Destination Blocking:
Expensive Blocked International Calls
How to configure destination blocking on your SIP trunk and PBX system to prevent unauthorized international calls, eliminate toll fraud, and take full control of your telecom costs.
Unexpected international call charges are one of the most damaging — and most preventable — telecom surprises a business can face. Whether caused by employee misuse, misconfigured systems, or sophisticated toll fraud attacks, uncontrolled international calling can cost businesses thousands of dollars overnight. This guide covers every layer of destination blocking: what it is, which destinations are highest risk, how to implement blocking in Asterisk, FreePBX, 3CX, and at the SIP trunk provider level, how to create whitelist-based calling policies, and how to build a complete call cost control framework that protects your business 24/7.
- What Is Destination Blocking and Why Does It Matter?
- The Real Cost of Unblocked International Calls
- Highest-Risk Destinations to Block Immediately
- 6 Methods to Block International Calls
- Destination Blocking in Asterisk & FreePBX
- Blocking in 3CX and Cloud PBX Systems
- SIP Trunk Provider-Level Blocking
- Whitelist Strategy: Allow Only What You Need
- Real-Time Monitoring & Auto-Block Alerts
- Complete Destination Blocking Checklist
- Frequently Asked Questions
🚫 What Is Destination Blocking and Why Does It Matter?
Destination blocking is a configuration-level rule applied to your VoIP phone system, PBX, or SIP trunk that prevents calls from being placed to specific phone number prefixes, countries, or number ranges. When a user dials a restricted number, the call is rejected before it ever connects — producing a busy tone or a configurable announcement explaining the restriction.
In the context of business telecommunications, destination blocking is the primary defense against two distinct threats: internal cost creep (employees making expensive personal international calls on company lines) and external toll fraud (hackers compromising your SIP credentials and using your account to make thousands of calls to premium-rate numbers at your expense).
The business case for destination blocking is overwhelming. International calls — particularly to satellite phones, certain Caribbean and Pacific island nations, and premium-rate number ranges — can cost $1.00–$9.00 per minute or more. A single compromised SIP account making calls over a weekend can accumulate bills of $5,000–$50,000 before anyone notices Monday morning. Destination blocking stops this at the source, regardless of how the call was initiated or by whom.
Stop Expensive Calls Before They Happen
NetViaVoice configures destination blocking, call caps, and fraud detection on your SIP trunk — protecting your business around the clock.
💸 The Real Cost of Unblocked International Calls
Understanding the financial exposure from unblocked international destinations is essential context for any destination blocking policy. Not all international calls are equally expensive — the variation is dramatic, and the most expensive destinations are often those targeted by toll fraud schemes.
Compromised SIP Credentials
Attacker brute-forces weak SIP password. Dials premium-rate numbers all weekend undetected.
$8,000–$50,000 lossEmployee Personal Calls
Staff member calls family in high-rate country. Billed to company without awareness.
$200–$2,000/monthMisconfigured IVR
IVR allows callers to dial out internationally through an unguarded dialthrough vulnerability.
$1,000–$20,000 loss⚠️ Highest-Risk Destinations to Block Immediately
Not every international destination needs to be blocked — but certain prefixes and country codes are so consistently associated with toll fraud and premium-rate exploitation that they should be blocked by default for any US business that doesn't have a specific operational need to call them.
| Destination / Prefix | Country / Type | Typical Rate | Fraud Risk | Action |
|---|---|---|---|---|
| +881, +882, +883 | Satellite phones (Iridium, Inmarsat) | $3–$9/min | Extreme | Block for all users |
| +900 (US premium) | US Premium Rate Services | $1–$5/min | Extreme | Block for all users |
| +1-900 | US 900 premium numbers | $1–$10/min | Extreme | Block for all users |
| +357 99x | Cyprus premium mobile | $1–$3/min | Extreme | Block unless Cyprus needed |
| +676, +677, +678 | Tonga, Solomon Islands, Vanuatu | $0.50–$2/min | Extreme | Block for all users |
| +1-268, +1-473, +1-767 | Caribbean NANP (Antigua, Grenada) | $0.25–$1/min | High | Block unless Caribbean ops |
| +232, +234, +255 | Sierra Leone, Nigeria, Tanzania | $0.10–$0.50/min | High | Block unless Africa ops needed |
| +0900 (international premium) | Various premium service codes | $1–$5/min | High | Block globally |
| +86 (China) | China mainland | $0.02–$0.10/min | Medium | Block unless China ops |
| +7 (Russia) | Russia | $0.05–$0.20/min | Medium | Block unless Russia needed |
🔧 6 Methods to Block International Calls
Dialplan Prefix Blocking
Block calls at the PBX dialplan level by rejecting any dialed number matching a specific prefix pattern. Most flexible and granular method — works in Asterisk, FreePBX, and most IP-PBX platforms.
