9.4 Webex Calling Toll Fraud Prevention, Call Permissions & Operating Modes
Key Takeaways
Outgoing call permissions are set per location by call type, with International and Premium Services blocked by default, and users, workspaces, and virtual lines can override them.
Each call type can be allowed, blocked, set to require an authorization code, or auto-transferred to one of three numbers, and each has an Allow transfers/forwards option.
Clearing Allow transfers/forwards on costly call types stops outside callers from being transferred or forwarded back out to expensive numbers, the classic hairpin fraud path.
Webex Calling supports up to 1,000 authorization codes, and permissions by digit pattern can allow selected countries while international calling stays blocked.
Operating modes (scheduled, holiday, or non-scheduled) are assigned to auto attendants, call queues, and hunt groups through Forward calls by modes, and mode managers can switch them from User Hub or phones.
9.4 Webex Calling Toll Fraud Prevention, Call Permissions & Operating Modes
Blueprint objectives 5.3 (implement toll fraud prevention on Webex Calling), 5.4.g (call permissions), and 5.4.a (operating modes) all deal with controlling what callers can do and where calls go. In Webex Calling the main tools are outgoing call permissions, authorization codes, transfer and forwarding controls, and mode-based call forwarding.
1. Outgoing Call Permissions
Every outbound call is classified into a call type (Section 9.3), and each call type has a permission. Permissions are set as defaults for each location, and individual users, workspaces, and virtual lines can use custom settings that override the location.
| Call type | Default | Transfers and forwards allowed by default |
|---|---|---|
| Internal | Allow | Yes |
| National | Allow | Yes |
| Toll free | Allow | Yes |
| International | Block | No |
| Operator assistance | Allow | Yes |
| Chargeable directory assistance | Allow | Yes |
| Special services I and II | Allow | Yes |
| Premium services I and II | Block | No |
Each call type can be set to one of these actions:
- Allow or Block.
- Requires authorization code: the caller must enter a valid code before the call proceeds.
- Auto-transfer to number 1, 2, or 3: the call is redirected to a configured number, for example an operator who can approve the call.
Each call type also has an Allow transfers/forwards option. Clearing it stops users from transferring or forwarding calls to that type of destination, which closes the classic hairpin fraud path in which an outside caller is transferred or forwarded back out to an expensive number. Local and long-distance were once separate types; they are now combined as National.
Permissions by digit pattern add finer control: an administrator can allow or block specific numbers or ranges, for example allowing international calls only to +44 and +49 while international calling stays blocked in general.
2. Authorization Codes
Authorization codes protect expensive call types without blocking them outright:
- A call type set to Requires authorization code prompts the caller for a code.
- Codes are managed for the location and can be customized per user; Webex Calling supports up to 1,000 authorization codes, and they can be provisioned in bulk.
- Detailed call history records the authorization code used, so costs can be traced to the person who authorized them.
3. Incoming Permissions and Other Controls
- Incoming call permissions control, for example, whether users may accept collect calls and whether calls that arrive from outside can be transferred or forwarded externally.
- Feature settings: Auto attendants, hunt groups, and call queues can forward or transfer calls; set their forwarding destinations and the permissions of the features themselves with the same care as user permissions.
- Voicemail: Strong PIN rules stop attackers from using a mailbox's notification or transfer features to reach outside numbers.
- Local Gateways: A premises gateway still needs CUBE's own toll fraud protections, such as the trusted address list, because the PSTN side of the gateway is outside Webex Calling's control.
4. Operating Modes
Operating modes route calls differently depending on time, day, or a manual switch. They are created under Calling > Features > Operating Mode at the organization or location level:
- Scheduled modes: same hours every day, different hours each day, or holiday schedules.
- Non-scheduled modes: no fixed times; active outside other modes or when a user switches to them.
- Each mode has a default forwarding action: forward to a destination (optionally to voicemail) or do not forward.
Modes are applied by enabling Forward calls by modes in the call forwarding settings of an auto attendant, call queue, hunt group, or Customer Assist queue. The order of the assigned modes sets their precedence when schedules overlap; in Cisco's example, a Lunch mode is placed above a Day mode so the lunch routing wins between noon and 1 p.m. Each assigned mode can use its default forwarding or its own destination.
Mode managers: Administrators can let a user, such as an office manager, manage modes for specific features. That user can switch or extend a mode from User Hub or from mode-management line keys on supported 98xx and 88xx phones (up to five features on a phone). A manual change puts the feature into an exception state, shown in Control Hub as amber (automatic switch back) or red (manual switch back), until it returns to normal operation.
Limits to remember: up to 100 organization-level modes, 100 modes per location, and 150 holiday entries.
5. Putting It Together: A Toll Fraud Review
| Risk | Webex Calling control |
|---|---|
| Calls to premium-rate or international numbers | Keep International and Premium Services blocked (the defaults), or require an authorization code |
| Outside callers transferred or forwarded to expensive destinations | Clear Allow transfers/forwards on costly call types and review incoming permissions |
| A few staff need international calling | Custom permissions on those users, or permissions by digit pattern for approved countries |
| After-hours calls reaching unattended phones | Operating modes on the main number's auto attendant or queue that forward to voicemail or an answering service |
| Fraud through the premises PSTN gateway | CUBE trusted list and dial-peer design on the Local Gateway |
A Webex Calling location keeps the default outgoing call permissions. Which call types are blocked by default?
Internal and special services
Toll free and operator assistance
National and chargeable directory assistance
International and premium services
Fraudsters call a company's auto attendant and get transferred back out to national numbers that charge premium rates through call forwarding tricks. Which Webex Calling setting most directly stops calls being transferred or forwarded to a given call type?
A translation pattern that rewrites the auto attendant's number to an internal extension.
The internal extension length setting under the location's Internal Dialing.
The Allow transfers/forwards option on that call type in the outgoing call permissions.
The route group priority values of the location's Local Gateway trunks.
A small office wants calls to its main number answered by a call queue during business hours, sent to a receptionist at lunch, and sent to voicemail at night, with the office manager able to extend lunch from a desk phone. What should the administrator use?
Operating modes on the call queue's Forward calls by modes, with the office manager allowed to manage modes.
A dial plan that sends the main number to a Local Gateway trunk at night and back to the call queue each morning.
An authorization code that the office manager enters every day at lunchtime.
Three separate Webex Calling locations, each with a different main number and schedule.
Sections you finish are checked off in the contents.