IVR security

[RBS]

Today we tried using IVR menu to limit scam calls from getting through. (Very simple, "press 1" connects to ring group).

Was surprised when the reception complained about TONS of scam calls for one day.
And guess what, there is not a single record of it. Not on Caller ID, not in any logs. Nowhere.

If you have any light to shed on this mystery, please do.

 

[cobaltit]

So how do you know they are scam calls? Are they answering them and getting a message? Or are you talking about ghost calls showing something like extension 1000 or extension 1001?

 

[RBS]

So how do you know they are scam calls? Are they answering them and getting a message?

Yes, the calls got answered and actually spoke with them.

What is the most puzzling, is how is this possible without leaving a record in the call logs.

 

[cobaltit]

Which call logs are you referring to? The call log on the phone or the call log in the dashboard? What about the activity log?

 

[RBS]

Which call logs are you referring to?

Activity log, Events (dashboard). I will physically go see the phones to see what they have on their caller ID shortly.

 

[cobaltit]

So the only way calls should hit the phone and not show in 3CX should be direct SIP. The only way direct SIP calls should be allowed is if your phones are not on current firmware and stock 3CX templates. The default template disallows direct SIP calls not originating from 3CX.

 

[RBS]

The default template disallows direct SIP calls not originating from 3CX.

Everything provisioned by 3cx as is (direct stun) and current. Direct SIP impossible (3cx is on google cloud, firewall blocking all incoming traffic except trunk provider and phone IP), phones are behind firewall blocking everything incoming.

Mystery deepens...

 

[cobaltit]

Some firewalls are overly generous in allowing return traffic. They see the phones register out and rather than restricting response traffic in their NAT rules they allow any source matching that port. And since you said phones you would be better of with a SBC which would eliminate that. But if it is 3CX provisioned then it shouldn't matter. Let us know what you see in the phone call logs.