International dialing fraud watch items

Overview

Toll fraud pumps expensive country destinations through compromised credentials or open SIP listeners.

Controls

• Geo permissions on trunks: allow only countries client needs; block premium rate ranges.
• Least-privileged Teams voice admin roles; MFA on all admin and SBC management interfaces.
• Spending caps and anomaly alerts when >2× baseline minute volume.

Monitoring

Daily digest of top destination countries; alert on short repetitive calls to odd ranges (modem replay patterns).

Response

Disable affected trunk credentials, rotate shared secrets, PCAP to forensics if insider compromise suspected, file carrier fraud report for credits.

Prevention projects

Move SBC admin off internet-facing RDP; use jump hosts; patch CVEs within SLA—SBC ransomware is real.

Client messaging

Framing

Describe toll fraud as a “financial DDoS”—that wording often resonates with finance approvers who gate spending controls and trunk locks.