🛡️ Rate Limiting: Preventing Toll Fraud with Call Caps
Summary: Toll fraud is one of the most financially damaging VoIP attacks—a single weekend of undetected fraud can generate five-figure losses. Rate limiting and call caps are your first line of defense. This guide covers everything you need to know: what rate limiting is, the different types of call caps you can set (concurrent, per-second, 24-hour spend), how to implement them across your SIP trunk, PBX, and SBC, and best practices to stop fraudsters in their tracks.
📖 Table of Contents
- 1. What is Rate Limiting?
- 2. Understanding Toll Fraud
- 3. Types of Call Caps & Rate Limits
- 4. Implementation: Where & How
- 5. Provider-Level Rate Limits
- 6. PBX & Firewall Rate Limits
- 7. SBC & Gateway Rate Limits
- 8. Credit Locking & Spend Limits
- 9. Monitoring & Alerting
- 10. Best Practices
- 11. Frequently Asked Questions
- 12. Related Resources
🔍 What is Rate Limiting?
Rate limiting is a security control that restricts the number of calls, registrations, or SIP messages that can be processed within a specific time frame [citation:4][citation:7]. By setting caps on concurrent calls, per-second INVITE rates, and 24-hour spend limits, you prevent fraudsters from generating massive call volumes to premium-rate numbers [citation:1][citation:3]. If an attacker tries to exceed these thresholds, the system automatically rejects the calls, stopping toll fraud in its tracks [citation:1][citation:2].
Rate limiting is one of the most effective ways to stop automated toll fraud attacks before they cause financial damage
Source: DIDWW Outbound Trunk Security Documentation [citation:3]
🔹 How Rate Limiting Works
- Defines maximum thresholds for call volume, registrations, or SIP messages
- Monitors traffic in real-time against these thresholds [citation:1]
- Automatically rejects or blocks traffic that exceeds limits [citation:1][citation:4]
- Can be configured at provider, PBX, and SBC levels [citation:3][citation:7][citation:10]
⚠️ Why Rate Limiting Matters
- Toll fraud exploits unlimited dialing privileges to generate high-cost calls [citation:3]
- Automated attacks can generate hundreds of calls per second [citation:4]
- Financial impact: A single weekend can generate five-figure losses [citation:3]
- Rate limiting stops the attack at the network level [citation:1]
⚠️ Understanding Toll Fraud
Toll fraud—also known as International Revenue Share Fraud (IRSF)—is the most financially damaging VoIP attack. Attackers gain unauthorized access to telecommunication services and generate high volumes of calls or messages to international or premium-rate numbers they control [citation:1][citation:5].
🔹 How Toll Fraud Works
- Attackers exploit your authentication flow or exposed SIP ports [citation:5]
- They generate calls to premium-rate numbers they own [citation:1]
- The fraudster takes a cut of the revenue from these calls [citation:5]
- Your business bears the entire financial cost [citation:5][citation:12]
🔹 Common Attack Vectors
- Brute force on SIP credentials [citation:3]
- Credential stuffing from data breaches [citation:3]
- Exposed SIP ports (5060/5061) without ACLs [citation:6]
- Bypassing call agents to address PSTN gateways directly [citation:6]
⚠️ Critical: Fraudsters target international and premium-rate numbers because each call generates revenue for them. Without rate limiting, a single compromised account can cause catastrophic financial losses [citation:3][citation:12].
🚀 Need Help Protecting Your VoIP System from Toll Fraud? NetviaVoice Can Help
Our security experts can help you implement rate limiting, call caps, and credit locking to protect your business from toll fraud.
Visit NetviaVoice📊 Types of Call Caps & Rate Limits
Different types of rate limits protect against different attack vectors. Here's what you should configure:
| Limit Type | Description | Best Practice |
|---|---|---|
| Concurrent Call Cap | Maximum simultaneous calls per trunk or extension [citation:3][citation:10] | Set based on your normal traffic baseline [citation:3] |
| Per-Second Rate Limit | Maximum INVITE messages per second from a single IP [citation:4][citation:7] | 10-30 requests/sec for most businesses [citation:11] |
| 24-Hour Spend Limit | Maximum dollar amount per trunk within a rolling 24-hour period [citation:3] | Set based on your average daily spend + buffer [citation:3] |
| Registration Rate Limit | Maximum REGISTER attempts per second [citation:2][citation:9] | Prevents brute-force attacks on credentials |
| Per-Destination Rate Limit | Maximum calls to specific destinations (international, premium) [citation:3] | Disable international calling by default [citation:10] |
| Duration Limit | Maximum call duration per call [citation:7] | Prevents extremely long fraudulent calls |
💡 Key Insight: Rate limits should be based on your normal traffic patterns. Start with conservative limits and adjust as you monitor legitimate usage [citation:3].
