Toll fraud and international revenue share fraud (IRSF) are often used as if they were the same thing. They overlap, but they are not identical. Toll fraud is the broad category: someone places calls through a phone system or account they do not own, and the account owner pays. IRSF is one kind of toll fraud. Its calls go to premium-rate numbers, and the fraudster collects part of the charge. The difference changes where the calls go, who collects the money, and which warning signs matter.
In short, toll fraud is defined by who pays: the account owner. IRSF is defined by where the money goes: a premium number and its revenue share. A control that watches destinations catches IRSF and a good deal of toll fraud. A control that only checks for unknown extensions can miss an IRSF attack that runs through a valid account.
Toll fraud: the broad category
Toll fraud means unauthorized use of a telephone service that bills the owner. A useful comparison is a stolen company credit card. The charges land on the account holder, not on the person who ran them up. In telephony, the "card" is usually a PBX (the private phone system inside an office), a SIP trunk (the internet connection that carries calls to the public phone network), or a cloud phone account with a login.
The FCC described one common pattern in a 1992 consumer alert about PBX remote access. Remote access lets staff who are away from the office call in, enter an authorization code, and get an outside line. Unauthorized callers can use computers to test random codes until one works. The calls then bill to the PBX owner's outgoing line. The notice is old, and attacks today may also target SIP credentials or cloud logins, but the billing outcome is the same. The broader prevention steps are covered in the VoIP toll fraud guide.
IRSF: the premium-number version
IRSF starts with a premium-rate number, which charges the caller more than a standard call. Part of that charge is paid to whoever owns the number. The fraudster's goal is to generate a large volume of calls to that number, so that the revenue share builds up. A 2021 academic study of IRSF describes several parties, including a fraudulent telecom operator and a premium-rate service provider, that collect and divide the call revenue.
The premium number is usually in a country with high termination rates, which is the fee that carriers pay to deliver a call there. Telesign's glossary describes fraudsters who target those destinations and set up a premium-rate number in that country. The traffic is then generated in one of three ways: automated dialers that call at high frequency, hacked PBX systems that place calls from inside a business, or SMS systems that are tricked into sending messages to premium lines.
The same economics apply to text messages. An app that sends verification codes pays for each message it sends. If attackers trigger a large number of codes to a premium number, the app's owner pays the message cost, and the fraudster collects a share. In that case the victim is often the business running the app, not the owner of a phone system. This variant is sometimes called SMS pumping.
How the two differ, side by side
| Question | Toll fraud | IRSF |
|---|---|---|
| Mechanism | Unauthorized calls placed through a PBX, SIP trunk, or cloud account | Traffic generated to a premium-rate number, through a compromised account, an automated dialer, or an SMS system |
| Who is the target | Any exposed phone system or account | Any account that can generate traffic, and apps that send SMS such as verification codes |
| Where the money goes | Charged to the account owner. The fraudster's gain varies by scheme | Shared between the premium number's owner and the other parties in the chain |
| How it appears in call records | Calls the business did not place: odd hours, unfamiliar extensions or logins, mixed destinations | A valid-looking account making many calls, often short or identical in length, to one number or one country code |
| Typical controls | Strong authorization codes, disabled unused remote access, outbound destination limits, after-hours limits | Blocks on premium prefixes, per-destination spend caps, volume alerts, traffic monitoring by the provider |
The practical difference is the destination. Toll fraud can go anywhere expensive, and IRSF specifically targets premium numbers. Many real attacks are both at once: someone uses a compromised PBX to call a premium number abroad. That is toll fraud by method and IRSF by destination.
How each shows up in call detail records
A call detail record (CDR) is the log that a phone system or carrier keeps for each call. It normally holds the source account or extension, the dialed number, the start time, the duration, and the cost. Both forms of fraud leave traces there, but the traces look different.
Toll fraud often appears as calls the business did not place. The source may be an extension nobody uses, a login at an odd hour, or a remote-access session with no matching staff activity. The destinations tend to be scattered, because the attacker is testing what the system will allow.
IRSF often looks like a normal account making calls. The tell is the destination. Many calls, often short or repeated, go to one number or one country code that the business does not serve. Because the source account is valid, a review that only asks "who made the call?" may find nothing wrong. A CDR also cannot show who received the revenue share. It can only show the pattern, so the pattern is what to act on.
A worked example (illustration)
This example is hypothetical. The figures are invented to show the arithmetic and do not come from a real case.
Suppose a 12-person accounting office has a PBX with remote access turned on. Over a weekend, an unknown caller enters a valid-looking code and places 200 calls of about four minutes each to a premium-rate number in a country the office has never called. Assume the destination costs $1.00 per minute. That is 200 x 4 = 800 minutes, or $800, on the office's outgoing line. No staff member made these calls.
