fraud protection

There are several ways that telecommunication services may be fraudulently accessed, but it is possible to take steps to minimize fraud exposure on your network. While we at TelePacific hope this never happens to you, we have developed some simple tips to help you minimize your exposure to fraud and to help get to the bottom of the situation if you discover fraudulent activities.

If you fail to implement reasonable steps to avoid toll fraud, you may be responsible for any toll fraud that results. TelePacific will not be responsible for any toll fraud that may result from your failure to take reasonable steps to secure your phone system against fraud, including but not limited to implementing the TelePacific Fraud Guidelines.

If you suspect you may be the victim of fraud, call TelePacific’s Fraud/Loss Prevention Department at (866) 839-8545, Monday through Friday, from 8:00 AM to 5:00 PM PDT as soon as possible and your PBX and voicemail vendors.

Fol style="list-style:decimal" lowing are strongly recommended steps that, if taken, will help secure your network from hackers. Failure to implement these reasonable steps may expose your phone system to a greater likelihood of exposure to fraud. In addition, you should consult your telephone system vendor for additional guidance.

Private Branch Exchange (PBX) Security

A PBX is a telephone system that serves a particular business or office. If the PBX system is not maintained and secured it can be compromised allowing remote hackers to re-originate long distance and international calls undetected to the business.

1. Change the generic code (administration security code) and or existing code. A generic code is the default administration security code set within a PBX/phone system. This code allows administrators of the control style="list-style:decimal" of turning on and off features within the PBX/phone systems. Obtaining generic codes for specific makes and models of PBX/phone systems are made available in the internet, therefore exposure exist with hackers obtaining these codes.
2. Understand the configuration of your PBX/phone systems and eliminate remote access and disable access system. This is most important on IP PBXs in which SIP trunks and open ports for the Public Internet exist.
3. Check for errors and changes in the configurations of your PBX, firewall and router or call processing,
4. Install a firewall and anti-virus software.
5. Check for inbound data spikes.
6. Review your call accounting software or station message detail for abnormal call activities.
   Set threshol style="list-style:decimal" ds to alarm on abnormal call activities during business hours and off hours.
7. Check all your lines to identify which line (s) placed the fraud calls.
8. Block all international countries to include Canada and Caribbean if not normally called directly in your PBX/phone system. A list of the international country codes is provided in this Fraud Guidelines.
9. If you do not accept third party billing, block this in your PBX/phone system.
10. Block casual calling 1010 in your PBX/phone system.
11. Disable or change out the password for Direct Inward System Access - DISA. This feature allows a caller to dial into the system, enter an authorization code and get an outbound line. The codes are often not difficult to crack. A hacker can then use this feature to make long distance calls at the company’s expense. The DISA application will provide dial tone, if the password parameter is "no-password” the calls can complete.        
12. Add long distance or international account codes.
13. Invest in a call accounting software.
14. Run periodic security audits to check for vulnerabilities.
15. Set a specific threshol style="list-style:decimal" d for attempts to enter system and program the PBX to terminate access when threshol style="list-style:decimal" d is exceeded.
16. Discard listings and or directors with PBX access numbers by shredding the information.
17. Only share system’s information to authorized individuals within the company.

Voice Mail System

1. Change the generic code (administration security code) and or existing code. A generic code is the default administration security code set within a voicemail system. This code allows administrators to have control style="list-style:decimal" of turning on and off features within the voice mail systems. Obtaining generic codes for specific makes and models of PBX/phone systems are made available in the internet, therefore exposure exist with hackers obtaining these codes.
2. Set voicemail passwords to hard codes consisting of 6 characters to 10 characters. You must not use extensions and or soft codes 1111 and 1234. The more complex the security codes the harder to compromise.
3. Change user security codes at least every 90 days.
4. Understand the configuration of your voicemail systems and disallow all features which allow remote access into your voicemail equipment to place outbound long distance and international calls. Hackers who have compromised a voicemail box will preprogram the fraud destination number(s). After they’ve done this, they use the transfer feature, pager feature and/or zero out features to place their fraud calls out.
5. Block 011 international outbound calls, 1010 casual calling and third party calls within your voicemail system.
6. Disable unused voice mail boxes especially in areas unoccupied.
7. Do not share your voice mail security codes or have them posted.

Physical Security

1. Keep phone rooms locked.
2. Always validate credentials for all technicians who visit your sites.
3. Fraud perpetrators can gain access to unsecured phone rooms. A device can be clipped on to your line(s) to place fraud calls.
4. Develop a security plan with your shared tenants and building management to secure your phone room.

D. Social Engineering

“Social Engineering” may be used, where a caller manipulates someone into performing an action or divulging confidential information. When the types of calls described below are received, please report the call to TelePacific’s Fraud / Loss Prevention Department. 

A fraud perpetrator may call into a business establishment pretending to be a technician for a phone company. The perpetrator will manipulate the party into pressing certain digits on the telephone keypad, allowing the perpetrator to place free long distance calls. The party will be charged for the long distance calls.

Do not transfer callers to 900, 800, 700 or the first required number for an outside line combined with “0, 0”; this is a fraud scam. Dialing 9 for an outside line and then 00 will give the fraud perpetrator a long distance operator.

E. Modem Hijacking

Modem Hijacking may be used to make fraudulent long distance calls from your computer that is billed to your phone number. Possible steps to prevent modem hijacking include:

1. Turn off your computer and modem when they are not in use.
2. Unplug phone connections from the modem when a modem is not in use.
3. Raise the vol style="list-style:decimal" ume level of your modem, so that you are aware of a redial.
4. Be aware when visiting sites of questionable content, or avoid such sites entirely.  A number of sites download surreptitiously onto consumers’ hard drives.
5. Monitor your child’s use of the Internet.  Consider using blocking software to keep children from questionable sites – adult, gambling, etc.
6. Do not download from an un-trusted web site.
7. Close pop-up windows by selecting the, “X” button in the upper right hand corner, rather than any other embedded icons.
8. Keep your operating system current with patches and updates.
9. Ensure that Internet dial-up access numbers are on your local telephone plan and delete unknown access numbers.
10. Consider installing anti-virus software and update regularly.
11. Disable ActiveX.
12. Software exists to prevent such fraudulent activity.  Web sites where anti-virus or trial version of anti-virus software has been made available include:
    1. www.symantec.com
    2. www.mcafee.com

International Country Codes