The most expensive thing that can happen to a PBX is not downtime, it is a phone bill you did not make. Toll fraud is automated, it runs while your office is closed, and a single quiet weekend can cost five figures. The good news is that the attack is predictable, so the defense can be too. Here is how it works and the layers that stop it.
How the attack works
None of this is clever. Bots sweep the internet looking for SIP on port 5060, brute-force weak extension passwords, register as a legitimate extension once they get in, and then dial premium-rate and international numbers they profit from. The chain runs in minutes and repeats all night.
The numbers are worth sitting with. Telecom fraud losses run to roughly thirty-nine billion dollars a year, and many victims only find out when an automated carrier alert fires after the damage is done. If your PBX faces the public internet with default settings, you are already on the list that gets scanned.
Six layers that stop it
No single setting is enough, but stacked together they turn a cracked password into a dead end instead of an open account.
Start with strong SIP passwords, long and random, one per extension, with no defaults and no using the extension number as the password. Then close port 5060 to the open internet: firewall it, allow-list the IPs that need it, or put a session border controller in front. Require authentication on outbound calls so the system fails closed rather than open. Add per-tenant spend caps and rate limits so a compromise cannot run up an unbounded bill. Block high-risk destinations by default, the premium-rate ranges and countries you never call. And watch for spikes, odd volume, off-hours calling, or a brand new destination, with the ability to auto-suspend an extension that starts behaving like a bot.
Multi-tenant raises the stakes
If you run a multi-tenant PBX, one weak tenant should never be able to spend the whole platform’s credit. Caps, route rules and monitoring belong at the tenant level, not just the system level, so a single careless customer cannot become everyone’s problem. This is exactly the kind of control a white-label platform needs to make its own.
FAQ
Does STIR/SHAKEN stop toll fraud? No. It targets caller ID spoofing on the network, not fraudulent outbound calls from a compromised PBX. You still need the layers above.
How fast can a weak password be cracked? Automated tools test thousands of combinations, and a default or weak password often falls within minutes.
What is the single most important step? Getting SIP off the open internet. Closing or filtering port 5060 removes most of the automated attack surface at once.
Why do spend caps matter if I have strong passwords? Because they bound the damage if anything else slips. A cap turns a five-figure weekend into a small, contained alert.
How would I even know it is happening? Only if you watch for it. Spike alerts on volume and destination are what turn a silent bill into an early warning.
Toll fraud is a numbers game the attackers play at scale. Make your PBX a bad bet, and they move on to an easier one.