Interconnect Bypass What is it? A carrier-specific attack Interconnect Bypass (aka toll bypass fraud, interconnect fraud, GSM Gateway fraud, or SIM Boxing) is the unauthorized insertion of traffic onto another carrier’s network. In this scenario, fraudsters make international calls appear to be cheaper than domestic calls, effectively bypassing the normal payment system for international calling. In Interconnect Bypass, the fraudsters will typically sell long-distance calling cards overseas. When customers call the number on the cards, operators can switch the call to make it seem like a domestic call. While this type of telecom fraud doesn’t directly impact the customer, it certainly drains carriers’ budgets. How? A customer makes a call to an international phone card The call is connected and an operator routes it to a different carrier network Impact: This does not directly impact the customer Carrier minutes are used for fraud, not the …

Understanding the Threat: Telecom Fraud Many individuals are familiar with cybercrime like ransomware or identify theft; however, a large majority of scams against enterprises are instances of telecom fraud. For the year 2020 - telecom fraud cost customers approximately $34.1 million (total reported loss, source: FTC Trends Over Time ). Telecom fraud awareness is especially relevant in 2022 as much of the workforce has been operating in remote or hybrid deployments. With many companies extending the length of time they plan to be remote, they are also revisiting security training for their teams in an increasingly digital landscape. Telecom security should be part of this discussion, so employees have the awareness and tools necessary to protect themselves against cybercriminals. To help companies avoid falling prey to fraudsters, we’ve outlined a few common telecom fraud types. Types of Telecom Fraud Call Forwarding Fraud False Answer Supervision (FAS) Interconnect Bypass Types …

… use FAS refers to the scenario where the answer signal of a call is modified and charged for non-conversational call time. There are three general types of false answer supervision: The carrier returns the answer signal when ringing starts , rather than when the customer answers. This increases the duration of the call, and therefore the cost of the call. A call may even be charged despite being dropped due to no answer. The more fraudulent variant of this scheme involves call diversion . Here, the fraudulent carrier will route the call to a recorded message that plays a ring tone and then a recording. This is intended to keep the calling customer on the line and paying for the call as long as possible. The third example of FAS is when a call is not terminated when the recipient hangs up and waits for the caller to disconnect . During the …

… the Fraud Control  page of Flowroute Manage . See Set a Maximum Outbound Rate to configure this option.  Set up a Destination Whitelist In addition to the maximum outbound rate, we also offer whitelist features. You may use a strict whitelist such that your account would only be authorized to call specific destinations. All other fraud tools are ignored for destinations listed in your whitelist. See Set up a Destination Whitelist for more information. Utilize a fraud management system (FMS) What is it? It’s a Company wide platform to prevent fraud. It can use CDRs of the customer's account to review account calling It monitors for commonly used fraud attacks It’s capable of alerting employees of any suspicious activity How does it help? FMS uses frequently found fraud patterns. It’s an enterprise-wide data analysis platform that works well in detecting many different types of fraud. The …

… on the front-facing PBX access portal PBX phone systems allow users to enable call forwarding to phone numbers. Oftentimes, a malicious party can hack into this process remotely by leveraging the system’s IVR and issuing commands via DTMF (dual-tone multi-frequency) signaling. Another way they can break into the system is by gaining access to an Internet-connected VoIP phone. In either case, the agent redirects the expensive international traffic to the fraudulent numbers, resulting in hefty phone bills to the company. This type of fraud reveals itself through a spike in traffic to high-cost destinations. To make matter worse, this type of fraud often spikes over holidays or weekends when individuals are out of the office and their phone numbers are not securely forwarded to other devices. To mitigate damages, service providers must have a monitoring and alarm system in place that will stop fraud …

To combat the growing amount of fraud in the VoIP industry, Flowroute is offering some fraud prevention features. These tools are provided as a courtesy by Flowroute and do not guarantee to prevent fraud. You are still liable for any damages incurred due to vulnerabilities in your security policies or practices. How fraud prevention works Flowroute analyzes your outbound call patterns to various destinations and creates an average metric that accounts for call duration and cost. If there is a sudden increase in traffic to a destination, the account is flagged, and in-progress calls become automatically suspended. The user receives a notification via e-mail and can either reauthorize the destination or leave it blocked. View your Fraud Control options Log in to Flowroute Manage Portal . Click Preferences on the left panel, and then select the Fraud Control tab. The Fraud Control page contains your current settings and …

What is it? Call Barring is a type of controlled phone censorship. It allows for blocking destinations, or certain specific numbers. How to use it? You can install it in a PBX system with tools for block lists or destination blockers. The tools are specific to the PBX. Call barring lets users bar or block certain types of calls, IP addresses, and destinations from being made to or from their phone. Some systems also let users block outbound calls to chosen destinations. Other options allow for only authorized business or employee IP addresses to make calls. NOTE: Flowroute cannot prevent any inbound caller from reaching a Flowroute DID. Any type of inbound call blocking must be done locally on your phone system.  

