---
title: "Toll fraud alert: what to do if your phone system is compromised"
url: "https://enfonica.com/help/security/toll-fraud"
summary: "First, find the device or account making the calls, and secure it. Then, in the Enfonica Console, reset the toll fraud escalation or turn your SIP trunk back on. Enfonica blocks the riskiest calls automatically, but calls that connected before the block are charged like any other calls."
type: troubleshooting
audience: everyone
products: ["Cloud SIP", "Cloud Voice"]
works_with: ["Any SIP PBX or SBC"]
who_can_do_this: "A project Owner with two-factor authentication, and whoever manages your PBX"
---

# Toll fraud alert: what to do if your phone system is compromised

**Short answer:** First, find the device or account making the calls, and secure it. Then, in the Enfonica Console, reset the toll fraud escalation or turn your SIP trunk back on. Enfonica blocks the riskiest calls automatically, but calls that connected before the block are charged like any other calls.

**Applies to:** Cloud SIP, Cloud Voice  
**Works with:** Any SIP PBX or SBC  
**Who can do this:** A project Owner with two-factor authentication, and whoever manages your PBX

First check the [Enfonica status page](https://enfonica.status.io/) for a known incident.

Toll fraud is when someone takes over part of a phone system and uses it to make calls to expensive international destinations. The part they take over might be a PBX extension, a password, or a Console login. Work in this order: stop the calls, find where they came from, secure the source, and then turn calling back on.

## You received a toll fraud alert, or international calls are being blocked

What you see: `[Toll Fraud Alert] Anomalous traffic detected`

Toll fraud prevention watches every project's outgoing calls. When calls to a group of countries rise unusually fast, it escalates:

- Calls to that risk tier and every higher tier are blocked.
- A support ticket is opened to tell you.
- The block stays until a project Owner resets it.

Calls to lower-risk destinations, including Australia and New Zealand, keep working. So do calls to whitelisted numbers.

### Something in your environment is making the calls

This is the most likely cause. Treat the alert as a real attack until you've found the source.

**To check**, in the Console, go to **Settings > Toll fraud prevention**. This is the cause if the page shows **Escalation active** with the time it triggered, and **Recently blocked calls** lists destinations your business doesn't call. In **Cloud Voice > Calls**, the blocked calls show the error code `BLOCKED` with `Blocked by Sentinel`.

**To fix it:**

1. Review **Recently blocked calls**, which covers the last 2 days. Note the destinations, times, and volume. To open a call, select its row.
2. Find where the calls came from. See [How do I find where the calls came from?](https://enfonica.com/help/security/toll-fraud#find-the-source)
3. Secure that device or account. See [How do I secure my phone system?](https://enfonica.com/help/security/toll-fraud#secure-your-system)
4. After you fix the cause, on the same page, select **Reset escalation**, and then select **Reset**. Only a project Owner with [two-factor authentication](https://enfonica.com/help/security/two-factor-authentication) turned on can do this.

> **Warning:** If the escalation triggers again soon after a reset, the cause is still there. Keep investigating instead of resetting again. Every reset gives an attacker a fresh window to make calls.

### Your own calling changed

A new campaign, an app under test, or calls to a new country can look like an attack.

**To check**, look at the blocked numbers and destinations. This is the cause if you recognize them.

**To fix it**, reset the escalation. To stop it from happening again, select **Manage whitelist**, and add the exact numbers you call, in full international format, for example `+442079460123`. Whitelisted numbers are always allowed, and only exact matches count. To override a whole country, select its tier under **Country policy**.

## Enfonica turned off outbound calls on your SIP trunk

When we see fraud coming through a SIP trunk, we might set its **Call termination mode** to **Disabled** to stop outgoing calls straight away. We email you the details. Your PBX then gets `501 Not Implemented` on every outgoing call, and the calls don't appear in the Console. Incoming calls keep working.

### Your PBX, or a user on it, is compromised

**To check**, read our email. It names the SIP domain, when the calls started, and what we saw, such as your PBX's software in the calls' `User-Agent`.

**To fix it**, secure the PBX first. See [How do I secure my phone system?](https://enfonica.com/help/security/toll-fraud#secure-your-system) Then turn the trunk back on:

1. In the Console, go to **Cloud SIP**, and open the SIP domain.
2. Under **Termination settings**, set **Call termination mode** to **PSTN Trunk**.
3. Select **Save Changes**.

Our email might list other restrictions, such as a removed incoming call handler or tighter country blocking. Put them back only after you confirm that the unwanted calls have stopped.

## All your services stopped after unexpected calls

If fraudulent calls use up your account's credit limit, the services on that billing account stop. They also stop if we suspend the account to prevent further calls.

### The credit limit was used up, or the account was suspended

**To check**, look for an email from us, or for a message on the **Billing overview** page that says your services are suspended.

**To fix it**, secure the source first, so that the calls don't start again when service returns. Then reply to our email, or contact us to restore service. To learn about credit limits and suspensions, see [Why have my services stopped?](https://enfonica.com/help/billing/services-stopped)

## The Console shows calls that nobody in your business made

If calls appear in **Cloud Voice > Calls** but not in your PBX's own call logs, they still came through your trunk. Usually an extension, a forwarding rule, or a login has been taken over.

