Toll Fraud — International Revenue Share Fraud (IRSF)
What is Toll Fraud?
Toll fraud — also called International Revenue Share Fraud (IRSF) — is a scheme where an attacker who has compromised a PBX, SIP trunk credentials, or a calling API key pumps outbound calls to premium-rate or high-cost international numbers they control, then collects a cut of the per-minute termination fees the carrier bills the victim business for every connected call. It is voice's counterpart to SMS pumping fraud: the same revenue-share abuse pattern, but draining call spend instead of message spend.
More detail
Toll fraud typically starts with stolen access — a hacked PBX admin panel, leaked SIP trunk credentials, or a compromised calling API key — rather than a public form, since it needs a live outbound call path already provisioned on a business's account.
Attackers concentrate calls on a handful of high-cost destination prefixes and run them in bursts overnight or over a weekend, when a compromise is least likely to be noticed before the bill arrives.
Defending against it means detecting an abnormal spend or call-volume spike per destination prefix in near real time and automatically throttling or blocking further calls, not just reviewing the invoice after the damage is done.
Frequently asked
- What is toll fraud?
- Toll fraud (also called IRSF, International Revenue Share Fraud) is when an attacker who has compromised a PBX, SIP trunk, or calling API pumps outbound calls to premium-rate international numbers they control, earning a cut of the per-minute termination fees the victim business gets billed.
- Is toll fraud the same as SMS pumping fraud?
- They're the same underlying abuse — inflating a victim's carrier bill so the attacker collects a cut of the termination fees — but toll fraud targets voice minutes through a compromised PBX or SIP trunk, while SMS pumping fraud targets OTP or verification text volume through a business's own signup or login flow.
- How can a business protect itself from toll fraud?
- Rotate and restrict SIP trunk and calling API credentials, cap the countries and prefixes a PBX or account is allowed to dial, and monitor for a sudden spike in call spend or volume concentrated on a small set of destination prefixes so it can be throttled or blocked before the bill arrives.
See also
Build it on Orbit
Voice, messaging, email, video, and AI agents on one platform and one pay-as-you-go bill. Start free — no credit card required.