All payment information is processed securely in accordance with the PCI Data Security Standard. Payment information is always transmitted over an SSL-encrypted HTTPS connection. Payment information is encrypted with AES-256 and decryption keys are stored on separate machines. The infrastructure for storing, decrypting, and transmitting individual payment transactions runs in separate hosting infrastructure from our primary services (SIP servers, websites, etc).

Never reveal your passwords to others.  Use different passwords for different accounts.  Use Multi-Factor authentication (MFA). Read more in this article . Length trumps complexity. Complexity still counts. Use phrase-based method: choose a password comprised of a sentence and put symbols between the words. Use a combination of uppercase letters, lowercase letters, numbers, and symbols. Use a password manager. The best practice is to set up secure PINs and passwords to the phone system, such as voicemail access, extension lines, and other features that may be compromised if accessed remotely. Conference phones can also be a high target area, which is often forgotten about with poor usernames and passwords. If companies have a lot of passwords for multiple accounts as well as their PBX system, they might find it beneficial to invest in the use of a password generation and saving system.  

… to change. Always verify the rate before making any changes to your account. Search for the country for which you want to set up a maximum outbound rate. Note the rate down. You'll use this as the baseline for setting up your maximum outbound rate. In this example, we're using INDIA - MAHARASHTRA with a rate of $0.0299 per minute. Next, set a maximum outbound rate. Click the Preferences menu, and then click Fraud Control . Go to the Maximum Outbound Rate section. In the Block outbound calls... field, enter the rate that blocks any call if the outbound per minute rate exceeds the rate specified here. For example, if you call INDIA - MAHARASHTRA at a rate of $0.0299 per minute, then you would want to set up a maximum outbound rate rule that blocks calls with an outbound rate higher than $0.0299 per minute. IMPORTANT: If …

… well as all outbound calls to any destination, including the U.S, unless selected in Destination Whitelist. If international calls are failing, check if this rule is enabled, and that your destination country is selected in the whitelist. Destination Restriction Destination Restriction is not a built-in feature in your Manage portal. However, when Flowroute sees an unusual spike of calls to a certain country, such a destination is automatically blocked due to a possible fraud alert and gets added to the Destination Restriction list, under Blocked Outbound Destinations. If you are unable to make outbound calls to certain international destinations, check this list under Preferences -> Fraud Control . If the country is added to this list, make sure to check the Date Blocked to evaluate the traffic. If the traffic is found to be legitimate, you can Unblock the destination, which will allow you to make calls to these destinations …

… called, regardless of the maximum outbound rate or any rate changes. For instance, if India is on the strict whitelist, only calls to India will be allowed, and calls to all other countries will be blocked. Important: Fraudulent activity to countries on your whitelist is possible. We strongly recommend regularly reviewing your call detail records and account balance. How to manage your whitelist configuration Log in to Flowroute Manage Portal . Click Preferences , and then click Fraud Control . Scroll down till you see the Destination Whitelist section. From the Country Code drop-down list, select the country you’d like to add to the whitelist. For this example, we are selecting India . Click +Add Country button. The country is now added to the list of countries to which outbound calls can be made, regardless of whether or not a maximum outbound rate is set. To remove a country from the whitelist …

"Additional Information Needed" There are times where our automated fraud detection system will flag an account for additional manual review. If this happens while creating your account we will need some information to open the account.  If you arrive at the page: “Additional Information Needed” while attempting to set up your account; we will need to verify proof of established identity. You will be provided a link that directs you to our third party identification partner and will only be viable for 48 hours as of sending. Begin by sending an email to  support@flowroute.com  to let us know you are encountering an issue. To expedite your request we use a third party fraud verification system. You will be sent a link in the response to your support email which needs to be followed and provide the verification to our partner with the requested information to clear the …

2FA is now mandated to secure your Manage account and prevent fraud Two-factor authentication methods offered by Flowroute Email (least secure) Yubikey (requires Yubikey device ) TOTP (Time-based One-Time Password) Two-Factor Authentication Guide Navigate to the Manage Portal → Preferences → User Profile or click this link . Under Two-Factor Authentication (2FA) you are given the option to set up one type of 2FA. Confirm you are authorizing Flowroute to create a second layer of security for your account. NOTE: Flowroute Team can not restore access to your account if you lose the two-factor authentication information. Always securely store your backup codes. Yubikey Method Make sure you have your hardware Yubikey with you before you attempt to create a 2FA using the Yubikey method.  Enable 2FA. Insert a token in the field by touching your YubiKey.  Create and save backup tokens. Backup tokens are an extra level …

