Unauthorized use of a phone system or voice account to make calls, usually expensive long-distance or international calls, that someone else ends up paying for.
Toll fraud is the broad category that covers any situation where an attacker gets calls billed to someone else. The entry point can be a compromised PBX, stolen SIP credentials, a weak voicemail PIN that allows outbound dialing, an exposed softphone account, or an account opened with stolen identity details.
Once in, attackers usually move quickly, running as many simultaneous calls as the trunk allows to destinations that pay them through revenue sharing. Attacks commonly begin on nights, weekends, and holidays, when nobody is watching the system and the window before detection is longest. An attack that starts on a Friday evening can run for an entire weekend if no automated controls are in place, which is why the time of day and day of week matter so much in detection rules.
Responsibility for the charges is often disputed between the enterprise and its provider. Regardless of who ultimately pays, the provider has the visibility to stop the attack early, because it can see the call pattern across the entire account in real time. Contracts that spell out fraud responsibilities, along with tools that let customers set their own dialing restrictions, help reduce disputes when an incident does occur.
Why it matters to carriers
For SIP trunk and hosted PBX providers, toll fraud is both a direct cost and a customer relationship problem. Per-account spend limits, concurrent-call caps, international dialing restrictions by default, and automated alerts on abnormal patterns stop most attacks before they become expensive, and they show customers you are protecting them.