There’s a story going around in finance circles about a group of people who made millions—not from hacking or scamming, but by exploiting a wrinkle in the Texas Lottery system.
Lotto Texas isn’t the flashiest of lotteries. It’s slow-moving, undersold, and occasionally, if the jackpot rolls over for long enough, you reach a mathematical oddity: it becomes profitable to buy every possible combination. In 2023, that’s exactly what someone did.
A Malta-based gaming firm partnered with Texas retailers and got the state to approve a plan that let them rapidly print nearly 26 million tickets using special terminals. The result? A guaranteed win. They spent about $25 million and walked away with a lump sum payout of nearly $58 million.
This wasn’t a scam. It was… legal. Clever. Painstaking. And most importantly—it was the result of someone asking: “Is there a way to get free money if I just work hard enough?”
Now let’s bring that back to telecom.
Why toll fraud still exists
Every time a SIP device connects to your network, there’s a potential for abuse. Hackers, like lottery arbitrageurs, are simply looking for cracks—small weaknesses that, with enough effort or automation, can be exploited to create “free money.”
Except this time, that free money comes out of your bank account.
Toll fraud happens when attackers make unauthorized international or premium calls through your telecom infrastructure. They might hack a phone, a PBX, a SIP trunk, or even an admin portal. And every minute the calls go unnoticed, the meter keeps running.
So how do you stop it?
Let’s walk through the three pillars of protection from our Toll Fraud Checklist: Prevent the Hack, Limit the Impact, and Spot the Hack.
1. Prevent the Hack
Just like the Texas Lottery could have said “No” to those extra terminals, you can reduce your attack surface before hackers even try.
- Enforce SIP authentication
Every device—PBX, phone, or SIP trunk—should require a username and password. No exceptions. - Use strong, unique passwords for all subscriber accounts
It’s not uncommon for hackers to log into user portals and simply forward calls to an international number, so every subscriber account (whether the phone or the CommPortal user interface) needs to be secure. - Restrict access to admin interfaces
Web portals for PBXs or phones should never be accessible from public IPs. If possible, disable them altogether or use access control lists. - Block registrations from suspicious user agents
Many soft clients used by hackers have known signatures. Whitelist known-good devices or at least block known-bad ones.
2. Limit the Impact
Even if someone gets in, they don’t need to clean you out. You can build firewalls—not the network kind, but financial ones—into your call routing logic.
- Disable international and premium calling by default
Most subscribers don’t need it. Enable only on request. - Block call forwarding to international destinations
It’s rare that someone wants to forward their home phone to Uzbekistan. Block it by default. - Watch out for World Zone 1
Some Caribbean and US territories have 1+10D dialing, but carry high rates. Consider blocking or at least flagging these calls. - Limit concurrent calls per line
If a hacker compromises a device, don’t let them spin up dozens of simultaneous calls. - Disable outbound calling after hours
This is extreme, but for business accounts you could even consider time-based call restrictions or PIN codes outside business hours. Hackers love to exploit the vulnerability at 3am on a Sunday morning, and most businesses aren’t making a lot of calls at that time!
3. Spot the Hack
You may not stop every intrusion, but the sooner you notice, the sooner you can shut it down.
- Monitor registration failures
Brute force attacks often show up as spikes in failed logins. Use alarms or analytics tools to alert you. - Track call volumes in real time
Unusual spikes in call attempts—especially after hours—should raise immediate flags. - Use fraud detection tools
There are software solutions that actively monitor your traffic and alert you to suspicious patterns. TransNexus and others offer options tailored for telecom.
You don’t need to be a lottery genius. Just be prepared.
The folks who “won” the Texas lottery didn’t break any laws—they just saw an opportunity and had the operational expertise to pull it off.
Hackers think the same way. They’re scanning ports, reading user manuals, testing default passwords, scripting logins. If there’s an opening, they’ll find it.
But you don’t have to make it easy.
Take a moment to download the Toll Fraud Checklist, or reach out if you’d like help reviewing your system. We’re happy to assess your current setup and help you lock down the most common vulnerabilities. Please contact us if you’re interested.
Because there’s no such thing as free money—especially when it’s coming out of your pocket.
