5 VoIP Security Mistakes That Lead to Toll Fraud

Toll fraud almost never comes from some brilliant, sophisticated attack. Most of the time it comes from a small mistake that sat unnoticed until the bill showed up. The good news hiding in that is simple. If the causes are basic, the fixes usually are too.

Here are five of the most common VoIP security mistakes that open the door to toll fraud, and what to do about each one. If you run a SIP platform, it is worth checking your own setup against this list.

1. Weak or default SIP credentials

This is the big one. Most toll fraud starts with a SIP account whose password was weak, reused, or never changed from the default.

Attackers run automated scanners that hammer exposed SIP servers all day, guessing common passwords. When one works, they are in, and they can place calls that look completely legitimate to your system. No breach, no clever exploit, just a login that should never have been guessable.

Fix it: use long, random passwords for every SIP account and trunk, rotate them, and get rid of any default credentials that shipped with your equipment or software.

2. Leaving SIP services open to the whole internet

A SIP port sitting on the public internet with no restrictions is an open invitation. Within hours of going live, it will start getting probed.

Plenty of platforms expose their SIP service to everyone when they only actually need it reachable from a handful of known places: their own offices, specific trunk providers, a few endpoints. Everything else is just attack surface you did not need.

Fix it: lock down access with IP allowlists wherever you can, so only trusted addresses can even reach your SIP service. If something has no reason to talk to your platform, it should not be able to.

3. Dial plans that allow calls you never make

Here is a quiet one. A lot of systems are set up to allow calling anywhere, to any country, at any rate, simply because nobody ever restricted it.

That is exactly what attackers exploit. Toll fraud, and IRSF (International Revenue Share Fraud) in particular, depends on reaching expensive premium-rate and international destinations. If your platform never calls those places anyway, leaving them open is pure risk for zero benefit.

Fix it: restrict outbound dialing to the destinations you actually use. Block premium-rate ranges and high-risk countries you have no reason to call. You can always open one back up later if a genuine need appears.

4. No limits on calls or spend

Even when an attacker does get in, limits are what stop one compromised account from running up thousands of dollars in an afternoon.

Many platforms have none. No cap on how many calls one account can place at once, no ceiling on spend, nothing to slow a sudden flood of traffic. So when fraud starts, there is nothing standing between the attacker and your telecom bill.

Fix it: set concurrency limits per account, cap how much any account can spend in a given window, and trigger automatic suspension when those limits are crossed. These are the financial brakes that keep a bad night from turning into a disaster.

5. Only finding out at billing time

The last mistake is not a config gap. It is simply not watching.

If the first you hear of fraud is when the invoice lands, the money is already gone. The calls connected, the minutes were real, and there is rarely a refund. By that point it is a cleanup job, not a prevention one.

Fix it: monitor call activity in real time instead of monthly. Watch for the obvious tells, a sudden spike in international calls, long calls to premium numbers, odd activity at 2am on a weekend, and set alerts that fire while an attack is happening rather than after.

The pattern behind all five

Notice what these have in common, Not one of them is exotic. They are all small, boring gaps that are easy to leave open and just as easy to close. That is really the whole story of toll fraud. It wins on thin defenses, not on clever attackers.

Good VoIP security is layered. No single fix catches everything, but stacked together, strong credentials, locked-down access, sensible dialing limits, spend caps, and real-time monitoring, they make your SIP platform a far harder target than the one next door.

If you want the deeper version, with the detection signals, the layered controls across your SBC and softswitch, and what to do during an active attack, there is a full guide on how to stop toll fraud and IRSF on SIP platforms that walks through all of it, just comment for it.

Go check your own setup against these five. Most toll fraud is preventable, and usually the fix was sitting there the whole time.