reach quickly, with UK-based support, when something looks wrong at 7pm on a Friday.

We also think flexibility is a security feature. If a service no longer fits, or a provider’s fraud controls are weak, you should be able to move without being locked in for years. That is why we offer our services without long-term contracts.

— Paul

Where our services fit

If you are reviewing your phone setup, our VoIP and SIP hosted telephony moves your voice service away from an ageing on-site box that nobody patches. It is a good moment to agree barring, out-of-hours rules and alerts. For automated reception and call handling, see our AI-powered business phone systems. If you want to talk through what is exposed on your current system, contact us via our site and we will look at it with you.

Resilience matters here as well. A phone system that depends on a single internet line is easier to disrupt, and our dual WAN failover guide explains how backup connectivity works. Our 5G and 4G routers start from £20 per month, and fibre broadband starts from £49 per month.

A one-page toll fraud checklist

Print this and tick it off with whoever looks after your phones.

• [ ] All default admin passwords, extension passwords and voicemail PINs changed
• [ ] Remote voicemail access off, or restricted to named users
• [ ] Call forwarding and transfer to external numbers off, or restricted to named users
• [ ] International and premium-rate calling barred by default
• [ ] Outbound calls blocked out of hours, at weekends and on bank holidays
• [ ] SIP access restricted; firmware and software up to date
• [ ] Provider-level spend limit and alerts agreed, with an out-of-hours contact
• [ ] Routing location confirmed with your provider
• [ ] Comms room physically locked
• [ ] Weekly call-log review in someone’s diary, plus a check after every bank holiday
• [ ] Incident steps written down, with your provider’s fraud contact number

FAQ

What is the difference between toll fraud detection and prevention?

Prevention stops attackers getting in or making costly calls, through passwords, barring and restrictions. Detection catches what slips through, by watching call records and alerts for odd destinations, long calls and out-of-hours traffic. You need both, because no set of controls is perfect.

Who pays if my phone system is used for toll fraud?

Usually the account holder, which means you, unless your contract says otherwise. Liability terms vary between providers, so read that clause before signing. Provider-level spend limits reduce how big the bill can get.

Does moving to VoIP make toll fraud more likely?

Not by itself, but internet-facing systems get scanned constantly, so weak credentials and open SIP ports are found quickly. A hosted service that your provider secures and monitors takes much of that burden off a small business. Barring and spend limits still need to be set up.

How do I stop toll fraud on an old PBX?

Start with the quick wins: change all passwords and PINs, disable remote voicemail and external forwarding, and bar international and premium-rate calls. Then ask your maintainer or provider to check for security updates and apply network-level barring. If the system can no longer be patched, that is a strong reason to replace it.

Sources

• NCSC: Private Branch Exchange (PBX) best practice
• Action Fraud: The threat of PBX/Dial-through fraud
• Communications Council: Recommendations for secure deployment of an IP-PBX
• NICC ND 1443
• Ofcom: What to do about a scam call, text or message
• GOV.UK: Fraud Sector Charter, telecommunications

Recommended

• Voip
• Business Mobiles