### A PBX extension or user has been taken over

**To check**, open the calls' SIP traces. This is the cause if they show your PBX's public IP address, your PBX's `User-Agent`, and a caller ID that belongs to one of your users.

**To fix it**, disable that extension in your PBX. Give it a new, strong password before you turn it back on. If the user's email password is the same, or was exposed, change it too.

### Calls to your number are being forwarded overseas

Attackers sometimes call one of your numbers and use your PBX's forwarding to reach international destinations.

**To check**, look in **Cloud Voice > Calls**. This is the cause if you see a burst of incoming calls to one number at the same time as the outgoing international calls.

**To fix it**, in your PBX, remove forwarding to external numbers that you don't need. Limit international forwarding and dialing to the users who need it.

### Someone signed in to your Console account

**To check**, look in the Console for SIP domains, numbers, service accounts, or users. This is the cause if you find any that nobody in your business created.

**To fix it:**

- Change the Console passwords of everyone with access.
- Turn on two-factor authentication.
- Remove users and service account keys that you don't recognize.
- Secure the email accounts behind those logins as well. A taken-over email account can reset a Console password.

## How do I find where the calls came from?

The SIP trace of a fraudulent call shows which device sent it. Traces are kept for 30 days after the call.

1. In the Console, go to **Cloud Voice > Calls**.
2. Select **Filters**. Under **Direction**, select **OUTGOING**, set the dates, and then select **Apply filters**.
3. Open one of the unexpected calls. Under **SIP Insights**, select **View SIP trace**.
4. In the first request, note the IP address it came from, the `User-Agent` (your PBX's software and version), and the caller ID in `From`, which points to the user or extension.

To learn more about reading a trace, see [Find a call and read its SIP trace](https://enfonica.com/help/call-troubleshooting/find-call-sip-trace).

## How do I secure my phone system?

The fix is almost always in your PBX, your phones, or a login. So you, or whoever manages your PBX, need to make it. To secure your phone system:

- Disable any extension or user that made the calls. Set a new, strong, and unique password before you turn it back on.
- Change your PBX's admin passwords. If the PBX supports two-factor authentication, turn it on.
- Check forwarding rules and the outbound dial plan for international destinations you don't use.
- Update your PBX, phones, and softphones to their latest versions.
- In the Console, add your PBX's public IP address to the SIP domain's IP access control list. If the SIP domain also has users, set new passwords for them, and update your PBX.
- Review **Settings > Users** and **Settings > Service accounts**, and remove anything that you don't recognize.
- Scan the computers of affected users for malware, and change their email passwords.

## Who pays for the fraudulent calls?

Calls that connected before they were blocked went through the phone network like any other call. The carriers they passed through charge for them, so they appear on your invoice. Enfonica's [terms](https://enfonica.com/terms) make each account holder responsible for any use of their account. For a list of the calls, contact us.

## How do I prevent it next time?

Toll fraud prevention is always on, but it can't stop every call. Securing your own environment matters most.

- Turn on two-factor authentication for every project Owner now, so that they can respond as soon as an escalation happens.
- Keep the **Block threshold** at **Block High Risk and above**. If you rarely call overseas, select **Block Elevated and above**.
- Whitelist exact numbers instead of overriding whole countries.
- Protect each SIP domain with an IP access control list. In your PBX, limit international dialing to the users who need it.

Toll fraud prevention covers outgoing calls only. It doesn't protect against schemes that trick people into calling back, such as Wangiri missed calls. To learn about the risk tiers and how attacks work, see [Understanding toll fraud and how to prevent it](https://enfonica.com/blog/understanding-toll-fraud-and-how-to-prevent-it/).

## Still stuck?

Reply to our alert email, or contact us with the details in [What to send us](https://enfonica.com/help/security/toll-fraud#what-to-send-us). We can share the calls and SIP traces we have, and help you work out where the calls came from.

## What to send us

Include these so we can act quickly.

- The project and SIP domain the calls came from.
- When you think the unwanted calls started, with your timezone.
- An example call: the number or country it went to, and the date and time.
- What you have already changed, such as passwords or firewall rules.

[Contact support](https://enfonica.com/contact-support?article=%2Fhelp%2Fsecurity%2Ftoll-fraud&topic=call-fault)

## Related

- [Turn on two-factor authentication](https://enfonica.com/help/security/two-factor-authentication.md)
- [Find a call and read its SIP trace](https://enfonica.com/help/call-troubleshooting/find-call-sip-trace.md)
- [Why have my services stopped?](https://enfonica.com/help/billing/services-stopped.md)
- [Toll fraud prevention (docs)](https://enfonica.com/docs/platform/toll-fraud-prevention/)
- [Understanding toll fraud and how to prevent it](https://enfonica.com/blog/understanding-toll-fraud-and-how-to-prevent-it/)

---

Web version: https://enfonica.com/help/security/toll-fraud