The Weekend Bill: How Toll Fraud Reaches a UK SME’s Ledger

A quiet system, a costly Monday

Most UK small businesses do not think of their phone system as a financial asset with a live connection to the outside world. It is simply there: desk handsets, a softphone on a laptop, a number that diverts to a mobile. That ordinariness is precisely what makes toll fraud so effective. A compromised voice system can place a large volume of international or premium-rate calls in a short period, often over a weekend when nobody is watching the call logs or the finance inbox.

The first indication is frequently not a technical alert. It may be a call from the service provider about unusual traffic, a finance team querying an interim invoice, or a user reporting that outbound calls are failing because the trunk is saturated. By then, the fraudulent activity may already have run for hours. The purpose of this article is not to alarm directors into switching everything off. It is to set out a proportionate control framework that fits the way a UK SME actually buys and runs communications.

Why the phone system is an attractive target

A modern VoIP estate has several doors. There are SIP credentials on desk phones and softphones, web administration portals, voicemail boxes and sometimes remote-worker profiles that were set up quickly and never reviewed. If any of these is protected by a default password, an extension number, a shared login or a PIN that has not changed since installation, the barrier is thin. Automated tools can test credentials at scale, and they do not need to understand your business to exploit a weak account.

Fraudsters tend to favour destinations that generate revenue quickly: international numbers and premium-rate services. They also favour out-of-hours activity, because a small business is less likely to notice concurrent call limits being reached at two in the morning. The cost is not only the call charges. There can be loss of service, damage to reputation if customers cannot get through, and considerable management time spent reconstructing what happened. In procurement terms, the cheapest control is usually the one applied before the first fraudulent call rather than after the first invoice.

Warning signs that deserve a second look

Not every anomaly is fraud, but some patterns justify a prompt check. Look for international or premium-rate numbers in the call detail records that no member of staff recognises. Check for repeated calls to the same destination, unusually high call volumes outside working hours, or a sudden jump in concurrent calls. A user may report that their voicemail PIN has changed, that their handset is behaving oddly, or that they are receiving unexpected missed-call notifications. Administrators may see password-reset prompts or new forwarding rules they did not create.

Other signals are less direct. Broadband performance may drop because voice traffic is consuming capacity. Extensions that should be dormant may show activity. A voicemail greeting may have been altered. The provider may contact you about a credit limit or unusual spend pattern. None of these alone proves toll fraud, but each is a reason to review the logs rather than wait for the monthly bill.

The settings that close the easiest doors

The most effective controls are not exotic. They are routine configuration decisions that should be documented and reviewed.

Call barring is the first. Unless there is a clear business need, international and premium-rate destinations should be blocked by default. Where international calling is required, restrict it to named extensions or approved destination patterns rather than opening it across the estate. Apply time-of-day rules so that out-of-hours calling is limited to the numbers the business genuinely needs. Review these permissions when staff join, move or leave.

Voicemail PINs deserve the same discipline as any other password. Default PINs should be changed at installation, and each mailbox should have a unique PIN that is not the extension number, a birth year or a simple sequence. Voicemail boxes that belong to former employees should be removed, not merely left dormant. If voicemail-to-email is enabled, check that the destination mailbox is still monitored and appropriately protected.

SIP password hygiene matters because SIP credentials are often the weakest link. Use long, unique passwords for each extension and trunk, avoid shared accounts, and rotate credentials when someone leaves or when a device is replaced. Disable unused extensions and remote profiles. Protect administration portals with multi-factor authentication where the platform supports it, restrict access by IP address where practical, and keep firmware up to date. These are not one-off tasks. They are part of the lifecycle of the system.

Spend alerts turn finance into an early-warning system. Ask the provider to set daily or hourly thresholds that trigger an email or call to a named contact, including out of hours. Set a credit limit that is appropriate to normal usage. Confirm who is authorised to change bars and limits, and make sure that person is reachable when the office is closed.

If the bill has already landed

The instinct may be to argue first and investigate second. Reverse that order. Contact the provider immediately and ask for the affected routes or extensions to be barred while the investigation takes place. Preserve the call detail records and any system logs before making changes that could overwrite evidence. Change credentials, disable suspect accounts and review forwarding rules. Do not wipe logs in an effort to tidy up.

Notify management according to your incident process, and check whether your insurance policy or contract includes any fraud-related cover or notification requirement. Report the matter to Action Fraud and follow your provider’s dispute procedure. Whether charges can be reduced will depend on the contract, the evidence and the controls that were in place, so avoid promising an outcome before those facts are established. Communicate plainly with staff and customers if service is affected, and record the root cause so that the same door is not left open again.

A routine control, not a project

Toll fraud is often described as a technical problem. In practice it is a governance problem with a technical expression. The businesses that manage it well tend to have an owner for communications security, a short set of documented bars and alerts, and a procurement process that asks providers what fraud controls are included rather than assuming they are automatic. A quarterly review of extensions, permissions and spend thresholds is less dramatic than a crisis meeting, but it is considerably cheaper than a weekend bill nobody expected.