Security & compliance
Security and Compliance on Every Route
Toll fraud is the most expensive thing that can happen to a VoIP account. Bad caller ID is the fastest way to get your calls blocked. We build controls for both into the account and expect customers to follow the rules of the countries they call.
Fraud protection
How toll fraud happens, and what stops it
Most fraud starts with a weak SIP password or an exposed PBX. The attacker then pumps calls to premium or high-cost destinations, usually overnight.
IP authentication
Only traffic from your whitelisted IPs is accepted. A stolen password alone is not enough.Prepaid balance
The account cannot spend more than its balance. There is no surprise invoice at the end of the month.Channel and spend caps
Limit concurrent calls and daily spend to what your business actually uses.Destination control
Block countries and premium ranges you never call. Open them again when you need them.Alerts
Low balance and unusual traffic alerts go to the contacts on your account.Your side
Strong passwords, no open SIP ports, fail2ban or an SBC in front of the PBX, and current firmware.
Full walkthrough: VoIP toll fraud: how it happens and how to stop it.
STIR/SHAKEN
Call authentication in the United States and Canada
STIR/SHAKEN signs each call with an attestation level. Terminating networks use it, with other signals, to decide how a call is presented.
| Level | Meaning | Typical case |
|---|---|---|
| A — Full | Provider knows the customer and that they may use the number | Calling from a DID the customer holds with the provider |
| B — Partial | Provider knows the customer, but not their right to the number | Customer sends a number held elsewhere |
| C — Gateway | Provider only knows where the call entered its network | International traffic handed over at a gateway |
Robocall rules (TCPA and FCC/CRTC regulations) still apply whatever the attestation. Read STIR/SHAKEN explained and the United States page.
Caller ID
Caller ID (CLI) rules
Everywhere
United Kingdom
Other markets
DID KYC
Know-your-customer for phone numbers
Phone numbers are a regulated resource. In many countries the provider must record who holds each number, and in Germany and several other EU countries you usually need a local address or proof of presence.
We ask for what the destination requires, typically a company registration or ID, an address, and sometimes a description of how the number will be used. Requirements change, so our team confirms current requirements before activation. More in buying DID numbers abroad.
| Requirement | How often |
|---|---|
| Company or personal ID | Most countries |
| Proof of address | Common |
| Local address in country | Germany, several EU states |
| Number usage description | Some regulators |
FAQ
Security and compliance questions
Who pays for fraudulent calls?
Calls made through your account are billed to your account, including calls made by someone who broke into your PBX. That is why prepaid balance, spend caps and destination limits matter: they cap the damage before it grows.
What attestation will my US calls get?
It depends on whether the calling number is one we can verify you are entitled to use. Numbers you hold with us can be signed at a higher level than numbers we cannot verify. Talk to sales about your exact setup.
Why do you need ID documents for some DIDs?
Many regulators require the provider to know who holds a number, and some require a local address. We collect what the destination requires and nothing more.
How do I report abuse coming from your network?
Email [email protected] with the calling number, called number, date, time with timezone, and what happened. Reports are read and acted on.