Toll Fraud Prevention Checklist

Most users don't need international dialing. Use Dial Permissions in your Manager Portal to disable international and premium-rate calling for every extension that doesn't explicitly require it.

Configure per-user outbound call limits to cap the number of simultaneous calls each extension can make. This limits the damage if credentials are compromised.

1. 1
   Log in to the Manager Portal
2. 2
   Navigate to the user or extension settings
3. 3
   Set a reasonable simultaneous call limit (typically 1–3 for most users)
4. 4
   Save your changes

Every portal account and SIP credential should have a strong, unique password. Avoid reusing passwords across extensions or accounts.

Enable MFA on all Manager Portal accounts. This adds a critical second layer of protection — even if a password is compromised, the attacker still can't log in without the second factor.

1. 1
   Go to your portal account settings
2. 2
   Enable Multi-Factor Authentication
3. 3
   Register your authenticator app or phone number
4. 4
   Verify it works by logging out and back in

Review your Call Detail Records (CDRs) at least weekly. Look for anything unusual — especially calls to unfamiliar international numbers, calls placed outside of business hours, or sudden spikes in volume.

Any extension or device that isn't actively in use is a potential attack vector. Deactivate or remove unused extensions from your system promptly when employees leave or devices are retired.

1. 1
   Identify all active extensions in the Manager Portal
2. 2
   Cross-reference with your current employee roster
3. 3
   Disable or delete any extensions no longer in use
4. 4
   Remove old device registrations

SIP usernames and passwords should never be sent via email, stored in shared spreadsheets, or written on sticky notes. Treat SIP credentials with the same care as banking passwords.

Configure E911 and system alert notifications so that administrators are immediately notified of suspicious activity, such as calls from unexpected locations or after-hours usage.

Watch for these red flags that may indicate your system has been compromised:

• Calls to unusual international destinations — especially countries you don't do business with (e.g., Cuba, Somalia, Latvia, Sierra Leone)
• High call volumes late at night or on weekends — when your office is closed
• Sudden spike in CDR activity — a dramatic increase in the number or duration of outbound calls
• Unfamiliar numbers in call logs — premium-rate or toll numbers you don't recognize
• Multiple simultaneous calls from a single extension — especially one assigned to a single user
• Complaints from your provider about unusual traffic patterns