Troubleshooting

Toll fraud alert: what to do if your phone system is compromised

Short answer

First, find the device or account making the calls, and secure it. Then, in the Enfonica Console, reset the toll fraud escalation or turn your SIP trunk back on. Enfonica blocks the riskiest calls automatically, but calls that connected before the block are charged like any other calls.

Applies to
Cloud SIP, Cloud Voice
Works with
Any SIP PBX or SBC
Who can do this
A project Owner with two-factor authentication, and whoever manages your PBX

Check for a known incident first. If there is one, we're already working on it, and there's nothing to change on your side.

Checking Enfonica system status…

Status page
On this page
  1. What are you seeing?
  2. You received a toll fraud alert, or international calls are being blocked
  3. Enfonica turned off outbound calls on your SIP trunk
  4. All your services stopped after unexpected calls
  5. The Console shows calls that nobody in your business made
  6. How do I find where the calls came from?
  7. How do I secure my phone system?
  8. Who pays for the fraudulent calls?
  9. How do I prevent it next time?
  10. Still stuck?
  11. What to send us
  12. Related

What are you seeing?

Toll fraud is when someone takes over part of a phone system and uses it to make calls to expensive international destinations. The part they take over might be a PBX extension, a password, or a Console login. Work in this order: stop the calls, find where they came from, secure the source, and then turn calling back on.

You received a toll fraud alert, or international calls are being blocked

[Toll Fraud Alert] Anomalous traffic detected

Toll fraud prevention watches every project's outgoing calls. When calls to a group of countries rise unusually fast, it escalates:

  • Calls to that risk tier and every higher tier are blocked.
  • A support ticket is opened to tell you.
  • The block stays until a project Owner resets it.

Calls to lower-risk destinations, including Australia and New Zealand, keep working. So do calls to whitelisted numbers.

Something in your environment is making the calls

This is the most likely cause. Treat the alert as a real attack until you've found the source.

Check

In the Console, go to Settings > Toll fraud prevention. This is the cause if the page shows Escalation active with the time it triggered, and Recently blocked calls lists destinations your business doesn't call. In Cloud Voice > Calls, the blocked calls show the error code BLOCKED with Blocked by Sentinel.

Fix

  1. Review Recently blocked calls, which covers the last 2 days. Note the destinations, times, and volume. To open a call, select its row.
  2. Find where the calls came from. See How do I find where the calls came from?
  3. Secure that device or account. See How do I secure my phone system?
  4. After you fix the cause, on the same page, select Reset escalation, and then select Reset. Only a project Owner with two-factor authentication turned on can do this.

If the escalation triggers again soon after a reset, the cause is still there. Keep investigating instead of resetting again. Every reset gives an attacker a fresh window to make calls.

Your own calling changed

A new campaign, an app under test, or calls to a new country can look like an attack.

Check

Look at the blocked numbers and destinations. This is the cause if you recognize them.

Fix

Reset the escalation. To stop it from happening again, select Manage whitelist, and add the exact numbers you call, in full international format, for example +442079460123. Whitelisted numbers are always allowed, and only exact matches count. To override a whole country, select its tier under Country policy.

Enfonica turned off outbound calls on your SIP trunk

When we see fraud coming through a SIP trunk, we might set its Call termination mode to Disabled to stop outgoing calls straight away. We email you the details. Your PBX then gets 501 Not Implemented on every outgoing call, and the calls don't appear in the Console. Incoming calls keep working.

Your PBX, or a user on it, is compromised

Check

Read our email. It names the SIP domain, when the calls started, and what we saw, such as your PBX's software in the calls' User-Agent.

Fix

Secure the PBX first. See How do I secure my phone system? Then turn the trunk back on:

  1. In the Console, go to Cloud SIP, and open the SIP domain.
  2. Under Termination settings, set Call termination mode to PSTN Trunk.
  3. Select Save Changes.

Our email might list other restrictions, such as a removed incoming call handler or tighter country blocking. Put them back only after you confirm that the unwanted calls have stopped.

All your services stopped after unexpected calls

If fraudulent calls use up your account's credit limit, the services on that billing account stop. They also stop if we suspend the account to prevent further calls.

The credit limit was used up, or the account was suspended

Check

Look for an email from us, or for a message on the Billing overview page that says your services are suspended.

