Stopping PBX hacks

As you read this, people all over the world are dialing toll-free numbers with their computers. When the toll-free number connects to a phone system, it begins hacking around to see whether it can access an outside line. If it can access an outside line, the computer then makes a test call to an international phone number. If the call completes fine, the series of codes and prompts used to access the outside line is recorded and sold on the streets by garden-variety thieves and organized criminals. This process of connecting into your phone system by way of a toll-free number and then dialing out is called PBX hacking.

Tip The first thing to do to prevent your PBX system from being hacked is to eliminate your phone system’s ability to reoriginate dial tone. That is, you want to prevent a scenario in which you receive an inbound toll-free call that can seize an outside line and receive dial tone. Obviously, accepting incoming calls is fine, but you don’t want an inbound call to find its way to a dial tone.

If it’s impossible to dial out of your system after a toll-free number accesses the system, you’re in pretty good shape. Before the widespread use of cell-phones, re-originating dial tone from a phone system was a great feature used by sales staff while on the road. They could use a special company 800 number to call in for messages, and then press a code to dial out and return their calls — all without having to rack up expensive long-distance charges. But nowadays you have better options, such as using company-distributed mobile phones.

Tip I strongly advise that you hunt down the toll-free dial tone reorigination option in your phone system and disable it. If you absolutely must keep it, at least have your phone system block international calls. The real money in telecom fraud is when you can sell minutes to locations that are expensive to call. Nobody is going to pay you $20 to talk to Mom in South Carolina, where the rate is usually about 7 cents a minute. The real market for telecom fraud is for people who want to call friends, relatives, and business associates in Afghanistan or the Kuala Lumpur, where the cost may be $2 per minute.