Outbound calls being redirected to phishing recording/live person.

[medic0305]

Not really sure where to start. One of my clients sent me a video today of an intermittent issue that happens a few times a day. When they make an outbound call they get an IVR recording that says "to continue your call please press one. When my client presses one they are connected to a live person that says they have won a 100 dollar gift card and they start asking for information to redeem the gift card. This happens at random across multiple phone numbers even trusted numbers such as when dialing my personal cell phone. I confirmed this by listening to the recordings on 3cx dashboard. When checking the call logs it shows the original number that was dialed but does not show the call being forwarded at all. Does anyone have any ideas where I can start to remedy this issue?
My 3cx version is: 18.0 Update 4 (Build 965) hosted through 3CX directly not self hosted

 

[SweetAction]

It's probably happening on the SIP trunk side. Who is the provider and have you opened a case with them?

 

[medic0305]

I haven't yet. I figured it was on 3cx because when calling in I get the normal IVR as planned but when we click one for sales is when it redirects to the malicious scam call center. sip provider is flow route.

 

[medic0305]

I checked the CDR on flowroute and everything seems normal it does not look like it redirects to another number on the sip side

 

[Pierre_3CX]

Hi,
When users make an outbound call in 3cx, it goes directly to the outbound rules, and then to the voip providers defined, there can't be any intermediary hop within the system. This means that the issue you describe happens on the voip provider level or even further downstream on the telcos level.

 

[SweetAction]

Is it inbound or outbound calls?

You say "when dialing my cellphone" which implies outbound calls.
But then you say "when calling in I get the normal IVR". which implies inbound calls.

If the issue is both ways that's good information. But if it's only 1 way, it will shed some light on where the problem lies.

Flowroute support has been great in the past, that being said it's unlikely to an issue on their side. But their input on what they see on these problematic calls will be very useful.