Bell MTS

Long Distance Fraud - Learn what YOU can do to protect your business from fraud.

Did you know that hackers can access your phone service and make long distance, even international calls, on your phone without your knowledge? All calls will be billed and you will be expected to pay for them.

1. Types of Fraud
   1. Voicemail Fraud
   2. Subscription Fraud
   3. Clip on Fraud
   4. Calling Card Theft
2. Industry Best Practices for Protecting Phone Systems
   1. Learn about your telecommunications system
   2. Know the access paths that could open doors to fraud
   3. Monitor and analyze your systems information
   4. Know the signs of a security breach
   5. Secure your System(s)
      1. System configuration
      2. PBX (Private Branch Exchange) and DISA (Direct Inward System Access)
      3. Voice-Mail Systems
      4. Remote Access Ports
      5. Modems
      6. IP Routers

Education - know the types of fraud that can occur.

It is important to know the different forms of long distance fraud that can occur, and what you can do to help protect yourself from unwanted calls and charges. This is an overview of the most significant telecommunication fraud threats that your business could face.

 Voicemail Fraud: This is the most prevalent type of fraud and the most significant threat to businesses that use a PBX (Private Branch Exchange) phone system or Voice Mail. Hackers can gain access to your phone system and place Long Distance calls directly from your lines. Access to your system is most commonly gained through voice mail menus protected with only simple passwords (1111, 2222, 1234, etc.) or unchanged factory default passwords. Once inside your system, hackers use the system commands to gain dial tone and place calls that appear no different to your service or equipment provider than any other call originating from your business. Having a good password management policy and practice is a strong start towards protection.

 Subscription Fraud: Criminals can open a phone service account using your personal information; name, address etc. They use this account to run up long distance charges and you receive the bill. It is important to safeguard your personal information. Service providers must also put forward their best effort to verify the information that is collected for new subscribers.

 Clip on Fraud: Although this type of fraud is less common it does occur once in a while. Criminals illegally access the telephone cables either outside or inside the building and temporarily attach a phone to make long distance calls. Anybody seen accessing this infrastructure should be able to produce a valid photo ID from a service provider.

 Calling Card Theft: Criminals simply steal a calling card and then use it to make calls.

If you think you are a victim of long distance fraud you should:

• Immediately change your voice mail system passwords.
• Contact your equipment provider (Interconnect) to have them perform a system audit as soon as possible.
• Request to have your long distance or international calling capabilities suspended if possible as a stop gap measure until the audit is complete.

Remember that you are responsible for paying for all calls originating from, and charged calls accepted at your telephone, regardless of who made or accepted them.

Back to Top

Industry best practices for protecting your phone systems

This is a list of steps that you and/or your equipment provider should be taking to guard against long distance fraud. Please note that MTS can not anticipate all possible fraud scenarios and taking these steps may not guarantee your phone systems against a fraud attack.

1.  Learn about your telecommunications system:
   1. Talk to your equipment provider about telephony fraud and how they can help you to protect your system;
   2. Know the safeguards, the inherent defences and security features;
   3. Determine the vulnerabilities;
   4. Ensure your staff are educated on how to utilize the safeguards and avoid unintentionally disabling the systems security features.
2.  Know the access paths that could open doors to fraud:
   1. Direct Inward System Access (DISA);
   2. Voice-Mail System;
   3. Remote System Administration (Maintenance Ports);
   4. Direct Inward Dialing;
   5. Tie Trunks and Tandem Network Services;
   6. Modems.
3.  Monitor and analyze your systems information:
   1. Study call detail records and review billing records (Exception Reports may provide a warning sign);
   2. Know your employees' calling patterns and analyze them;
   3. Review voice-mail reports;
   4. Monitor valid and invalid calling attempts whenever possible.
4.  Know the signs of a security breach:
   1. Complaints that the system is always busy;
   2. Sudden changes in normal calling patterns such as increases in wrong number calls or silent hang-ups, night, weekend and holiday traffic, 800 and WATS calls, international calling, and odd calls (i.e. crank/obscene calls);
   3. Toll calls originating in voice-mail;
   4. Long holding times;
   5. Unexplained 900 (Chat Line) calls;
   6. High tolls for any unauthorized trunk extension.
5.  Secure your System(s):
   1.  System configuration
      1. Restrict access to specific times (business hours) & limit calling ranges;
      2. Block all toll calls at night, on weekends and on holidays;
      3. Restrict call forwarding to local calls only;
      4. Block all 10XXXX calling from your PBX if this service is not necessary.
      5. Block, limit access or Require attendant assistance to overseas calls;
      6. Establish policies on accepting collect calls and providing access to outside lines;
      7. Educate switchboard operators and employees about con- artists who try to obtain calling access or transfers through a PBX;
      8. Secure equipment rooms (lock up all telephone system equipment & wiring frames);
   2.  PBX (Private Branch Exchange) and DISA (Direct Inward System Access)
      1. Change default codes after installation of new equipment;
      2. Never publish DISA telephone numbers;
      3. Change your DISA access telephone number periodically;
      4. Issue a different DISA authorization code for all users and ensure DISA users do not write them down;
      5. Do not use sequential access numbers (1111, 2222, 1234, etc.);
      6. Use longer DISA codes (minimum 7-9 digits) and change the codes regularly;
      7. Disconnect telephone extensions that are not in use;
      8. Restrict DISA access at night, weekends and on holidays (prime time for fraud);
      9. Block or restrict overseas access;
      10. Program your system to answer with silence after five or six rings (hackers look for systems that answer with a steady tone).
      11. Identify invalid access attempts to your DISA and route them to an operator;
      12. Implement DISA ports that drop the line when an invalid code is entered;
      13. Program your PBX to generate an alarm when an unusual number of invalid attempts are made, and to disable the port after a set number of invalid attempts.
   3.  Voice-Mail Systems
      1. Establish controlled procedures to set and reset passwords;
      2. Change passwords regularly, at least once per month;
      3. Use maximum length passwords for system manager box & maintenance ports;
      4. Prohibit the use of simple passwords (i.e. 222, 123, your last name, etc.);
      5. Limit the number of consecutive log-in attempts to five or less;
      6. Change all factory default passwords immediately upon being assigned a voicemail box;
      7. Block access to long distance trunking facilities, and collect call options on the auto attendant;
      8. Block or preferably Delete all inactive mailboxes;
      9. Limit your out-calling;
      10. In systems that allow callers to transfer to other extensions, block any digits that hackers could use to get outside lines, especially trunk access codes;
      11. Conduct routine reviews of the status of your system and system usage.
   4.  Remote Access Ports
      1. Block access to remote maintenance ports and system administration ports;
      2. Use maximum length access codes and change them regularly.
   5.  Modems
      1. Use maximum length passwords and change frequently;
      2. Eliminate three-way calling on all extensions used with modems;
      3. Disconnect modems that are not in use.
   6.  IP Routers
      1. Limit outside access to your router by blocking all unneeded ports (including port 5060);
      2. Do not allow access to your router from outside your VPN;
      3. Ensure router passwords are changed from factory default and are made as complicated as possible;
      4. Ensure you know all security features of your router and maximize their use;
      5. Know that call logging features are often bypassed with an IP router hack. Station level (desktop phone set) recording will NOT capture calls that are placed from within the router itself.

These recommendations do not contemplate every possible scenario but give you an overview of ways to secure your systems against commonly known types of long distance fraud.

Back to Top