Toll fraud is the most expensive thing that can happen to a phone system: someone gains access and makes international or premium calls on your lines, and you receive the bill. Weak passwords, open settings and unrestricted dialling make it possible. This guide explains how to secure an IP PBX, using the controls in Voxdial IP PBX.
How PBX toll fraud happens
- Weak extension passwords let outsiders register a phone as one of your extensions.
- Unrestricted dialling lets any extension call international numbers.
- Weak voicemail PINs and default passwords on gateways and phones.
- Anonymous SIP calls accepted from the internet.
- Admin accounts shared or left with too many rights.
- No monitoring, so the abuse runs for days before anyone notices.
1. Restrict who can dial what
- Give each extension a class of service: local only, national or international.
- Allow international only for the few extensions that need it.
- Limit costly routes to office hours with a time group, so nothing goes out at night.
- Ask for a route PIN on international or other costly routes.
- Set the maximum channels on each trunk, so abuse cannot use every line at once.
2. Lock down registrations and SIP
- Use long, random extension passwords; never the extension number.
- Turn off anonymous inbound SIP calls. Voxdial notes that turning this off improves security.
- Use secure transports: TLS for phones, and secure WebSocket (WSS) for browser phones.
- Install a trusted certificate for production rather than a self-signed one.
- Change default passwords on analog gateways from the PBX on day one.
3. Protect voicemail
- Require a minimum voicemail PIN length.
- Limit failed PIN attempts; Voxdial disconnects callers after the set number of failures.
- Allow checking a mailbox only from its own extension where suitable.
4. Control admin access
- Create user groups such as Supervisors and Admins with only the permissions each needs.
- Give every administrator their own login; no shared accounts.
- Review the activity log: every sign-in, add, edit and delete, with time, user and IP address. Entries cannot be edited or removed.
5. Watch for unusual calls
- Check the status page for unexpected extensions online.
- Review long outbound calls in call statistics weekly.
- Watch the live calls list for international calls at odd hours.
- Block abusive callers with the blacklist.
6. Keep backups
Schedule backups to an off-site location, so you can restore a clean configuration quickly if something is changed.
Security checklist
| Area | Check |
|---|---|
| Dialling | Class of service per extension; international only where needed |
| Routes | Time groups and PINs on costly routes; trunk channel limits |
| SIP | Strong passwords; anonymous calls off; TLS and WSS |
| Devices | Default gateway and phone passwords changed |
| Voicemail | Minimum PIN length; failed attempt limit |
| Admins | Own logins; least permissions; activity log reviewed |
| Monitoring | Long calls and live calls checked |
| Recovery | Off-site backups scheduled |
BitVoice sets up these controls on every Voxdial installation and supports customers 24X7. See the full installation checklist or talk to us.
FAQs
What is PBX toll fraud?
It is when someone misuses a business phone system to make calls, usually international or premium calls, that the business has to pay for.
How do I stop international calls from my PBX?
Give extensions a class of service without international access, limit international routes to office hours, and require a PIN for them.
Why should anonymous SIP calls be turned off?
Accepting anonymous SIP calls from the internet exposes the PBX to unwanted calls and abuse. Turning it off improves security.
How can I see who changed my PBX settings?
Voxdial’s activity log records every admin sign-in, add, edit and delete, with time, user and IP address, and entries cannot be changed.