Sent date: January 18, 2022 We have made important changes to the auto-replenishment setting. We analyzed our customer feedback and payment activity, along with our own support experience, and came to the decision to make these changes. As a result, we provided a way to avoid uncontrolled transactions in the event of fraud caused by compromised phone systems/account credentials. What is different: The maximum amount charged per 24 hour period will be limited to $500. Previously any amount could be set or the option to leave this field blank for no limit. The maximum single auto-replenishment payment amount will be limited to $410. When: These changes are scheduled to be implemented on January 27th, 2022. Impact: The limitation applies to auto-replenishment payments on Credit Cards ONLY. Manual transactions can still be used to fund the account for any amount. Action needed: If you have already …

At Flowroute, we make sure the process of getting your account up and running as fast as possible. As a best practice, we collect your address to provide you with more reliable service and to comply with tax regulations. Why we validate your address? Better service to needed areas Identify usage and currency in provided countries Helps prevent fraud on Flowroute accounts Regulate our customer offerings, DID purchasing, Port Orders. etc. Validate local tax regulations that require the address to be accurate and current What addresses should you use for your account? Addresses on your Flowroute account need to be associated with the most direct end-user of the account. For instance, if you are setting up a Flowroute account for a school in Dallas, TX, but live in Kansas City, MO, you would use the school's location for your Contact Information. If you were setting this up …

… Flowroute in good legal standing and protect our customers. Definition of an account owner An account owner, who owns the email account for which the email is registered on the account, is the only one who can act on the account. If anyone claiming to be an account owner is denied access, without the consent of the account's email holder. The account is considered unable to be acted upon by others either actually or fraudulently claiming to be the owner without verification. This is strictly in place to prevent business partners from interfering or taking over an ex-partner's account or taking any or all DIDs on the account which they deem valuable. The account is protected from outside and fraudulent disturbance as severely as we are able to protect it. Any accused loss of account access to another party must be reconciled with the current account owner …

… Click Preferences on the left panel, and then select the Balance Management tab. Go to the Auto-Replenishment Payments section at the bottom of the page. Important rules on the page are noted in the yellow box: IMPORTANT : You acknowledge and understand that this is an auto-replenishment feature. By enabling this feature you hereby authorize charges to your payment source to replenish your Flowroute account balance. This feature may increase your financial exposure to fraud in the event that your system is compromised and fraudulent calls are sent through your Flowroute account. To limit your exposure to potential fraud, please refer to our article on fraud controls . NOTE: By default, auto-replenishment is disabled until you set it up and authorize it. Set up auto-replenishment of your account by completing the following: Automatically replenish your account balance by : From the drop-down list, select the preset amount by …

… class 3 The 3xx response codes indicate a redirection of the call. 300 Multiple Choices 301 Moved Permanently 302 Moved Temporarily 305 Use Proxy 380 Alternative Service SIP Responses, class 4 The 4xx response codes indicate request failures. 400 Bad Request 401 Unauthorized: Used only by registrars. Proxies should use proxy authorization 407 402 Payment Required (Reserved for future use) 403 Forbidden 403 - Insufficient funds ( often related to the balance on the account or the Fraud control settings for the destination number) 404 Not Found: User not found ( Typically the PBX will deliver when an inbound route is not setup for the DID) 405 Method Not Allowed 406 Not Acceptable 407 Proxy Authentication Required 408 Request Timeout: Couldn't find the user in time 409 Conflict 410 Gone: The user existed once but is no longer available 413 Request Entity Too Large 414 Request-URI Too Long 415 Unsupported Media …

… the International Access Code followed by the E.164 country code and international local number format: [(IDD prefix)[country code](International DID)] For example, Test call from the USA to Philippines: 63-2-2479-7000 Test call from Philippines to USA: 1-232-234-2676 Reasons for failed calls If an outbound number is dialed through Flowroute without adhering to these guidelines, the connection may fail in several ways: The malformed outbound number incorrectly dials a different country or location if the length of the dialed number is incorrect The malformed outbound number will fail completely due to the dialed number not having any destination in that format The malformed outbound number will fail because fraud protection enforces the destination cost limitation. This means that calls exceeding your set cost limit will not be allowed to establish. You can review and adjust your fraud prevention settings in the Manage portal .