Fraud and Toll-Fraud Policy

Version 2026-11-06 · Effective 2026-11-06

This Policy forms part of the Terms of Service. Toll fraud, where criminals use compromised credentials or devices to place large volumes of expensive calls or messages, can generate thousands of dollars of charges in hours. This Policy explains who bears that cost and what both of us do to prevent it.

1. You are liable for traffic from your Account

1.1 You are responsible for, and must pay for, all calls, messages, number purchases, AI usage and other Usage originating from or authenticated with:

• your console users and API keys, including keys used by AI agents and MCP clients;
• your SIP endpoints, registrations, digest credentials and IP-authenticated trunks;
• your BYOC trunks;
• your PBX, IP phones, softphones, gateways, routers and other equipment; and
• your End Users and sub-accounts,

whether or not the Usage was authorised by you, including where it results from theft or compromise of your Credentials or equipment by a third party.

1.2 This applies even where the Usage is caused by a vulnerability in third-party software or hardware you use, or by a person who obtained access through you, your End Users or your contractors.

1.3 We are not liable for fraudulent Usage except to the extent it was caused by a breach of security within our own systems that is not attributable to you or your Credentials.

2. Your security duties

To reduce the risk of fraud, you must at least:

• use strong, unique SIP passwords (at least 16 random characters) and never use extension numbers, defaults or dictionary words;
• use IP allowlists for trunks and restrict registrations to known addresses where your setup allows;
• restrict API keys to the minimum scopes needed, store them in a secret manager, never embed them in client-side code or public repositories, and rotate them regularly and immediately after any staff change or suspected exposure;
• keep PBX and device firmware and software up to date, and disable unused features, extensions, voicemail-to-outbound and remote-access functions;
• not expose PBX management interfaces or SIP ports to the internet without protection;
• disable international and premium destinations you do not need, and set spending and channel limits in the console;
• enable two-factor authentication for console users where available; and
• monitor your usage, alerts and CDRs, and respond promptly to unusual activity.

3. Our right to act

3.1 To protect you, other customers, our network and our carriers, we may, at any time and without prior notice:

• block calls or messages to specific destinations, number ranges or countries;
• set, lower or enforce spending limits, channel limits, CPS limits and daily caps;
• throttle or reject traffic;
• pause auto-recharge;
• disable Credentials, API keys, trunks or devices;
• suspend a sub-account or the whole Account; and
• require you to reset Credentials or provide information before restoring service.

3.2 We will try to notify you promptly when we take such action, by email, in the console or by phone, but we may act first where we believe that waiting would increase the loss.

3.3 We are not liable for any loss caused by action we take in good faith under this section, including blocked legitimate traffic.

4. Fraud monitoring is not a guarantee

4.1 We run automated monitoring for suspicious patterns, such as sudden increases in international traffic, calls to high-risk ranges, unusual CPS, or short-duration call bursts. This monitoring is provided for our own risk management and as a courtesy to you.

4.2 Monitoring may not detect every fraud, may detect it late, and may block legitimate traffic. The presence or absence of a fraud alert does not change your liability under section 1. You remain responsible for securing your systems and watching your own usage.

5. What to do if you suspect fraud

5.1 If you suspect your Account, Credentials or equipment have been compromised:

1. disable the affected Credentials, API keys or trunks in the console immediately;
2. contact support@sip.io and abuse@sip.io with your Account ID, the affected Credentials and the time the activity started;
3. secure and update the affected systems before re-enabling them; and
4. report the crime to the police where appropriate.

5.2 Notifying us does not transfer liability for Usage that occurred before we were able to act, but it helps us limit further loss.

6. Credits and disputes

6.1 Any credit, waiver or refund for fraudulent Usage is entirely at our discretion and does not set a precedent. In deciding, we may consider whether you followed this Policy, how quickly you reported the issue, whether our upstream carriers have given us any relief, and your account history.

6.2 We cannot recover charges we have paid to upstream carriers for fraudulent traffic in most cases, and we are under no obligation to pursue carriers or third parties on your behalf.

6.3 A chargeback for fraudulent Usage is handled under the chargeback provisions of the Terms of Service.

7. Fraud committed by customers

If we reasonably believe you or your End Users are knowingly involved in fraud, including traffic pumping, IRSF, wangiri, SMS pumping or bypass as described in the Acceptable Use Policy, we may terminate your Account immediately, withhold any Wallet balance or payments linked to the fraud, recover our losses and costs from you, and report the matter to carriers, industry bodies and authorities.

8. Related policies

See also the BYOC Terms, the Voice Services Policy, the AI and MCP Services Addendum and the Security page.