This is a new one on me.

A new client has had 3 months of >$250 usage charges over normal on their CF'd 800 number.

It took me a while to figure out where the $$ were coming from that the Perps were harvesting. I'm familiar with Telecom fraud using your (leaky) PBX to tandem out through us, passing intel via voicemails or worse. It seems pretty high level for them to make money on the intermediate carriers connection fees but from what I'm reading it isn't that uncommon for rural companies to pull this scam.

As these are incoming calls with spoofed CID I'm at a loss as how to block THEM but allow valid 800# traffic through?

They have a KXTD1232 with a TVA 50. I do not know versions yet but the VM was replaced about 2 years ago so I hope the firmware is up to date.

Any clues better than changing their number or simply disconnecting it?

I considered a trap on the front end requiring an extra digit to continue in, but if they are persistent we would end up changing it all the time. This won't stop the 30 second calls but it will stop the 60 MINUTE calls.

Like I said, I had never heard of this before. I am hoping someone else has had experience with preventing this and can give me some clues.

Thank you.

Might do a recording on the front side, make it repeat multiple times, make 0 go back to the beginning, make people dial 3 digits to access anything. It should detour most bots, but humans should still be able to get through.

Yeah, I think that could help and I'm considering that.

I was really hoping for a cleaner fix though. In my 40 years of telecom, I've done and I've seen and done a lot of weird things and was completely surprised this was something I had never even heard ANYTHING about before..

Thanks for any more clues.

Sounds like that's grounds for a police complaint if your provider isnt taking action. You're being defrauded by these callers. In a functioning world your provider would credit you and go after the criminals abusing their system. I'm sure you're not the only victim.

Yeah, the fine print is it's your problem. When 888 opened up, I thought I'd go for putting my regular number on 888. My number is 352-4477. Innocent enough. I kept that number for about 2 weeks.

Check out the back of a Frito-Lay bag of anything they make. Their number? 800-FLCHIPS.

Oh Noooooo!

You'd be amazed by the number of calls I got, after hours, when it clearly says call like 8-5 Central time.

I haven't figured out how to stop the inc. calls but I DID discover the original attendant had left months ago.

The owner disabled her mailbox,

After hours calls would come in.

The "do nothing loop" (No DTMF ) went to 0 which had been the old attendant, 107.

With no MB it, the transfer would time out and return to the front end and start over.

This apparently looped for 28 min or 60 at night and I have no Idea what the difference was They were still getting 5-8 Day calls that are no party and drop offs.

I fixed the attendant loop and am waiting to see the new traces.