Phone frauds sting NZ firms

Photo / Supplied

International fraudsters are hacking into unsecured phone exchanges of about 40 New Zealand companies a month and have ripped off $50,000 of phone calls, the Telecommunications Industry Group says.

TIG, formed last year as a single voice for New Zealand's telecommunications industry, says companies are losing hundreds of thousands of dollars a year through this fraud, which has increased four-fold this year.

TIG chief executive Rob Spray said organised crime gangs overseas were behind the fraud, which was costing businesses in the United States about US$4 billion ($5.6 billion) a year.

Losses had increased in New Zealand as more and more small businesses installed private automatic branch exchanges (PABXs) as they became cheaper, but were not aware of the need to use secure passwords and monitor settings, he said.

The fraudsters had set up automated systems that dialled thousands of numbers a minute to find insecure PABXs - with either no password, a factory default password or a common number sequence such as 1234.

Once they hacked into the PABX the main method of fraud was to sell its access to groups running call centres, many of them set up in Europe and North America, who onsold cut-price phone call minutes to customers.

"The calls are redirected through your office PABX. This could be someone in Italy calling someone in Somalia and it will be routed through Joe Bloggs' company at Paraparaumu," Spray said.

"The charges go through to Joe Bloggs and the extent of this is huge."

Spray said the scams were generally traced within about two days by New Zealand telcos, using software looking for strange billing patterns.

"The average level of loss is about $10,000 per event and at the maximum level we've got records of $30, $40, $50,000 hits."

The companies owning the insecure PABXs were liable for the financial loss, he said.

TIG has made a number of recommendations to guard against PABX fraud, such as choosing a strong password, keeping it confidential, and reviewing system security settings regularly.

- NZPA