The Weekend Raid: How Toll Fraud Drains Small Business Phone Systems While Nobody Is Watching

The pattern is remarkably consistent. A small business closes for the weekend on Friday evening. Sometime after midnight, a device or extension on its phone system begins dialling international premium-rate numbers — often in sequences of dozens of simultaneous calls, hour after hour, until the fraudsters' destination numbers cut off the operation on Sunday night or Monday morning. On Monday, the business discovers a phone bill running into four or five figures.

This is toll fraud, sometimes called International Revenue Share Fraud, and it is one of the least discussed budget drains in UK small business telephony. The mechanics are simple: criminals generate revenue by directing calls to premium numbers they control or share proceeds with. The victim's phone system supplies the minutes. Because the calls are automated and typically occur outside working hours, the fraud can run unchecked for days.

Why Small Businesses Are the Preferred Target

It might seem counterintuitive that fraudsters focus on SMEs rather than large corporates. The answer is attack economics. Larger organisations tend to have managed telephony, security monitoring and session border controllers. A small firm, by contrast, often runs a VoIP system on an office broadband line with default passwords unchanged since installation — an opportunistic target requiring little sophistication.

Common entry points include:

• Weak or default extension passwords, particularly on IP phones and softphones exposed to the internet
• Unnecessary open ports left forwarding to the phone system's web interface
• Disused extensions that remain active but unmonitored
• Compromised handsets or VoIP apps on staff devices

Once inside, the attacker does not need to steal data or hold anything to ransom. They simply make calls — thousands of them — and the meter runs on the victim's account.

The Warning Signs

Most compromised systems betray themselves before the bill arrives. Operations leads should watch for:

• Call logs showing outbound activity at unusual hours, especially overnight and at weekends
• Repeated calls to unfamiliar international destinations, particularly premium-rate ranges
• Extensions registering from IP addresses in unexpected countries
• Staff reporting that lines are persistently engaged or calls fail to connect
• A sudden spike in usage on the provider's online portal

Any one of these alone may be innocent. Two or more together warrant an immediate investigation.

Five Settings That Block the Majority of Attempts

The encouraging news is that the overwhelming majority of toll fraud attempts can be defeated with straightforward configuration discipline:

1. Enforce strong, unique passwords on every extension and admin account — and change them when staff leave. Credential guessing remains the most common entry method.
2. Restrict international calling by default. If the business rarely dials abroad, disable it entirely; where it is needed, whitelist specific destinations and require approval for others.
3. Set call-cost and concurrent-call limits. A ceiling on simultaneous outbound calls and a daily spend threshold will truncate a fraud attempt within minutes rather than hours.
4. Close what you do not use. Remove web interfaces from public internet access, disable forwarding of unused ports, and retire dormant extensions.
5. Enable out-of-hours lockdown. If no one makes calls at 3am on a Sunday, the phone system should not be permitted to either.

A Note on Responsibility and Recovery

Liability for fraudulent calls varies between providers and contract terms, and outcomes often depend on how quickly the customer reported the incident. That alone is a reason to check call records on a Monday morning rather than waiting for the monthly invoice — and to confirm, before an incident occurs, what your provider's fraud monitoring and dispute process actually involves.

Toll fraud is not exotic. It is a mundane, industrialised crime that succeeds through inattention rather than sophistication. For a small business, an hour spent reviewing passwords, call restrictions and spend limits is among the highest-return security investments available — and considerably cheaper than a Monday-morning phone bill.