Suspected International Call Fraud

[Mujahed Khan]

I can see some fraud call in the Telecom provider invoice for October 2026......these calls are not showing in 3CX reports....

Any idea how this could have been happened?

My findings indicate that the suspicious calls were limited to three days (22, 24 and 25 October), involving 65 calls to Guinea-Bissau and Burkina Faso, with total charges of approximately AED 2,818.

 

[Alphabetic]

if theyre not in 3CX reports then they didnt originate from 3CX.

 

[NikosT_3CX]

@Mujahed Khan check if the trunk is registered anywhere else, like another PBX.
From the portal of your Telecom provider can you see the source ip of the trunk registrations ?

 

[Mujahed Khan]

Thanks for your response.

Just to clarify, we're using a physical PRI line, connected to our 3CX system through a Patton gateway.

The suspicious international calls appear on our invoice but are completely absent from our 3CX call logs.

In this setup, can we conclusively rule out 3CX if the calls are not reflected in its reports? Or is there any possibility of calls being initiated through the PRI gateway or another route without being recorded in 3CX?

I'm trying to establish whether we should focus our investigation entirely on the telecom provider and PRI gateway, or whether there are any additional checks we should perform within 3CX.

Appreciate your guidance.

 

[NikosT_3CX]

@Mujahed Khan if the calls do not appear on the Reports of the PBX, then the calls were not made from the PBX side.
Yes you can rule out this scenario.
Check the Patton gateway in case there are anyregistrations from any other internal ip.

 

[Alphabetic]

Just to be certain, your call logs still remain? They werent purged? You can see calls in your report?

 

[Mujahed Khan]

@Alphabetic - Yes, all over call logs are there in 3CX except thee fraud calls happend on October 23, 24 and 25......These fraud calls are only showing in Telecom provider invoice. We have a simple setup - 3CX on-prem server, Patton gateway and a PRI line.....Im wondering this would have happened....

 

[Mujahed Khan]

@NikosT_3CX - its a valid point....let me check the Patton gateway......Is the call fraud at PRI Line Patton gateway level common? If the gateway has accepted calls from another internal IP, would those calls bypass 3CX entirely and therefore not appear in the 3CX call reports? Just curious?

 

[NikosT_3CX]

@Mujahed Khan
.Is the call fraud at PRI Line Patton gateway level common?
>> Not really but you never know in these cases.. Since this is local the requests may come from another internal ip.

If the gateway has accepted calls from another internal IP, would those calls bypass 3CX entirely and therefore not appear in the 3CX call reports?
>> Exactly, these would never appear on the PBX side if the calls did not initiate from an endpoint that belongs to the PBX.

Think that someone has the credentials of the gateway and goes and registers a client on it and starts making calls firectly towards the gateway. The PBX would never know that.

But again, this is just a idea to check it out.