Securing an Asterisk server against toll fraud

Toll fraud is the failure mode that turns a working phone system into a five-figure invoice overnight. An exposed SIP server gets found by automated scanners within hours, and if an attacker can register or place calls, they will route expensive international traffic through your account while you sleep.

The good news: nearly all of it is preventable with configuration you should be doing anyway. Here is the baseline we apply to every deployment.

1. Never expose weak credentials

Automated attacks guess SIP credentials at scale. Defend against it by:

• Using long, random secrets for every SIP account — never the extension number, never a dictionary word.
• Disabling guest and anonymous SIP calls unless you have a specific, understood reason to allow them.
• Restricting which IP addresses can register or send traffic where your topology allows it.

2. Encrypt signaling and media

Run SIP over TLS and media over SRTP. Encryption is not only about privacy — TLS makes it far harder for an attacker on the network path to inject or hijack calls. On a modern server the performance cost is negligible.

3. Rate-limit and ban with Fail2ban

Fail2ban watches your logs and bans IP addresses that fail authentication repeatedly. It is the single highest-leverage control against brute-force SIP attacks. Pair it with a firewall that only opens the ports you actually use.

4. Put guards in the dial plan

Even if an account is compromised, your dial plan can limit the damage:

• Block or explicitly allow-list international destinations. Most businesses only ever call a handful of countries.
• Set sane limits on simultaneous calls per account.
• Watch for and block premium-rate number ranges that fraudsters favor.

Think of this as defense in depth: authentication keeps attackers out, and the dial plan limits what they can do if they get in.

5. Monitor and alert

Fraud is cheapest to stop early. Basic monitoring on call volume, destinations, and spend can flag an anomaly — a sudden burst of calls to an unusual country at 3am — before it becomes a large bill. This is one of the things an ongoing managed-support retainer covers.

6. Keep it patched

Vulnerabilities in telephony software get found and fixed. Running an old, unpatched version leaves known holes open. Scheduled patching closes them.

The bottom line

Toll fraud is common because so many deployments skip these basics. None of them are exotic — strong secrets, TLS/SRTP, Fail2ban, dial plan guards, monitoring, and patching. We apply this baseline to every Asterisk and FreeSWITCH deployment as part of the build, not as an afterthought.

If you are running a system that was set up casually, request a quote for a security review — it is far cheaper than the invoice that arrives after an incident.