Protecting Your Account from Toll Fraud

How it happens

Attackers scan the internet for phones and phone systems with weak passwords or open ports. Once in, they call premium numbers in high-cost countries, often overnight or at the weekend, when nobody is watching.

How Click2Call protects you

Click2Call runs its own fraud detection on every account:

• Calls to high-risk overseas destinations are watched in real time. An unusual call, such as one in the middle of the night to a country you've never called, is ended and further attempts are blocked.
• Hourly and daily spending limits catch sudden jumps in call costs.
• Connections that keep guessing passwords, or that come from known hacking tools, are blocked automatically.

Sometimes a staff member misdials an international prefix and the system blocks it as a precaution. If that happens, contact support and we'll unblock the account once we've spoken with you. If your account was blocked for suspected fraud, change your line passwords before we turn calling back on.

These checks limit the damage, but they can't replace securing your own phones. The steps below stop most attacks before they start.

Five steps to protect your account

1. Use strong line passwords. Each line password in Voice → Line Manager should be long and random. Never use simple passwords like 1234 or the phone number.
2. Don't forward ports to your phones. Click2Call works behind your router without port forwarding. Opening ports exposes your phones to the internet.
3. Use TLS. It encrypts your phone's sign-in details. See SIP settings for desk phones, adapters and PBX systems.
4. Restrict overseas calls. If you don't call overseas, open each number, choose Outgoing Calls → Call Barring, tick Enable the call Barring feature for this line and tick Block all All Overseas Calls. If only some staff do, require a PIN. See PIN codes and call assignment.
5. Lock your account to your office. If your phones always connect from the same fixed IP address, add it to the Access Control List in your profile under Voice → Profiles (one address or subnet per line), so connections from anywhere else are refused.

Using your own PBX

Prefer a registered SIP trunk to IP peering. If you do use peering, only allow SIP traffic from Click2Call's addresses through your firewall. See Connecting your own PBX with a SIP trunk.

Protect your portal login

Turn on two-factor login so a stolen password isn't enough. See Two-factor login.

If you think you've been hacked

Change every line password, check Reports for calls you don't recognise, and contact support straight away.