Toll Fraud is defined as the use of a telecom service or product without the intention to pay for it. This is not a new concept but the arrival of Voice over Internet Protocol or VoIP technology has hugely opened up the field for fraudsters and criminals.
Old-fashioned wire-based lines naturally limited the number of fraudulent calls that could be made by virtue of the physical number of the phone lines. However, VoIP allows a line to make multiple simultaneous calls thus significantly increasing the opportunities to profit by fraudulent means.
Toll fraud is an embryonic crime that is developing on the back of technological potential; it is a critical issue for businesses using this type of technology and who are very vulnerable to potentially fraudulent activity.
In a 2015 survey, the Communications Fraud Control Association estimated that toll fraud racked up $38.1 billion in losses due to fraudulent call forwarding schemes.
Toll fraud prevention
VoIP providers will generally offer fraud monitoring as part of their overall service package however, there may be more to it than that. Understanding how toll fraud works will enable business owners to take preventative steps and measures to protect their networks as well as their profits.
What are the main types of toll fraud?
The top five types of fraud are:
- IRSF – International Revenue Share Fund
- Interconnect Bypass, e.g. SIM Box
- Premium Rate Service
- Arbitrage
- Theft or stolen goods
The top five countries for terminating fraudulent calls are Cuba, Somalia, Bosnia and Herzegovina, Estonia and Latvia.
VoIP providers do include processes to protect against toll fraud as part of their service but businesses need to be far more proactive and follow established best practices so they can stop toll fraud dead in its tracks.
Toll fraud prevention protocols
Start by analysing and defining which equipment is vulnerable and needs protection; this includes understanding the type of weakness and also the degree. Understand the economic impact on the business if the equipment is disconnected or damaged.
Start by protecting the most vulnerable equipment. Understand not only the degree of risk but also the impact; this might include computers which would have a big impact if they were taken out of commission even though their vulnerability to toll fraud may be low. Write a plan to minimise or eliminate vulnerability. Create an emergency fallback plan. Keep written records of what you are doing so that they are easy to access and review and implement a process which does just that.
Establish procedures and protocols which insist on the use of a password with a minimum length of at least 16 mixed characters including letters, numbers and symbols. Instigate a process to ask the user to change their password at a specified time interval the frequency of which may depend upon the importance of the protected information. Defined protocols for failed passwords such as the maximum number of attempts (usually three).
Employee education and responsibility
Business owners and managers should establish a protocol that can help employees stay safe and also act as guardians for the network. Employees should:
- Inform IT teams about reduced network speeds and erratic or irregular behaviour
- Be aware of the security plan and adhere to the policies it contains
- Understand the importance of not sharing their password or login details with anyone else
Members of the IT department can be tasked with specific responsibilities including:
- Designating each team member specific equipment to monitor
- Maintaining an accurate and up to date logbook recording each action taken concerning the equipment including upgrades and relocation and anything else that may be relevant
- Maintaining secure software
It can be very useful to create two administrators (more can make the network less secure) that have full permissions. The profiles and permissions for each member of the IT staff should be designated independently. Periodic and random audits of computer access should be undertaken.
Back up!
Toll fraud prevention involves paying attention to housekeeping.
- Keep data restoration procedures clearly documented
- Record the current settings for all network computers and store them in a safe place
SMEs can use software-based firewalls, in larger organisations it may be necessary to use physical firewalls. Use IPS or IDS Security devices to detect early threats from unusual network behaviour or activity.
Use security features on your computers and disable all redundant and unwanted services or protocols in routers and firewalls.
International calling
Designate an administrator to authorise special permission for international calls and document this and keep it in a safe place.
Use PINs for telephony services. Do not place telephones in areas where they cannot be monitored or within reach or people external to the company, for instance, unsupervised meeting rooms or reception areas.
Establish a protocol of monitoring calls and bills on a regular basis. Maintain a log of international calls including identifying the destination and supplier/contractor. Impose an alarm system to alert to national or international calls outside of business hours and on non-working days.
Make sure there is a clearly defined reporting line and protocol for action in the event of suspected fraud.
Choosing a provider
The best VoIP providers will implement round the clock fraud monitoring including detection alerts to allow services to be immediately suspended if there is fraudulent activity. This might involve unusual call patterns and international calls both in terms of volume and location. There need to be robust reporting procedures to help keep VoIP safe.
One of the best ways businesses can help themselves is by being aware of the potential risks of toll fraud and understanding where their weak points are and what their role is in preventing this latest technological threat.
About EC-MSP, your IT support partner
EC-MSP are one of the most trusted IT support providers in London. If you would like more help advice and support with technology for your business, contact us today to see how we can help.