The CDR would show calls on Saturday and Sunday, a remote-access source, a country code never seen before, and nearly identical durations. A destination block for that prefix would have stopped the calls. A daily volume alert would have flagged them within hours. A monthly bill review would show them weeks later, which is often too late to dispute them quickly.
Warning signs
- Calls or SMS to a country the business does not serve, especially a new country code
- Many calls to one number in a short time, often of similar length
- Calls at unusual hours, or from an extension or login nobody recognizes
- A sudden rise in SMS or call volume that does not match any change in the business
- Charges on a bill labeled premium, international, or toll that nobody can explain
- Short "one-ring" calls from unfamiliar numbers. The FTC warns that these calls are often auto-dialed to get a return call, and that the numbers look like US three-digit area codes but link to Caribbean international lines. The codes it lists include 268, 284, 473, 664, 649, 767, 809, 829, 849, and 876. Callers who return the call can pay a per-minute premium on top of the international rate.
Controls checklist for a business
No single control stops both forms of fraud. A layered set is more realistic, and most of these steps cost little to set up.
- Block destinations you do not need. Restrict international and premium prefixes per user or per account, not only through a default list.
- Harden authorization codes. Use the longest codes the system allows, change them, delete default or unused codes, and keep them out of voicemail greetings and shared notes. The FCC's 1992 advice still applies.
- Turn off what is unused. Disable remote access and outbound features that no one uses, and consider limiting outbound calling after business hours.
- Limit credentials and exposure. Rotate SIP passwords, and where possible restrict SIP registration to known addresses rather than leaving it open to the internet.
- Set spend and volume limits with your provider. Make sure an alert goes to someone who reads it the same day.
- Review call records on a schedule. A weekly review is a reasonable starting point. Treat any new destination as something to explain.
- Do not return unknown one-ring calls. Look the number up in an online directory first, as the FTC advises.
- Know your dispute window. The FTC's 900-Number Rule sets a 60-day window to dispute a pay-per-call billing error, but it covers US 900 numbers, not most international premium numbers. Check your own contract for the window that applies.
What a wholesale provider should monitor
A carrier or wholesale provider sees traffic from many accounts, so it can spot patterns that a single customer cannot. The signals below are general. Each provider's detection depends on its own design and data.
- Traffic volume to each destination prefix, compared with that account's normal baseline
- Bursts of short or identical-duration calls to one number
- New premium or high-cost prefixes appearing on an account that has never used them
- Calls at unusual hours, or from unusual source IP addresses or devices
- Failed logins followed by successful international calls, which can indicate stolen credentials
- SMS send volume that rises without a matching rise in registrations or completed verifications
- OTP requests from sequential number ranges, or repeated requests from one IP address or device
Who pays, and why the contract matters
The bill for fraudulent calls is not always the same as the victim's loss. Published carrier toll-fraud policies often place the cost of calls made through a customer's system on that customer, even when the carrier did not block them. Some sources also cite older FCC decisions on this point. The primary orders were not verified for this article, so the safe approach is to read the contract, ask how disputes are handled, and set limits before an incident rather than after.
Questions to ask a wholesale provider
- Which destinations do you block by default, and can I add more per account?
- Do you alert me on international volume spikes, and what threshold triggers an alert?
- Do you suspend traffic to a premium destination, and how do I learn about it?
- Who is notified first when fraud is suspected, and how quickly?
For how carriers trace the source of suspicious calls, see Traceback Requests: The 24-Hour Response Rule Explained.
Related reading
- VoIP Toll Fraud: How to Protect Your Business
- Traceback Requests: The 24-Hour Response Rule Explained
- UCaaS Security and Compliance Explained
Sources
- Sahin and Francillon, Understanding and Detecting International Revenue Share Fraud, NDSS 2021. Academic study describing the parties who split IRSF revenue and a detection approach tested on operator call data.
- FCC Public Notice DA 92-728, Consumer Alert: Telecommunications Toll Fraud (June 9, 1992). PBX remote-access fraud, billing to the owner's outgoing line, and advice to businesses. The notice is dated, so its advice is used as a baseline only.
- Telesign, What is International Revenue Share Fraud (IRSF)?. Vendor glossary on premium-number economics, traffic generation methods, and warning signs.
- Infobip, SMS fraud: The complete guide to detection and prevention. Vendor guide on SMS pumping signals, including volume spikes, sequential number ranges, and off-hours bursts. No publication date is shown.
