What are the first signs of SIP or PBX toll fraud?

Unexpected international or premium destinations on CDRs, outbound spikes when offices are closed, short-duration bursts, or carrier fraud notifications—often before users notice call quality issues.

What should I do when my VoIP bill suddenly increases?

Open a carrier ticket, preserve CDRs and logs, contain outbound routes or credentials per your change process, then investigate before re-enabling full international dialing.

How can I detect unusual outbound bursts?

Baseline normal CPS and concurrency; alert on distinct-destination velocity, new country mixes and off-hours traffic—tune thresholds in alert-only mode first.

Which FreeSWITCH logs and CDRs should I preserve?

CDR export, sofia registration/auth lines, dialplan execution for affected periods, and config snapshots after containment—store with UTC timestamps.

How do I distinguish compromised extensions from a legitimate dialer?

Join CDR user/device fields with known campaign schedules; compromised traffic often lacks CRM/campaign metadata and hits unusual prefixes.

Can Fail2ban and firewalls prevent all toll fraud?

They reduce exposure but do not stop authenticated abuse of valid credentials or weak dialplan rules. Layer controls; do not rely on one tool.

How should fraud alert thresholds be tested?

Run alert-only, compare against historical CDR, include legitimate outbound campaigns in UAT, then enable containment with rollback documented.

How do I recover without reopening a compromised route?

Rotate credentials, patch dialplan, validate inbound, restore outbound in stages with carrier approval—monitor unlock is separate from trunk restoration.

FusionPBX Toll Fraud & PBX Security: FAQ When Your Phone Bill Spikes

Scenario: Finance forwards a carrier invoice with unfamiliar international destinations. CDRs show hundreds of short outbound calls between 02:00 and 05:00 local time. The FusionPBX dashboard still shows trunks “registered.” The wrong move is installing a random script from a forum and re-enabling outbound routes without understanding what was compromised.

Direct answer

First 15 minutes (approved by your incident lead):

Carrier — report suspected fraud, ask whether outbound can be restricted or suspended on their side; get a ticket reference.
Contain — disable or narrow affected outbound routes, rotate exposed credentials, or ACL-block known bad destinations using your change process (not ad-hoc edits without backup).
Preserve — export CDRs, FreeSWITCH logs, and authentication events before log rotation; note timezone and server clock.

A monitoring product helps after you survive the hour: pattern detection, incidents, alerts, gated unlock. It does not replace carrier response. See FusionPBX & FreeSWITCH Security Monitor and the case study.

Incident lifecycle

Detect → Investigate → Contain → Remediate → Validate → Recover

Phase	Goal	Common mistake
Detect	Know within minutes, not at invoice	No baseline for “normal” outbound
Investigate	Tie calls to credential, route, or dialplan	Blaming “the internet” without CDR join
Contain	Stop bleeding	Blocking all inbound to “fix” outbound
Remediate	Patch creds, dialplan, ACL	Reusing same SIP password
Validate	Test inbound and outbound	Clearing lockdown = carrier restored (they are different)
Recover	Document thresholds and runbooks	Re-enabling full international without caps

What to collect (evidence pack)

CDRs — source extension/user, destination, duration, disposition, trunk, timestamp (UTC normalized).
FreeSWITCH logs — sofia registration failures/successes, dialplan execution, bridge outcomes.
Auth events — failed REGISTER bursts from new IPs (may be scanning, not the same as toll fraud).
Destination patterns — country codes, premium ranges, sequential dialing.
Config snapshot — outbound routes, dialplan contexts, user directory after containment (for diff).

Store read-only; restrict access; define retention with legal/compliance if recordings exist.

Detection examples (synthetic thresholds)

Illustrative rules only—tune per carrier, business hours, and legitimate dialer campaigns:

Signal	Example threshold	False-positive risk
Outbound calls per minute per account	> 10 sustained 2 min	Call-back campaigns, power dialers
Concurrent outbound channels	> N vs historical P95	Monday morning spikes
New country mix	first-time premium prefix burst	Travel, new market test
Short-duration international	many < 6s to same range	misconfigured IVR loop
Failed REGISTER storm	> 50/min from one IP	internet background noise

Test thresholds in alert-only mode before auto-containment. The monitor product documents velocity/concurrency/distinct-destination windows on outbound channel events—confirm signals for your deployment.

Example timeline (synthetic, labeled)

Time (UTC)	Event
02:14	Outbound CPS to +88x exceeds baseline × 8
02:16	Alert email: incident opened
02:22	Operator disables international route on trunk T1
02:40	CDR export attached to incident
03:10	Credential rotation on extension 4xx range
08:00	Validation: inbound IVR OK; outbound domestic test OK
08:30	Carrier confirms fraud block; separate approval to restore intl route

Unlock ≠ carrier billing restored

In the documented monitor design, clearing security lockdown does not automatically re-enable carrier billing or outbound routes. Operators verify root cause addressed, test inbound, then follow a gated procedure for carrier/trunk restoration. See product FAQ and case study unlock API.

Monitoring gaps to plan for

ESL or event collector down → blind spot while PBX still calls.
Disk full → log loss before investigation.
Alert email to unmonitored mailbox.
False positives on legitimate outbound campaigns → alert fatigue → rules disabled.

Prevention still requires strong SIP passwords, ACLs, dialplan guards, patching, and least privilege—security & reliability, production rescue.

Engagement types

Situation	Start here
Active fraud / bill shock	Incident triage + evidence
No incident	Assessment + gap review
Ready to instrument	Monitor deployment + UAT
Many instances	Per-instance boundaries

False positives and legitimate traffic

Legitimate patterns that trip naive rules:

Outbound reminder campaigns — high CPS for minutes, domestic only.
International sales desks — new country mix after marketing launch.
Call-back queues — many short outbound legs to returned missed calls.
Conference bridges — concurrent channels without long duration.

Mitigation: allowlists per trunk, business-hours windows, per-extension roles, manual approval for auto-contain, and separate rules for inbound vs outbound. The case study documents inbound UAT after tightening outbound rules—retest both directions.

Safe recovery checklist

Root cause documented (credential leak, open route, weak IVR forward)
Affected passwords rotated; old credentials invalidated at carrier if supported
Dialplan diff reviewed; unexpected transfer/bridge paths removed
Inbound IVR and main DID tested per site
Outbound domestic test call; then international if required—with spend cap
Monitor/alert paths healthy (not the same mailbox that missed the first alert)
Carrier fraud ticket closed or escalated with reference

When to choose triage vs full monitor deployment

Triage when bills or CDRs already prove an incident—you need containment forensics this week. Assessment when leadership asks “are we exposed?” without active fraud. Deployment when ESL access, alert owners and unlock procedures are ready—instrumentation without runbooks creates false confidence.

Author note: Engineering evidence and limitations are on the FusionPBX security monitor case study—not marketing claims.

Limitations: No product guarantees all fraud prevented; attacker behavior and misconfiguration vary. We do not publish invented savings figures.

Next step: Assess my PBX security · Earlier narrative incident