Fix

Secure the source first, so that the calls don't start again when service returns. Then reply to our email, or contact us to restore service. To learn about credit limits and suspensions, see Why have my services stopped?

The Console shows calls that nobody in your business made

If calls appear in Cloud Voice > Calls but not in your PBX's own call logs, they still came through your trunk. Usually an extension, a forwarding rule, or a login has been taken over.

A PBX extension or user has been taken over

Check

Open the calls' SIP traces. This is the cause if they show your PBX's public IP address, your PBX's User-Agent, and a caller ID that belongs to one of your users.

Fix

Disable that extension in your PBX. Give it a new, strong password before you turn it back on. If the user's email password is the same, or was exposed, change it too.

Calls to your number are being forwarded overseas

Attackers sometimes call one of your numbers and use your PBX's forwarding to reach international destinations.

Check

Look in Cloud Voice > Calls. This is the cause if you see a burst of incoming calls to one number at the same time as the outgoing international calls.

Fix

In your PBX, remove forwarding to external numbers that you don't need. Limit international forwarding and dialing to the users who need it.

Someone signed in to your Console account

Check

Look in the Console for SIP domains, numbers, service accounts, or users. This is the cause if you find any that nobody in your business created.

Fix

  • Change the Console passwords of everyone with access.
  • Turn on two-factor authentication.
  • Remove users and service account keys that you don't recognize.
  • Secure the email accounts behind those logins as well. A taken-over email account can reset a Console password.

How do I find where the calls came from?

The SIP trace of a fraudulent call shows which device sent it. Traces are kept for 30 days after the call.

  1. In the Console, go to Cloud Voice > Calls.
  2. Select Filters. Under Direction, select OUTGOING, set the dates, and then select Apply filters.
  3. Open one of the unexpected calls. Under SIP Insights, select View SIP trace.
  4. In the first request, note the IP address it came from, the User-Agent (your PBX's software and version), and the caller ID in From, which points to the user or extension.

To learn more about reading a trace, see Find a call and read its SIP trace.

How do I secure my phone system?

The fix is almost always in your PBX, your phones, or a login. So you, or whoever manages your PBX, need to make it. To secure your phone system:

  • Disable any extension or user that made the calls. Set a new, strong, and unique password before you turn it back on.
  • Change your PBX's admin passwords. If the PBX supports two-factor authentication, turn it on.
  • Check forwarding rules and the outbound dial plan for international destinations you don't use.
  • Update your PBX, phones, and softphones to their latest versions.
  • In the Console, add your PBX's public IP address to the SIP domain's IP access control list. If the SIP domain also has users, set new passwords for them, and update your PBX.
  • Review Settings > Users and Settings > Service accounts, and remove anything that you don't recognize.
  • Scan the computers of affected users for malware, and change their email passwords.

Who pays for the fraudulent calls?

Calls that connected before they were blocked went through the phone network like any other call. The carriers they passed through charge for them, so they appear on your invoice. Enfonica's terms make each account holder responsible for any use of their account. For a list of the calls, contact us.

How do I prevent it next time?

Toll fraud prevention is always on, but it can't stop every call. Securing your own environment matters most.

  • Turn on two-factor authentication for every project Owner now, so that they can respond as soon as an escalation happens.
  • Keep the Block threshold at Block High Risk and above. If you rarely call overseas, select Block Elevated and above.
  • Whitelist exact numbers instead of overriding whole countries.
  • Protect each SIP domain with an IP access control list. In your PBX, limit international dialing to the users who need it.

Toll fraud prevention covers outgoing calls only. It doesn't protect against schemes that trick people into calling back, such as Wangiri missed calls. To learn about the risk tiers and how attacks work, see Understanding toll fraud and how to prevent it.

Still stuck?

Reply to our alert email, or contact us with the details in What to send us. We can share the calls and SIP traces we have, and help you work out where the calls came from.

What to send us

Include these so we can act quickly.

  • The project and SIP domain the calls came from.
  • When you think the unwanted calls started, with your timezone.
  • An example call: the number or country it went to, and the date and time.
  • What you have already changed, such as passwords or firewall rules.
Contact support

Our support team are telco specialists, backed by the engineers who run the network.