IRSF and toll-fraud protection for VoIP wholesale carriers

International Revenue Share Fraud (IRSF) is one of the most expensive problems a wholesale VoIP carrier can face. A single compromised account can push thousands of minutes to high-cost number ranges in a few hours, often overnight or at the weekend when nobody is watching. By the time the invoice arrives, the fraudster has been paid and the carrier in the middle is left holding the bill. This guide explains how IRSF and related toll fraud work, where wholesale operators are exposed, and the layered controls that keep losses small when something does go wrong.

What is IRSF?

International Revenue Share Fraud is a scheme in which someone obtains access to number ranges that earn a share of the termination revenue — typically premium-rate or high-cost international ranges — and then generates as many calls as possible to those numbers through somebody else’s network. Every minute delivered creates revenue along the chain, and part of that revenue ends up with the fraudster. The calls themselves are not meant to be answered by a real person; they exist only to be billed.

The carrier that originates or transits the traffic pays its vendor for every minute. If the traffic came from a compromised customer account, a hacked PBX or a stolen SIP credential, that carrier usually cannot recover the money from anyone. That is why IRSF is often described as toll fraud: someone else’s toll ends up on your bill.

How toll fraud reaches a wholesale network

Wholesale operators rarely get attacked directly through their own switch. More often the fraudulent traffic arrives through a legitimate interconnect from a customer who has been compromised further down the chain. Common entry points include:

• Hacked customer PBXs and softphones. An enterprise system with a weak extension password is found by a SIP scanner and used to place calls. The enterprise’s provider sends the traffic upstream to you as normal wholesale traffic.
• Stolen or guessed SIP credentials. Customers who connect using username and password registration instead of a fixed IP are exposed if those credentials leak.
• Weak management access. An admin portal, web interface or database reachable from the internet with a default password can be used to create new accounts or raise limits.
• Wangiri callbacks. One-ring calls leave missed-call notifications that tempt people to call back a high-cost number. The callback traffic is legitimate from the network’s point of view, but the destination is part of the scheme.
• Arbitrage and short-stopping. Traffic intended for one destination is diverted, or numbers are “hijacked” mid-route, so that revenue is captured somewhere it should not be.

Our training lesson on VoIP server security covers the network-edge controls — firewalls, whitelists and automatic blocking — that stop direct attacks on your own switch. This article focuses on the commercial and traffic controls that limit damage when fraud arrives through a legitimate partner.

Warning signs in live traffic

IRSF has a recognisable shape in call detail records. None of these signs proves fraud on its own, but several together deserve immediate attention:

• A sudden spike in calls to destinations the account rarely uses, especially high-cost or premium ranges.
• Many sequential or near-sequential B-numbers in the same range, for example +999 555 0100, +999 555 0101, +999 555 0102 (illustrative numbers).
• Traffic outside the customer’s normal hours: nights, weekends and public holidays.
• Very high concurrency from a single source, often reaching the channel limit within minutes.
• Unusual call durations: either very uniform durations (machine-generated) or long calls with no meaningful audio.
• Many different A-numbers or obviously invalid caller IDs on traffic that normally carries a small, stable set of CLIs.
• Answer rates that look too good for a destination that is usually difficult — a pattern that can also point to False Answer Supervision.

The skill of spotting these patterns quickly is covered in more depth in Lesson 14: a daily NOC routine and reading CDR patterns.

Layer 1: commercial controls

The cheapest fraud to deal with is the fraud you are never exposed to. Before a customer sends their first call, agree the commercial guard-rails:

• Prepaid or tightly limited credit. New customers should start on prepaid balance or a small credit limit. A balance that runs out stops the loss automatically. See Lesson 5: rates, billing, balance and CDRs for how balances and credit limits work.
• Clear fraud terms in the contract. State who is liable for traffic generated from a compromised customer system, and what happens to disputed minutes.
• Destination scope. Agree which destinations the customer actually needs. A customer who sells local retail calling in one region has no reason to reach every premium range in the world.
• Know-your-customer checks. A real company address, references and a named technical contact make it far harder for fraudsters to open accounts with you directly.

