Kiwi ISP takes action over PABX fraud

A Kiwi ISP has decided to block phone calls to 28 countries after three of its business customers fell victim to hackers and suffered large losses over just one weekend.

Fairfax reported on Sunday that Orcon has blacklisted calls to mostly African and eastern European destinations, where termination charges can be as high as $18 a minute.

Routing calls to such destinations through compromised PABX or switchboard systems is lucrative for fraudsters, with Orcon telling Fairfax that the three businesses lost a total of NZ$35,000 (A$31,000).

The ISP estimated that in total its customers had lost hundreds of thousands of dollars to PABX fraud, which is why it decided to act to prevent the attacks that "would have been devastating" to small business customers.

Last year, West Australian police said businesses in the state had lost tens, some hundreds of thousands of dollars in PABX-related call fraud.

PABX fraud is a widespread problem and telcos such as Optus are warning [PDF] customers to take precautions against it so as not to run up bills in the tens of thousands of dollars in short periods of time.

These include changing the often easily guessable "1234" or "0000" default pass code on PABX systems to something less obvious, using firewalls, blocking international calls unless necessary, as well as monitoring call volumes, especially outside normal business hours.