Prevent and Mitigate Toll Fraud Attacks in Okta

International Revenue Sharing Fraud (IRSF), or toll fraud, occurs when malicious actors generate a high volume of international calls to premium-rate numbers using Voice or SMS authentication factors. Prevent and mitigate toll fraud in Okta by securing user provisioning, utilizing network zones, monitoring system logs, and configuring rate limits.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Voice Multi-Factor Authentication (MFA)
• SMS Multi-Factor Authentication (MFA)

What are the implications of toll fraud attacks?

Toll fraud attacks contribute to the creation of fake accounts, which leads to higher operational costs, a devalued user base, and the need for administrative cleanup. High volumes of toll traffic impact the deliverability of Voice and SMS messages for legitimate users because providers block numbers based on the destination country. Additionally, toll fraud increases active Monthly Active Users (aMAU) counts, resulting in higher billing for usage and telephony APIs.

NOTE: Okta does not issue refunds for the use of telephony APIs if toll fraud occurs and administrators have not implemented the mitigations outlined in this article.

Okta Implements Default Mitigations for Toll Fraud

Okta mitigates toll fraud by default using several measures to restrict traffic and alert administrators.

• Service cap for SMS and Voice traffic: Okta blocks all Voice or SMS traffic for 24 hours if the environment reaches the service cap limit. Requests receive a 429 error message. Voice and SMS have separate limits; reaching the limit for one factor only blocks that specific factor.
• Per-user rate limits: Okta enforces per-user Voice and SMS enrollment rate limits to prevent a single user from flooding the environment with malicious calls.
• Active attack alerts: Okta Support sends notifications during an active toll fraud attack.

Administrators Must Secure User Provisioning Methods

Secure user provisioning and prevent the creation of fake accounts by implementing specific security recommendations.

• Block account creation from known malicious geolocations.
• Validate user registration using email-based verification.
• Integrate with identity-proofing tools to determine if an email address originates from a fake domain.
• Implement rate limiting on custom registration pages to prevent fraudsters from generating large volumes of fake accounts.
• Deactivate fake users to prevent fraudsters from rotating through accounts to generate calls.

How do network zones block malicious traffic?

Utilize Okta network zones to block traffic from known malicious IP addresses before authentication occurs. Fraudsters cannot access Okta sign-in and registration pages if the attempt originates from an IP address or network identified in a blocked network zone policy.

Administrators Can Disable Voice MFA or Control Access Per Group

Deactivate Voice MFA if users do not require it. Navigate to Security and select Multifactor to disable the feature. If users require Voice MFA, restrict new account enrollment until administrators complete identity proofing to ensure the account is legitimate.

How do administrators monitor malicious activity in the System Log?

Monitor suspicious voice activity using a third-party monitoring tool or directly within the Okta System Log. The following example uses Splunk, but administrators should use a tool that best fits organizational guidelines. Deactivate bad actors and fake users based on the output of these queries.

• Checks the field system.voice.send_phone_verification_call and analyzes whether the count of the combination of User, IP Address & User Agent is greater than a certain threshold (that is, where count > 20).
• The threshold can be set based on the search timeframe. If the search is run every hour, the threshold can be set to a value that is higher than the benign activity during the hour.

event_type="system.voice.send_phone_verification_call"| stats count values(client_geographical_context_country) as Country dc(target1_alternate_id) as unique_count_phone_numbers by actor_alternate_id, client_ip_address, client_user_agent_raw_user_agen| where count > 20| table actor_alternate_id, client_ip_address, client_user_agent_raw_user_agent, Country, unique_count_phone_numbers

Explanation of fields in the above query:

• event_type: Event recorded by Okta based on user action. In this case, the event indicates that phone call verification was initiated.
• actor_alternate_id: Email address of the user.
• client_ip_address: IP address of the user.
• client_user_agent_raw_user_agent: User-agent string.
• target1_alternate_id: Mobile phone number to which the verification call was sent.
• client_geographical_context_country: Geo location of the user’s IP address.

Administrators Can Contact Okta Support for Additional Mitigations

Implement additional restrictions on the environment by contacting Okta Support to perform administrative actions.

• Allowlist countries: Provide an allowlist of approved countries to Okta Support. Okta blocks Voice MFA calls to all other countries not included on the allowlist.
• Modify rate limits: Request strict rate limits on Voice and SMS enrollment endpoints to decrease the frequency of new account creation during an active attack.
• Disable Voice MFA: Request Okta Support to permanently disable Voice MFA on the environment.

• The System Logs query below can also be used to filter all the Toll Fraud events:

  eventType eq "system.sms.send_factor_verify_message" and outcome.reason eq "Toll Fraud Suspected"

Administrators Can Integrate Partner Solutions for Identity Proofing

Integrate with identity-proofing solutions for new account creation. Enable user self-verification through document-based or knowledge-based proofs to improve identity confidence and approve access for authorized individuals.