Layer 2: switch configuration

Your softswitch is where commercial limits become hard limits. Most platforms, including VOS3000, let you configure these per account or per gateway:

The VOS3000 accounts, gateways and rate groups lesson shows where these settings live when you create a new customer. Treat them as part of onboarding, not as something to add later.

Default-deny for high-cost destinations

A practical approach is to keep a high-risk prefix list that is blocked for every account by default and opened only on request, per account, after a check. Maintain the list centrally, review it when you update vendor rate decks, and log every exception. The longest-prefix logic described in Lesson 13 on E.164 and dial plans applies here: make sure your blocking rules match after number normalisation, otherwise a call sent as 00 plus the number may slip past a rule written for +.

Layer 3: real-time monitoring and alerting

Limits contain damage; monitoring shortens the time to discovery. The aim is to be told within minutes, not when the invoice arrives. Useful alerts include:

1. Spend velocity: cost per account per hour compared with that account’s normal baseline.
2. New destination: the first calls from an account to a country or range it has never used before.
3. Sequential numbers: several calls to adjacent B-numbers within a short window.
4. Concurrency at limit: an account sitting at its channel cap for more than a few minutes.
5. Off-hours activity: traffic from business customers outside their normal working pattern.

Alerts are only useful if someone acts on them. Decide in advance who receives them out of hours, and give the NOC authority to suspend an account or block a destination immediately while the commercial team investigates.

Layer 4: an incident playbook

When an alert fires, speed matters more than certainty. A short written playbook helps an engineer act calmly at three in the morning:

1. Contain: block the affected destination range for the account, or suspend the account’s mapping gateway if the pattern is broad.
2. Preserve evidence: export the CDRs and, where available, SIP traces for the affected period before anything rotates out.
3. Notify: contact the customer’s technical contact so they can secure their own systems, and inform the vendor that carried the traffic.
4. Quantify: calculate minutes and cost by destination and time window.
5. Dispute where appropriate: raise disputes with vendors quickly and with evidence; many agreements have short dispute windows.
6. Review: after the incident, ask which control would have stopped it earlier and change the defaults.

Worked example

Imagine a small customer, “Customer Y”, that normally sends around 20 concurrent calls to two neighbouring countries during office hours. At 01:40 on a Saturday, the account starts sending calls from 198.51.100.25 to a high-cost range in “Country Z”. Within ten minutes it reaches its 30-channel limit, the B-numbers are sequential, and call durations are clustered around the same length.

With good defaults the story ends quickly: the destination is on the high-risk list, so most calls are rejected outright; the few that pass a misconfigured exception trigger the new-destination and spend-velocity alerts; the on-call engineer suspends the gateway, exports CDRs and contacts the customer, who finds a compromised PBX extension. The loss is a few minutes of traffic rather than a weekend of it.

Without those defaults, the same incident can run for 60 hours at full concurrency before anyone notices.

Common mistakes

• Opening every destination for every customer because it is “easier”.
• Generous credit limits for new customers with no trading history.
• Alerts sent to a shared mailbox that nobody reads at weekends.
• Whitelisting broad IP ranges instead of specific addresses.
• Assuming fraud only happens to retail providers; wholesale carriers pay the vendor whether or not they get paid.

IRSF protection checklist

1. Prepaid or small credit limits for new customers.
2. Contract terms covering liability for compromised traffic.
3. Per-account channel, CPS, daily spend and duration limits.
4. High-risk destinations blocked by default, opened per account.
5. Specific IP whitelists on every interconnect.
6. Real-time alerts on spend velocity, new destinations and sequential numbers.
7. An out-of-hours contact with authority to suspend.
8. A written incident playbook and a post-incident review.

For a broader view of fraud types — including FAS and CLI manipulation — work through Lesson 7: FAS, CLI manipulation and fraud detection, and keep the wholesale VoIP glossary handy for terms such as wangiri and short-stopping.

How VoxComms can help

VoxComms runs wholesale voice termination with fraud controls built into every interconnect. For carriers on VOS3000, VoxInspector adds live traffic monitoring, unusual-pattern alerts and FAS detection on a separate server, so suspicious traffic is visible within minutes. Questions about protecting a specific interconnect? Contact our sales team.