SIP toll fraud and PBX hacking: how hijacked accounts show up in call records

Toll fraud happens when an attacker takes control of a phone system or SIP account and uses it to place calls the owner never intended, usually to expensive destinations. For a VoIP provider, a hijacked customer account can generate a large bill very quickly, often overnight or over a weekend.

How accounts get hijacked

Attackers scan the internet for exposed SIP services and try common or weak credentials. Once an extension or trunk registers, they send calls through it. Other routes in include reused or leaked passwords, misconfigured open trunks, and compromised customer devices. The calls often go to destinations that pay revenue share, which links toll fraud to IRSF.

Warning signs in call records

• An account that is normally quiet suddenly places many outbound calls.
• Calls at hours the customer never uses, such as 3 a.m.
• New destinations or a sudden focus on high-risk countries.
• Many concurrent calls, or a jump in calls per second, from one account.
• Registrations from a new IP address or location, if your switch records it.

Steps providers can take

• Require strong, unique SIP credentials and restrict registrations by IP where practical.
• Disable international calling by default and enable it per customer.
• Apply per-account limits on spend, concurrent calls and calls per second.
• Alert quickly on out-of-pattern behaviour and keep a fast way to suspend an account.
• Tell customers to secure devices, change default passwords and keep firmware updated.

How Smart Gravity Shield approaches hijacked accounts

Because each customer is judged against their own history, a hacked account that starts calling a high-risk destination at 3 a.m. stands out even if its total volume is modest. Smart Gravity Shield scores the change, alerts your team and, where you allow it, can rate-limit or block the account. Whitelists protect trusted traffic, and everything is logged in an audit trail.

Common questions

Who pays for toll fraud?

This depends on the contract. Often the account holder is billed, but providers can end up absorbing losses or disputes, especially with wholesale upstream charges.

Can monitoring alone stop toll fraud?

Monitoring shortens the time before action, which limits the loss. Strong credentials, restricted destinations and spend limits reduce the chance of it starting.

This guide is general information, not legal or security advice. Fraud patterns change, and no detection system catches every case.