Country Code Blocking
Block all calls to specific country codes (e.g., deny all calls starting with +234 for Nigeria). Maintained as a list in your PBX or SIP trunk portal — easy to manage and update.
Per-User / Extension Policies
Set different calling permissions per extension. Reception desk: domestic only. Sales team: North America + Europe. CEO: unrestricted. Granular control without blanket blocking.
Call Spend Caps
Set maximum daily or monthly spend limits per extension or account. When the cap is reached, outbound calls are blocked automatically until reset. Complements destination blocking.
Time-of-Day Blocking
Block all international calls outside business hours (evenings, weekends). Since most fraud happens when no one is monitoring, after-hours blocking eliminates a major attack window.
Whitelist-Only Mode
Block everything by default — only allow calling to explicitly approved country codes or number ranges. Zero-trust calling policy — the most secure approach for high-risk businesses.
⚙️ Destination Blocking in Asterisk & FreePBX
In Asterisk, destination blocking is implemented in the dialplan — in extensions.conf — by matching called number patterns and sending blocked calls to a Hangup() or Busy() application before they reach the outbound trunk context. Here's how to implement it:
; ─── Context: outbound-restrictions ───────────────────────── [outbound-restrictions] ; BLOCK: Satellite phones (+881, +882, +883) exten=>_011881.,1,Playback(this-call-cannot-completed) same=>n,Hangup(21) exten=>_011882.,1,Playback(this-call-cannot-completed) same=>n,Hangup(21) ; BLOCK: US 900 premium numbers exten=>_1900.,1,Playback(blocked-number) same=>n,Hangup(21) exten=>_900.,1,Playback(blocked-number) same=>n,Hangup(21) ; BLOCK: Specific high-fraud countries (Nigeria +234, etc.) exten=>_011234.,1,Playback(call-not-permitted) same=>n,Hangup(21) exten=>_011676.,1,Playback(call-not-permitted) same=>n,Hangup(21) ; BLOCK: ALL international (everything starting with 011) ; Use this for maximum protection — allow only domestic exten=>_011.,1,NoOp(International call blocked: ${EXTEN}) same=>n,Playback(international-calls-not-permitted) same=>n,Hangup(21) ; ALLOW: Everything else (domestic US/Canada) include=>outbound-allowed
FreePBX GUI Method — Outbound Route Restrictions
📍 FreePBX Destination Blocking Navigation
- Connectivity → Outbound Routes → [Route Name] → Dial Patterns tab: Add patterns that should be BLOCKED and point them to a Termination/Reject destination instead of a trunk
- Admin → User Management → User Groups → Calling Permissions: Restrict international calling per user group — accounts, reception, sales, executives
- Admin → Call Barring: FreePBX Pro feature for easy country-level blocking via checkbox interface
- Applications → Blacklist: Add specific international numbers that should never be dialed — works on both inbound and outbound
- For time-based blocking: Admin → Time Conditions — create "After Hours" condition that routes outbound international to a blocked context
🖥️ Blocking in 3CX and Cloud PBX Systems
| Platform | Blocking Feature Location | Blocking Capability | Granularity |
|---|---|---|---|
| 3CX PBX | Admin Console → Users → Call Permissions | International on/off per extension group; country-level via outbound rules | High |
| 3CX (Outbound Rules) | Admin → Outbound Rules → Prefix filter | Block by dialed prefix — e.g., block all 011 calls | High |
| Hosted PBX (generic) | Admin Portal → Call Controls → Outbound Restrictions | Country toggle or prefix deny list | Medium |
| Microsoft Teams (Direct Routing) | Teams Admin Center → Voice → Calling Policies | Per-user calling policy; restrict to domestic only | High |
| Grandstream UCM | PBX → Outbound Routes → Outbound Blacklist | Prefix-based blocking with scheduling support | Medium |
| Cisco CUCM | Call Routing → Route Pattern → Block pattern | Pattern-based blocking per partition and CSS | Very High |
🌐 SIP Trunk Provider-Level Blocking
The most robust destination blocking strategy includes controls at the SIP trunk provider level — not just at the PBX. Provider-level blocking is enforced on our infrastructure before calls even leave the network, meaning it cannot be bypassed by dialplan errors, misconfigured call forwarding, or compromised PBX credentials.