🛠️ Implementation: Where & How to Set Rate Limits
Rate limiting should be implemented at multiple layers for defense-in-depth:
🔹 Provider Level
- Concurrent call caps per trunk [citation:3]
- 24-hour spending limits [citation:3]
- Usage notifications at 80% of limit [citation:3]
- International calling restrictions [citation:3]
🔹 PBX / Firewall Level
- Per-second SIP request limits [citation:7][citation:11]
- IP whitelisting & blacklisting [citation:7]
- DoS protection with iptables [citation:7]
- Known attack signature blocking (SIPVicious, Friendly-Scanner) [citation:7]
🔹 SBC / Gateway Level
- Explicit inbound/outbound dial-peers [citation:6]
- IP Trust List for allowed sources [citation:6]
- Trunk access codes for expensive destinations [citation:6]
- CDR monitoring for unusual patterns [citation:6]
🔹 User / Account Level
- Individual user credit limits [citation:8]
- Automatic credit locking [citation:8]
- Per-extension call caps [citation:8]
- Multi-factor authentication [citation:3]
📞 Provider-Level Rate Limits
Most SIP trunk providers offer built-in rate limiting features. Here are the key controls to configure:
| Provider Feature | Description | Why It Matters |
|---|---|---|
| 24-Hour Limit (USD) | Maximum funds allowed per trunk within a rolling 24-hour period [citation:3] | Once reached, the trunk is blocked—stopping further fraud [citation:3] |
| Capacity Limit | Restricts maximum number of simultaneous outbound calls [citation:3] | Prevents unexpected call bursts and limits abuse [citation:3] |
| Usage Notifications | Sends email when 80% of limit is reached [citation:3] | Early warning to investigate abnormal activity [citation:3] |
| Digest Authentication | Requires valid username/password for every SIP request [citation:3] | Adds a second layer beyond IP whitelisting [citation:3] |
⚠️ Important: Active calls are disconnected shortly after the spending limit is reached. The final billed amount may slightly exceed the configured 24-hour limit [citation:3].
🖥️ PBX & Firewall Rate Limits
PBX systems and firewalls provide additional rate limiting capabilities:
🔹 FreeSWITCH Rate Limiting
FreeSWITCH security applications support rate limiting with configurable thresholds:
🔹 CoreDial Firewall Rate Limits
CoreDial's firewall allows administrators to set Call Rate Limits using IPTables rules that limit the rate at which particular SIP message types are accepted [citation:7]:
- Set different limits for internal vs. external IP ranges [citation:7]
- Whitelist trusted IPs (e.g., call center predictive dialers) [citation:7]
- Blacklist known attackers [citation:7]
- Log dropped packets for analysis [citation:7]
🔹 Recommended Per-Second Limits
| Environment | Recommended Limit | Notes |
|---|---|---|
| Small Office (<50 devices) | 10 requests/sec [citation:11] | Basic protection for small deployments |
| Standard Business (50-200 devices) | 30 requests/sec [citation:11] | Default protection for most businesses |
| Large Organization (200-500 devices) | 100 requests/sec [citation:11] | Higher capacity for larger deployments |
| Call Centers & Providers | 300 requests/sec [citation:11] | High-volume environments with legitimate bursts |
⚠️ Important: A value that is too low can block legitimate traffic during mass device re-registration after a reboot. Consider the number of SIP devices in your network [citation:11].
🔧 SBC & Gateway Rate Limits
Session Border Controllers (SBCs) and gateways provide additional security controls to prevent toll fraud [citation:6]:
- 1 Use explicit dial-peers—avoid default incoming dial-peer 0 which is promiscuous and allows all incoming connections [citation:6]
- 2 Configure trunk access codes for expensive destinations (international, premium) [citation:6]
- 3 Close unused SIP ports and transport mechanisms—UDP and TCP ports should be restricted [citation:6]
- 4 Enable IP Trust List—only allow connections from trusted IPs [citation:6]
- 5 Monitor CDRs from the gateway/SBC itself—some fraudsters bypass the call agent entirely [citation:6]
💡 Pro Tip: Some toll fraud hackers bypass the enterprise call agent and address fraudulent calls directly to the PRI gateway or SBC—monitoring CDR from the gateway itself is essential to detect these call patterns [citation:6].
🔒 Credit Locking & Spend Limits
Credit locking provides a financial failsafe when rate limits aren't enough. If a user or business exceeds their credit limit, the system automatically bars outgoing calls [citation:8].
