Home > VoIP Security & Fraud Prevention > Fraud Prevention Configuration Guide

VoIP Fraud Prevention Configuration Guide

Toll fraud rarely looks dramatic at first. A compromised extension or trunk quietly places calls to premium or international destinations, often overnight or over a weekend, and the first sign is a bill far larger than expected. By then the damage is done, and in many agreements the account holder is responsible for charges generated through their own credentials.

The encouraging part is that fraud prevention is mostly a configuration problem, not a product you buy. Each control in this guide removes one path an attacker could use, and together they make your account a much harder and less profitable target. Many of these settings are quick to apply, and most only need to be reviewed periodically once they are in place.

This guide is written as a practical checklist you can follow in order. For background on the threats themselves, see our overview of VoIP fraud prevention. Exact options and menu names depend on your platform and provider, so treat the example values here as starting points to tune for your own call patterns.

1. How VoIP Fraud Usually Happens

Understanding the attack paths makes it clear why each setting matters. Most incidents follow a few familiar patterns.

2. Which Controls Matter Most

Indexed illustration based on common industry practice; the right priority order depends on your environment and risk profile.

3. Step 1: Establish Your Baseline

You cannot spot abnormal activity without knowing what normal looks like. Before configuring limits, use your call detail records to document how your business really calls.

• List the countries and number types you genuinely call each month.
• Record your peak number of simultaneous calls and your typical daily outbound volume.
• Note normal calling hours for each department or extension.
• Identify which numbers receive inbound traffic and at what volume.

4. Step 2: Harden Credentials

Credentials are the first barrier, and the most commonly broken one. Every trunk, extension, and admin account should be treated as a potential entry point.

• Replace every default username and password on phones, gateways, and the PBX.
• Use long, random, unique passwords for each SIP account; never reuse them.
• Enable multi-factor authentication on admin and reseller portals.
• Use separate admin accounts per person rather than a shared login.
• Disable or delete accounts for former staff and retired extensions immediately.

5. Step 3: Restrict Access by IP

Even a stolen password is far less useful if the trunk only accepts traffic from known addresses. IP allowlisting limits who can register and send calls at all.

• Allow only the public IP addresses of your PBX, SBC, or office gateways.
• Update the allowlist whenever your network or provider changes.
• Block SIP traffic from all other addresses at the firewall.
• For remote workers, use a VPN or a registered, controlled IP rather than opening access broadly.

6. Step 4: Control Destinations

Destination control is one of the most effective settings because fraud usually targets a small set of expensive destinations your business never calls. Default to blocking and allow only what you need.

Also review your VoIP invoice for destinations you do not recognize, since they are often the first visible sign that a restriction is missing.

7. Step 5: Set Call Caps and Spend Limits

Caps limit the damage even if every other control fails. They turn a potential multi-thousand-dollar incident into a contained one. Our guide to preventing toll fraud with call caps goes deeper on the reasoning, and the table below summarizes the main cap types.

Tip Set caps using your own baseline, not a generic number. Values that are too tight cause legitimate calls to fail, so review them after campaigns or seasonal changes.

8. Step 6: Apply Time-Based Rules

Fraud often occurs outside business hours when nobody is watching. Time-based rules reduce that window.

• Restrict or disable international dialing outside business hours.
• Apply lower caps overnight and on weekends and holidays.
• Require extra approval or a separate profile for after-hours outbound campaigns.
• Make sure the system time zone is correct so schedules apply when intended.

9. Step 7: Monitor and Alert

Preventive controls need a detection layer. Regular review of call records, plus automatic alerts, shortens the time between an incident and your response from days to minutes.

• Set alerts for spend thresholds, unusual destinations, and sudden volume spikes.
• Review call records daily for unexpected countries, timing, or short repeated calls.
• Watch for spikes in failed registrations, which can indicate guessing attempts.
• Send alerts to more than one person so incidents are not missed.
• Track fraud-related findings alongside your cost optimization strategies so savings and security improvements reinforce each other.

10. Step 8: Protect Inbound and Toll-Free Lines

Fraud is not only outbound. Where inbound minutes are billed to you, abusive inbound traffic can also create cost, and toll-free numbers deserve particular attention. Even legitimate growth can look unusual, as the account of how toll-free increased inbound calls shows, so measure normal volume first and then alert on deviations.

• Track inbound minutes per number and compare against expected volume.
• Set limits or alerts on unusually long or repetitive inbound calls.
• Release inbound numbers you no longer use so they cannot be targeted.
• Review who has permission to change routing and forwarding on each number.

11. Step 9: Prepare an Incident Response Plan

When fraud is suspected, speed matters. A written plan removes hesitation and reduces total cost.

12. Configuration Checklist

• Baseline of normal destinations, volume, and hours documented
• All default and shared credentials replaced; MFA enabled on admin accounts
• IP allowlisting applied to trunks and SIP access
• International and premium dialing disabled by default, allowed only where needed
• Concurrent, daily, and spend limits configured from your baseline
• After-hours restrictions and lower caps in place
• Alerts configured and sent to multiple contacts
• Inbound and toll-free usage tracked per number
• Incident response plan written and shared with the team
• Configuration reviewed on a regular schedule and after any major change

13. Frequently Asked Questions