PBX Toll Fraud (PBX Hacking / Toll Fraud)

Also known as: PBX Hacking

PBX toll fraud is a class of attack where an internet-exposed enterprise PBX or IP-PBX (typically via weak SIP registration, DISA misconfiguration or default credentials) is compromised and used to place high volumes of calls to premium-rate or international destinations, generating IRSF revenue for the attacker at the enterprise's expense. Losses are frequently discovered only on the next invoice cycle.

Categories: SignalingThreats and AttacksFraud

PBX Toll Fraud in context

Signaling protocols carry the control-plane instructions that set up calls, register subscribers, hand over sessions and route SMS. SS7, Diameter, GTP-C and SIP are the four dominant families, and interconnect exposure of any of them is treated by GSMA FS.11 / FS.19 / FS.20 as a top-tier telecom risk.

Telecom threats range from opportunistic SMS phishing and SIM swap to nation-state grade location tracking and lawful-interception abuse. The common thread is that most attacks exploit the inherited trust model of legacy signaling. SS7 and Diameter were designed for a closed operator community that no longer exists.

To place PBX Toll Fraud in the wider telecom-security picture, review PBX Dial-Through Fraud, GSMA T-ISAC, Wangiri, Artificial Traffic Inflation, Flash Call Fraud and CLI Spoofing.

Related terms

Related topic hubs

More from the TelcoSec Glossary

Browse the full TelcoSec Glossary, the Ultimate Guide to Mobile Network Security, or the P1 Arsenal of telecom-security tools.