Toll-fraud protection

Toll fraud is the attack with a bill: someone gets hold of a SIP credential and pumps calls to premium international numbers until you notice. The defense is layered — even a stolen password should hit three more walls before it costs money.

Layer 1: allowed country codes

Admin → Security → Allowed Country Codes is a region/country checklist — calls to countries you haven't allowed don't go out, full stop. Most businesses can allow their home region plus a handful of countries they actually call. This is the highest-value five minutes in the security section.

How it behaves:

• Until you save a list, only the United States and Canada are allowed — the same two boxes the page shows ticked. If your users call other countries, tick them before you need them.
• Your own country is always allowed, and national and local dialing is never blocked.
• The Caribbean is not "domestic". Jamaica (1-876), the Dominican Republic (1-809) and the other islands inside the North American numbering plan are dialed exactly like a US number and are a favourite premium-rate fraud target, so each is its own checkbox and is blocked until ticked.
• The check runs on the number as dialed and as your outbound rule sends it to the carrier, so an outside-line prefix or a strip/prepend rule cannot hide the country.
• It covers everything that reaches a carrier: calls from phones and apps, forwarding and find-me targets, IVR and overflow destinations, queue callbacks (the number a caller asks to be called back on) and outbound faxes. Emergency numbers are never blocked.
• A refused call gets a fast busy. Each attempt is written to the event log (Call refused … is not an allowed country); tick Calls & messages made to blocked countries under Admin → System → Alerts to be emailed as well — repeats are held back for fifteen minutes, so an attack doesn't bury your inbox (the event log still records every attempt).

Layer 2: dialing classes

Outbound rules carry a required dialing class (Local / Domestic / International / Premium), granted per user. A compromised reception extension that's never been granted International simply can't use the international rule — the blast radius of any single credential stays small.

Layer 3: rule design

• Keep a blocked rule above your permissive ones for premium-rate prefixes.
• Cap simultaneous calls per trunk (trunk options) — fraud runs many calls at once; a sane channel cap turns a flood into a trickle.
• Restrict after-hours risk by scoping rules to extension groups where practical.

Layer 4: credential defense

Abuse control auto-bans the brute-forcing that steals credentials in the first place, and the CID blacklist (Admin → Security → Number Blacklist) drops known nuisance callers before they ring anyone.

Detection

Turn on the relevant alerts: blocked-country attempts, anti-hacking rejections, and unusual trunk activity. Fraud that's noticed in five minutes is an incident; fraud noticed on the invoice is a budget item. Your carrier's own spending caps are the final backstop — set them there too.