It usually starts on a Friday evening and is discovered on Monday morning. Somebody gets into a business phone system, points it at expensive international numbers and leaves it dialling all weekend. By the time anyone notices, the call charges can run into four figures. Here is how it happens, how to make your system a poor target, and the part nobody enjoys explaining: who ends up paying for it.
The 30-second version
- Fraudsters do not want your data. They want your dial tone, pointed at numbers that pay them a share of the call cost.
- It happens out of hours deliberately, because a long weekend is the longest run they will get before anyone notices.
- Weak passwords on extensions and voicemail are the usual way in, not some sophisticated attack.
- The calls are real calls, so the charges are real charges. This is the uncomfortable bit, covered below.
- Monitoring shortens the damage, it does not prevent it. Anyone telling you otherwise is overselling.
- Barring the destinations you never ring is the single most effective control, and it costs nothing.
On this page
What phone system fraud actually is
Most people picture fraud as someone stealing information. This is not that. The target is your ability to make calls, and the business model is simple enough that it has barely changed in twenty years.
Certain phone numbers pay a share of the call revenue to whoever owns them. Some are premium rate numbers, others are ordinary looking international numbers in countries where the termination rate is high. A fraudster registers or rents those numbers, then finds a phone system they can make calls from, and dials their own numbers continuously. Every minute of connected call is money to them, and cost to whoever owns the system.
Nothing is stolen in the sense people expect. No files are taken. The system simply makes thousands of calls it was never meant to make.
How they get in
Almost none of this is clever. It is automated scanning looking for the same handful of weaknesses, over and over, across the whole internet.
- Weak or default extension passwords. An extension with a password of 1234, or the extension number itself, is found within hours of going live.
- Voicemail PINs left at default. Voicemail systems can often dial out. A default PIN is a dial tone with a bow on it.
- A system reachable from anywhere. If the phone system accepts registrations from any address on the internet rather than the places your people actually are, the attack surface is the whole world.
- Credentials reused or shared. One password that has appeared in a breach elsewhere, used again on a handset, is enough.
- A handset or softphone on a compromised machine. If a laptop running a softphone is infected, the credentials on it are available too.
- Ports opened and forgotten. A temporary rule added during an install years ago, never removed.
The common thread
Every one of those is a configuration or housekeeping issue rather than a flaw in the phone system itself. That is genuinely good news, because it means the fixes are things you can actually do, and most of them take minutes.
Why it always happens at the weekend
The timing is not luck. A fraudster wants the longest possible run between the first call and somebody noticing, because the fraud only pays while the calls are connected.
A Friday evening start on a bank holiday weekend can mean seventy two hours of unattended dialling. They will often run many calls in parallel rather than one after another, so the total is not one call for three days, it is dozens of simultaneous calls for three days. That is how the numbers get large so quickly.
It is also why the first sign is frequently not a security alert but a phone system that sounds busy, or staff reporting they cannot get an outside line on Monday because every channel is in use.
Who pays for the calls
This is the part we would rather not have to write, and the part most providers leave for you to discover at the worst possible moment.
The calls are genuine calls, carried by real carriers, and somebody has to pay for them. The carrier bills us, and our terms pass that cost to the account holder. This is standard across the industry rather than something unusual to us, and you will find the same position in the terms of essentially every UK provider.
Our terms and conditions set this out at clause 15. Fraudulent activity expressly includes calls made from your system without your knowledge and calls made using your authentication details, and responsibility for securing the system sits with the customer. We are telling you here, in plain language and before anything happens, because finding out from a contract clause after a four figure bill is a horrible way to learn it.
What we will do is move quickly. If we spot it, we will stop it, bar the destinations and work through the call records with you. Where there is a case to take back to a carrier we will make it. We cannot promise the charges disappear, and we will not pretend otherwise.
What fraud monitoring does, and does not, do
We offer a fraud monitor on our platform, and it is worth having. It is also worth being precise about what it is.
| Fraud monitoring | What that means in practice |
|---|---|
| Is a detection system | It watches call patterns and flags behaviour that does not look like you: sudden volume, unusual destinations, calls at hours you do not trade. |
| Is not a prevention system | It does not stop someone getting in. It shortens how long they are in once they are. |
| Reduces the size of the bill | The difference between an hour of fraud and a weekend of it is the whole difference in cost. |
| Does not replace your own security | Passwords, firewalls and keeping handsets patched remain yours to manage, and our terms say so explicitly. |
Any provider who tells you their monitoring means fraud cannot happen to you is selling you something. Detection is genuinely valuable. It is not a wall.
Seven things that make you a poor target
Fraud is opportunistic. It goes where it is easy. These are in rough order of how much they buy you for the effort involved.
- Bar the destinations you never call. Most UK businesses never dial satellite, premium rate, or a long list of international destinations. Barring them outright removes the profit motive entirely. This is the single highest value thing on the list and it costs nothing.
- Set a spend cap or call limit. A ceiling on what can be spent in a day turns a catastrophe into an annoyance.
- Change every default password, on extensions, on voicemail and on the admin interface. Then make them long and unique rather than memorable.
- Restrict where the system accepts registrations from. If your people are in one building and on known mobiles, the system does not need to answer the rest of the internet.
- Turn off what you do not use. Voicemail to outside line, call forwarding to external numbers, remote access features nobody has touched in years.
- Review your call records monthly. Not forensically. Just look at the destinations and ask whether they make sense.
- Keep handsets and firmware updated, and remove extensions for people who have left. A live extension nobody owns is nobody's responsibility to notice.
Not sure how exposed your system is?
We will look at how yours is configured, tell you which destinations are currently open, and set barring and limits that match how you actually trade. If you are not our customer we will still tell you what we find.
If you think it is happening right now
- Call us immediately on 0151 230 3949. Speed is the only variable you still control. Do not email and wait.
- Do not reboot the phone system first. It will not stop the calls if the credentials are compromised, and it destroys the logs that show what happened.
- Change the passwords on any extension you suspect, and the admin password.
- Expect us to bar outbound international calling while we work out the scope. It is disruptive and it is the right call.
- Report it to Action Fraud. Our terms ask you to report it to the Police, and if there is any prospect of recovering money or challenging charges, a crime reference number is usually the thing that is asked for first.