VoIP Toll Fraud Prevention for Business
Lock down your phone system so a hacked account can't run up a huge bill.
Indigo Unified Communications secures business phone systems against toll fraud, where criminals break into a phone system and make expensive calls at your cost. The main defences are barring destinations you don't need, locking down logins and admin access, and keeping systems patched. International and premium-rate calls are barred as standard on new systems, unless you need them, and we or the carrier monitor call spend and alert you to unusual activity. We set it up on 3CX, 8x8 and Teams Phone and support it from Glasgow.
What is toll fraud?
Toll fraud, also called PBX fraud or dial-through fraud, is when criminals get into your phone system and use it to call premium-rate or international numbers they profit from. It often happens overnight or over a weekend, when nobody is watching.
The cost lands on you. The National Cyber Security Centre (NCSC) says that, as the owner of the phone system, the business is expected to pay the bill. Worldwide, the Communications Fraud Control Association estimated telecoms fraud losses at $38.95 billion in 2023, and named PBX fraud among the top methods (CFCA, November 2023).
How do phone systems get hacked?
- Weak or default passwords on extensions, voicemail PINs or the admin console.
- Admin portals open to the internet, without multi-factor authentication or restrictions on who can reach them.
- Stolen user logins, often from phishing, which let someone make calls from a softphone anywhere.
- Call forwarding abused, so calls into your system are forwarded to an expensive number.
- Out-of-date software and handsets with known security holes.
Cloud systems aren't immune. The same risks apply, but they move from a box in the comms room to online accounts. Our article covers the wider picture: How secure is VoIP? →
How we lock down 8x8, 3CX and Teams Phone
| Control | 3CX | Microsoft Teams Phone | 8x8 |
|---|---|---|---|
| Bar international and premium-rate calls | Allowed country codes restrict which countries can be dialled | Outbound calling restriction policies limit users to domestic calls, or none | Barred as standard on new systems we set up |
| Block attackers | Anti-hacking protection and a global IP blacklist | Microsoft Entra ID sign-in with multi-factor authentication and conditional access | 8x8 runs and secures the platform itself |
| Protect admin access | Console restrictions limit who can reach the admin console | Admin roles in Microsoft 365 | Named admins with strong sign-in |
| Encrypt calls | Secure SIP (TLS) | TLS and SRTP by default | TLS and SRTP |
On every platform, international and premium-rate calls are barred as standard on new systems, unless you need them. Indigo or the carrier also monitors call spend and alerts you to unusual activity. Beyond barring, 8x8's toll-fraud controls aren't listed on its public feature pages, so we confirm the rest for your account before go-live.
A practical checklist
These controls follow the NCSC's guidance on securing phone systems:
- Bar what you don't use. Block premium-rate and international numbers unless someone needs them, and allow exceptions per person.
- Change every default password and PIN, including voicemail, and use strong, unique passwords.
- Turn on multi-factor authentication for admin accounts, and keep the number of admins small.
- Restrict call forwarding and transfers to outside numbers, a common route for fraud.
- Watch call patterns for unusual volumes, destinations or times of day.
- Remove leavers the day they go, including their softphone logins.
- Keep software and handsets patched.
Why the network behind your phones matters
Your phone system is only as secure as the network it runs on. Indigo is certified to ISO 27001:2022 for information security, with a scope that includes hosted telecoms and connectivity, and holds Cyber Essentials Plus. Because we also supply and monitor business broadband, leased lines and firewalls, one team looks after the whole call path. Business connectivity → · Managed IT support →
Charities and venues with small teams and busy out-of-hours periods are common targets, because nobody is watching the system at night. Phone systems for charities → · Leisure and entertainment →
Frequently asked questions
What is VoIP toll fraud?
Toll fraud is when criminals get into a business phone system and make calls to premium-rate or international numbers they profit from, often overnight or at weekends. The business pays the bill. It's prevented by barring destinations you don't call, using strong passwords and multi-factor authentication, restricting call forwarding and keeping software patched.
Who pays if our phone system is hacked?
Usually you do. The NCSC says that as the owner of the phone system, the business is expected to pay the bill for fraudulent calls. That's why prevention matters more than recovery. Check your contract and any cyber insurance for what's covered. With Indigo, international and premium-rate calls are barred as standard on new systems, unless you need them, and call spend is monitored with alerts on unusual activity.
How do I know if my phone system has been hacked?
Warning signs include calls to countries you don't deal with, calls at night or weekends when the office is closed, a sudden jump in call volume or cost, lots of short calls, and callers who hang up as soon as they're answered. Contact your provider straight away and change passwords if you see any of these.
Does 3CX protect against toll fraud?
Yes. 3CX includes allowed country codes to restrict where calls can go, anti-hacking protection, a global IP blacklist and console restrictions for the admin interface. They only protect you if they're set up for how your business calls, alongside strong passwords and patching. Indigo Unified Communications configures them when we install 3CX.
Can we stop Teams users calling international numbers?
Yes. Microsoft Teams Phone has outbound calling restriction policies that allow international and domestic calls, domestic calls only, or no outbound phone calls apart from emergency numbers. They can be set for the whole organisation or per user, and they apply however Teams connects to the phone network.
Book a free phone system review
We'll check your current phone system for the gaps that lead to toll fraud and show you how we'd lock it down. You'll get a written recommendation within 2 working days.