Toll Fraud Protection

You do, in almost every case. The calls were placed with valid credentials on your account, they were carried across the network, and they were terminated by operators your carrier has already had to pay. Business telecoms contracts generally make the account holder responsible for calls made from the service, whether or not those calls were authorised, and the clause is usually the one about unauthorised or fraudulent use. Read yours before you need it. Some providers set their own spend thresholds and will sometimes discuss sharing the loss, but that is discretion rather than a right and it is not something to build a plan around.

Credentials, nearly always, rather than anything sophisticated. The common routes are a SIP account with a default or guessable password, an extension reachable directly from the internet, a voicemail box whose PIN is still the last four digits of the extension, and a maintenance login set by the installer at handover that nobody has changed since. Once an attacker can authenticate, nothing is being broken. Calls are simply placed with your identity, which is exactly why they look legitimate all the way through to the invoice.

Because volume is the point and interruption is the risk. The money is made per minute on premium-rate and revenue-share international destinations, so an attacker wants as many concurrent calls as possible running for as long as possible. A Friday evening before a bank holiday buys three days before anybody is in the building to hear the phone system running flat out. It is a scheduling decision rather than a technical one. The system is no weaker at 2am, it is just unobserved.

Yes, though the failure mode moves. There is no PBX in your building to compromise, so the exposure shifts to credentials and to the management portal: a user password reused elsewhere and turning up in a breach, an administrator account without multi-factor authentication, or a softphone configuration sitting in a shared folder. Hosted platforms generally have better default protections and better central visibility than an ageing on-premise system, and that genuinely helps. It does not change the underlying position, which is that an attacker holding a valid login is placing calls you will be billed for.

Not entirely, unless you genuinely never call abroad. The useful version is an allow list rather than a blanket block: permit the handful of countries you actually deal with and bar the rest, which keeps the business working and still removes most of the revenue-share destinations. Premium-rate and satellite ranges are the easier decision — very few UK businesses have a legitimate reason to dial either, and those can usually go without an argument.

They are the fraud protection in SCG's Service Assured range — Voice Safe on voice services, VoIP Safe applying the same cover to VoIP. Some of the group's material writes it as Voicesafe; it is the same product. What distinguishes it from monitoring on its own is a credit guarantee against fraudulent call charges, and the terms of that guarantee are the part worth reading rather than assuming. Whether it is worth buying depends on your call profile and on how much the barring has already ruled out, and we would tell you if the answer were no.

Ask for the list of destinations your system is currently permitted to dial, then bar every one you have never used. Most businesses have never legitimately called a premium-rate number, a satellite range or the bulk of the international list, and barring them costs nothing, takes minutes, and removes the profit motive rather than merely watching for it. Change the installer and default passwords in the same sitting. That combination closes the routes behind the large majority of incidents, and it does it before you have spent anything on monitoring.