🛡️ What NetViaVoice Provides at the Provider Level
- Country-level destination blocking: We block entire country codes from your account — calls to blocked countries never traverse our network
- Prefix-level blocking: Block specific prefixes (e.g., all +881 satellite calls) across your entire SIP trunk account
- Real-time spend monitoring: Set daily and monthly spending thresholds — we alert you and optionally auto-block when limits are approached
- After-hours international block: Automatically block all international calling outside your configured business hours
- IRSF protection list: We maintain an actively updated blacklist of known IRSF (International Revenue Share Fraud) number ranges — blocked automatically
- Velocity limits: Block accounts that make more than a set number of international calls per hour — stops automated fraud scripts
- Instant block on demand: Call or portal-request to block any destination immediately — takes effect in under 60 seconds
✅ Whitelist Strategy: Allow Only What You Need
The most secure and recommendable approach for businesses that don't need broad international calling is a whitelist-based policy — block all international by default, then specifically enable only the country codes your business actually calls. This "deny by default, allow by exception" approach eliminates the entire category of unexpected international charges.
| Business Type | Recommended Default | Whitelist To Enable | Block Everything Else |
|---|---|---|---|
| Local retail / service business | Domestic US only | Nothing — block all international | All international |
| US + Canada operations | NANP only | +1 prefix (includes Canada) | All non-NANP |
| US + UK / Europe clients | Domestic + approved countries | +44, +33, +49, +31 etc. | All other countries |
| Real estate (see our SIP for Real Estate guide) | Domestic + client countries | Countries where international buyers originate | All other high-risk |
| Contact center (outbound) | Campaign-specific countries | Only countries in active campaign list | All non-campaign countries |
| Global enterprise | All enabled with monitoring | All countries (with per-user policies) | High-risk premium numbers only |
; Priority: Most specific patterns first, general block last [outbound-international] ; ALLOW: UK (+44) exten=>_01144.,1,Dial(SIP/trunk/${EXTEN}) exten=>_+44.,1,Dial(SIP/trunk/${EXTEN}) ; ALLOW: Germany (+49) exten=>_01149.,1,Dial(SIP/trunk/${EXTEN}) ; ALLOW: Canada (already in NANP +1) ; No special rule needed — handled in domestic context ; BLOCK: Everything else international (catch-all) exten=>_011.,1,Playback(international-not-authorized) same=>n,Hangup(21) exten=>_+.,1,Playback(international-not-authorized) same=>n,Hangup(21)
📊 Real-Time Monitoring & Auto-Block Alerts
Destination blocking is a static defense — it prevents calls to known high-risk destinations. But sophisticated fraud attacks evolve, and new premium-rate destinations are constantly being exploited. Real-time monitoring adds a dynamic layer that catches unusual calling patterns before significant charges accumulate.
📡 Monitoring Controls That Complement Destination Blocking
- Call volume velocity alerts: Alert (and optionally auto-block) when more than X outbound calls are placed per hour — abnormal for most businesses
- Spend threshold alerts: Email or SMS alert when daily outbound spending exceeds a set amount (e.g., $50/day for a typical SMB)
- After-hours call alerts: Instant notification any time an outbound call is placed outside business hours
- New destination alerts: Flag when a call is placed to a country code your account has never called before
- Failed authentication alerts: Monitor SIP registration failures — high failure rates indicate a brute-force attack in progress
- Call duration anomaly: Flag calls with abnormally long duration to unusual destinations — a hallmark of IRSF fraud
- Auto-suspend: Automatically suspend outbound calling and notify admin if fraud threshold is crossed — stops damage in minutes not hours
✅ Complete Destination Blocking Checklist
- All satellite phone prefixes blocked (+881, +882, +883) at PBX and provider level
- All premium-rate number ranges blocked (+900, +0900, country-specific premium prefixes)
- High-fraud country codes blocked by default (review list with your provider)
- Caribbean NANP numbers assessed and restricted if not operationally needed
- Whitelist strategy implemented — only explicitly approved countries allowed
- Per-extension calling permissions configured (reception: domestic only; management: approved international)
- After-hours international blocking enabled — no international calls outside business hours
- Daily spending cap set at SIP trunk provider level with auto-suspend
- Real-time spend alert configured — email/SMS when threshold reached
- Failed SIP registration alert active — notifies on brute-force attempts
- Velocity limit configured — block account exceeding X calls/hour
- SIP credentials using strong password (16+ chars, mixed case, symbols, numbers)
- IP whitelist on SIP trunk — only your office IP can register and make calls
- Provider-level IRSF protection list active on your SIP trunk account
- Test all blocking rules — verify blocked destinations return busy/announcement
- Documented blocking policy reviewed and approved by management
- Staff informed of calling policy — employees understand which destinations are restricted
Lock Down Your SIP Trunk — Block Expensive Calls Now
NetViaVoice configures destination blocking, fraud monitoring, and call caps for your SIP account — protecting your business from unexpected charges and toll fraud attacks.