🔹 How Credit Locking Works
- Users receive email alerts at 80% of their limit [citation:8]
- Once the limit is reached, the account is locked [citation:8]
- All devices are barred and active calls are terminated [citation:8]
- Users cannot make new calls while the lock is active [citation:8]
🔹 Supported Features
- Business-level and user-level credit locking [citation:8]
- Customizable email alerts (by percentage of spend) [citation:8]
- Automatic reset at the end of the month [citation:8]
- 24/7 access to the credit locking feature [citation:8]
- Emergency calls (e.g., 999) can still be made [citation:8]
⚠️ Important: CDRs are rated in real-time, but depending on time of day, the lag can be between 15 minutes and 75 minutes [citation:8]. This means there is a window between spending and credit locking—rate limiting should be your primary defense.
📊 Monitoring & Alerting
Real-time monitoring and alerting are critical for catching fraud before it escalates [citation:1][citation:6].
🔹 What to Monitor
- Call volume spikes to international/premium numbers [citation:1][citation:6]
- Multiple failed registration attempts from unknown IPs [citation:2][citation:9]
- Calls at unusual hours (weekends, nights) [citation:3]
- Sudden drops in OTP conversion rates [citation:12]
- Unusual IP locations or VPN usage [citation:12]
🔹 How to Respond
- Enable automatic alerts for suspicious activity [citation:1]
- Set up usage triggers at 80% of limits [citation:3][citation:8]
- Implement geographic permissions to restrict destination countries [citation:12]
- Use real-time fraud guard systems with automatic blocking [citation:1]
💡 Pro Tip: Time is critically important when a fraudulent incident occurs. The sooner one acts, the better chance they have to mitigate possible losses. Enable fraud prevention notifications to alert customers and administrators immediately [citation:3].
🏆 Rate Limiting Best Practices
✅ Immediate Actions
- Set concurrent call caps per trunk [citation:3][citation:10]
- Configure 24-hour spending limits [citation:3]
- Disable international calling by default [citation:10]
- Enable digest authentication + IP whitelisting [citation:3]
- Implement per-second SIP request limits [citation:7][citation:11]
✅ Ongoing Management
- Review call activity regularly [citation:3][citation:6]
- Update firmware on all VoIP equipment [citation:3]
- Audit user accounts—remove ex-employees [citation:3]
- Monitor CDRs for unusual patterns [citation:6]
- Educate staff on credential handling [citation:3]
✅ Advanced Protection
- Implement machine learning for anomaly detection [citation:5]
- Use risk-aware rate limits [citation:5]
- Enable geographic permissions [citation:12]
- Set up VPN and proxy detection [citation:12]
- Implement exponential delays between retries [citation:12]
✅ What to Avoid
- Don't use default administrative passwords [citation:3]
- Don't leave unused SIP ports open [citation:6]
- Don't allow connections from "unknown" sources [citation:6]
- Don't ignore usage notifications [citation:3]
- Don't skip regular security audits [citation:3]
❓ Frequently Asked Questions
Rate limiting restricts the number of calls, registrations, or SIP messages that can be processed within a specific time frame [citation:4][citation:7]. By setting caps on concurrent calls, per-second INVITE rates, and 24-hour spend limits, you prevent fraudsters from generating massive call volumes to premium-rate numbers [citation:1][citation:3]. If an attacker tries to exceed these thresholds, the system automatically rejects the calls, stopping toll fraud in its tracks [citation:1][citation:2].
Key limits include: concurrent call caps (maximum simultaneous calls per trunk), per-second SIP request limits (e.g., 5-10 INVITEs/sec), 24-hour spending limits (USD cap per trunk), international call restrictions, and per-destination rate limits [citation:3][citation:10][citation:7]. Many providers also offer automatic credit locking when a user reaches 80% of their limit [citation:8].
Rate limiting can be configured at multiple levels: at your SIP provider's portal (set concurrent call caps, 24-hour spending limits), on your PBX (configure call rate limits in firewall settings), and on your SBC (define INVITE thresholds) [citation:3][citation:7][citation:10]. Most providers offer customizable settings for fraud prevention [citation:1].
Rate limiting proactively restricts call volume in real-time—rejecting calls that exceed thresholds [citation:4][citation:7]. Credit locking is a reactive measure that bars an account after a spend limit is reached [citation:8]. Both work together: rate limiting stops the attack at the network level, while credit locking provides a financial failsafe if an attack slips through [citation:3][citation:8].
Key warning signs include: sudden spikes in call volume to international or premium-rate numbers, multiple failed registration attempts from unknown IPs, calls at unusual hours, and a drop in your call conversion rates [citation:1][citation:5][citation:12]. Use real-time monitoring and CDR analysis to detect these patterns early [citation:6].
📢 Ready to implement rate limiting and protect your business from toll fraud? Let NetviaVoice help you secure your VoIP system.