Platform, Security & Integrations / Security

Toll Fraud Prevention

Through several layers working together. We guard against toll fraud (unauthorized use of your phone system, usually by hackers, to place expensive international or premium-rate calls at your expense — see Glossary: Toll Fraud) with outbound call restrictions, usage limits, and the same login protections that stop a bad actor from getting into your system in the first place.

How does toll fraud actually happen to a business?

Typically, an attacker finds a way into an extension or the admin portal (often through a weak or reused password), then uses it to place a burst of expensive calls to premium-rate or international numbers — often overnight or over a weekend, when no one’s watching, racking up thousands of dollars before anyone notices.

What specific protections are in place?

Several layers stack together: outbound route restrictions and PIN codes on sensitive routes, country and region call restrictions, call-frequency and concurrent-call limits (which catch an unusual burst of outbound calls even from a legitimate-looking account), and time-condition restrictions that can block after-hours outbound calling entirely if your business doesn’t need it.

Does this rely on someone noticing a suspicious pattern manually?

No — the limits and restrictions apply automatically and continuously, not as something a person has to catch in real time. That said, event logs and notifications flag unusual activity so you have visibility if something does look off.

Is this connected to how we protect logins?

Yes — since most toll fraud starts when an attacker compromises an account, Brute-Force Login Protection is a key part of preventing it before it starts, by keeping attackers from getting into an account at all.

Who’s responsible for configuring these protections — us or you?

We apply sensible defaults out of the box, and we can tune outbound restrictions to match your specific calling patterns (for example, if your business legitimately calls internationally) as part of onboarding, so protection doesn’t come at the cost of blocking calls you actually need to make.