Outbound Call Security

Outbound call controls are the final safeguard in a layered security plan. Even if an attacker slips past your other defenses, tightly scoped dialing rules cap how much damage a compromised extension or trunk (the connection to your phone carrier) can do. The main threat these controls guard against is toll fraud: unauthorized use of your phone system to place calls that run up charges, usually to premium-rate or international destinations. Cloud Voice lets you constrain outbound calling along several dimensions at once, so combine the controls below to match how your business actually uses the phone system.

The controls covered here are outbound route permissions, PIN (Personal Identification Number) codes, time conditions, allowed countries/regions, blocked numbers, call frequency limits, concurrent-call caps, and maximum call duration.

Tip

No single control stops every attack. The strongest setup layers several of these together, for example a time condition plus route permissions plus a per-extension frequency limit, so a gap in one is backed up by another.

Danger

Whatever outbound restrictions you apply, make sure emergency calls (911) are never blocked. A time condition, PIN, route permission, or country restriction that unintentionally covers your emergency path can stop a 911 call from going out when someone’s safety depends on it. Always keep a dedicated, unrestricted route for emergency dialing and test it after any change to these settings.

Limit dialing with outbound route permissions

Not every employee needs to place every kind of call. An outbound route is the rule that decides which trunk a dialed number leaves through. A good starting point is to separate your traffic into distinct outbound routes, for example local, long-distance, and international, each tied to the appropriate trunk. You can then grant permission for a route only to the extensions whose jobs require it, so most users can never reach a costlier route in the first place.

Tip

Follow the principle of least privilege: give each extension only the routes it genuinely needs (often just local and domestic long-distance), and add international or other high-cost routes case by case.

Require a PIN code before dialing

Adding a password to an outbound route forces the caller to enter a PIN (Personal Identification Number) before the call is placed. The route rejects the call unless a valid PIN is supplied. You can protect a route with either one shared PIN or a list of individual PINs.

Tip

Prefer a PIN list over a single shared PIN. Per-user PINs tie each call to a specific person for accountability in your call records, and if one PIN leaks you can remove just that entry instead of changing a password everyone relies on.

Use a single PIN

1. Go to Call Control > Outbound Route and open the route you want to protect.

2. In the Outbound Route Password drop-down, choose Single PIN and enter a PIN code.

   

3. Click Save, then Apply.

Use multiple PINs

1. Build a PIN list under Call Features > PIN List.

   

2. Attach the PIN list to the route under Call Control > Outbound Route > Outbound Route Password.

   

3. Click Save, then Apply.

Restrict dialing by time of day

Fraud attempts tend to cluster in the hours when nobody is watching: nights, weekends, and holidays. By pairing a time condition with an outbound route, you can allow calls only during the periods you expect legitimate traffic. A common approach is to define a “Business Hours” condition and permit outbound calls on a route only while it is active.

1. Define a time condition under Call Control > Business Hours and Holidays.

   

2. Apply the time condition to an outbound route: a. Go to Call Control > Outbound Route. b. In the Time Condition section, pick the condition that should govern when the route can be used.

   c. Click Save, then Apply.

Note

Time conditions are configured under Business Hours and Holidays, where you can also set up holiday schedules that override your regular hours.

Caution

A route limited to business hours rejects every call through it outside those hours, including legitimate after-hours calls. If some staff (on-call technicians, night shift) need to dial out after hours, give them a separate route that is not time-restricted.

Restrict dialing by country or region

If your team works with partners or customers abroad, you will need international dialing enabled, but that capability is a prime target for international toll fraud, which can run up large bills quickly. Keep the exposure small by allowing international calls only for the users who need them and only to the destinations they actually reach.

1. Grant international dialing permission to the right extension: a. Go to Extension and Trunk > Extension and open the extension. b. On the Security tab, clear the Disallow International Calls checkbox.

   c. Click Save, then Apply.

2. Turn on dialing to the specific countries or regions you need.

   a. Go to Security > Security Settings > Allowed Country Codes. b. Turn on Enable Allowed Country/Region Code Dialing Protection. c. In International Dialing Code, enter your country’s international call prefix. d. In the Operations column, enable each country or region you want to allow. e. Click Apply.

3. Confirm that at least one outbound route matches the international dialing code and is available to the extension, so the permitted calls can actually leave the system.

   

Note

The International Dialing Code is the prefix users dial before a country code to place an international call. In the United States and Canada that prefix is 011.

Caution

Three things must line up before a permitted international call will connect: the extension must be allowed to dial internationally, the destination country or region must be enabled, and a matching outbound route must exist. If any one of the three is missing, the call is rejected. Configure all three, then test with a real number.

Block specific phone numbers

Toll fraud often works by pushing a flood of calls to premium-rate numbers (numbers that bill a high per-minute rate, part of which the number’s owner collects). The fraudster takes the revenue and you receive the bill. Blocking those destinations shuts down that path. You can block individual numbers or whole ranges using number patterns.

1. Go to Call Features > Blocked/Allowed Numbers > Blocked Numbers.

2. Click Add and enter the numbers users must not be able to dial.

   Tip

   You can enter exact numbers or number patterns to block a whole range of destinations at once, such as a premium-rate prefix.

   

3. Click Save, then Apply.

Limit how often users can dial out

Capping the number of outbound calls an extension can place in a given window stops a compromised account from generating traffic at machine speed: once the limit is hit, further calls are refused. Cloud Voice ships with a default rule of up to 5 outbound calls per second per extension. You can rely on that default or create your own rule and assign it to specific users.

Note

The built-in default (5 outbound calls per second per extension) is already enough to stop automated fraud. You only need a custom rule when you want a tighter limit for particular users, so most extensions can be left on the default.

1. Create a custom frequency rule: a. Go to Security > Security Rules > Outbound Call Frequency Restriction. b. Click Add to define the rule.

   c. Click Save.

2. Apply the rule to the relevant extensions: a. Go to Extension and Trunk > Extension and open the extension. b. On the Security tab, choose your rule from the Outbound Call Frequency Restriction drop-down.

   c. Click Save, then Apply.

Cap concurrent calls on a trunk

Limiting how many outbound calls can run at the same time over a SIP trunk (a carrier connection that uses SIP, the Session Initiation Protocol, to set up calls) keeps an attacker from launching a large volume of simultaneous calls through it.

1. Go to Extension and Trunk > Trunk and open the SIP trunk.

2. On the Advanced tab, set a value for Maximum Concurrent Calls.

   

3. Click Save, then Apply.

Caution

Set this cap high enough to cover your busiest legitimate moment on the trunk. If it is lower than your real peak, valid outbound calls will be rejected once the limit is reached.

Cap outbound call duration

Automatically ending calls once they reach a set length limits both accidental misuse and runaway costs from a fraudulent call left connected. You can enforce a limit for everyone at once or for individual users.

Caution

When a call reaches this limit the system ends it automatically, cutting off the conversation in progress with no warning. Set the value high enough to clear your longest normal calls (support sessions, conference bridges) so you do not disconnect legitimate calls. The global setting applies to every user at once.

For all users (global setting)

1. Go to PBX Settings > Preferences.

2. In the Basic section, set a value for Max Call Duration (s).

   

3. Click Save, then Apply.

For specific users (per-user setting)

1. Go to Extension and Trunk > Extension and open the extension.

2. On the Security tab, pick a value from the Max Outbound Call Duration (s) drop-down.

   

3. Click Save, then Apply.