Help! Toll fraud on MICS 3.0 and Startalk Flash 1.7?????

[519tech]

Hey all;

It’s been a while since I’ve had to post for help here, but you’ve all been a great resource in the past!

I have a customer with a MICS 3.0, and a Startalk Flash 1.7. New customer to me. Their carrier, is telling them that their system is hacked? I have gone through the system and found that:
No mailbox has line or pool access.
No CCR tree has been built.(Greeting and menu only.)
Vmail DN’s do NOT have line access.
Vmail DN’s have toll restriction on them anyways!
DISA has no line access, incoming or outgoing.
No RAD on site.
Lines are not Call Forwarded at C.O.
No DN’s have forward capability.
No Destination codes or Routes have been created or defined.
Flash 1.7 does NOT have outbound transfer capability from mailbox.
Lines come straight from inside demarc to the MICS.
Disconnected line they were using to hack from system, and now they have moved to the next line?

What am I missing??????????? Carrier says they are still being hacked!!!!!!

As always, any help is appreciated.

UPDATE: I found the issue. Haven’t see. This one before, in 25 years of doing this! Email me if you would like to know.

Thanks anyways!

 

[curlycord]

Can you just please post what they were doing....I will update the FAQ's if need.

For Flash I have seen them use Off Prem Notify to forward one of their lines using *72011......
They do that at night then do *73 in the morning to go undetected.

________________________________________

=----(((((((((()----=

http://www.curlycord.com

Toronto, Canada

Add me to LinkedIN

 

[519tech]

Hey Curlycord;

That’s exactly what it was. They got into mailbox 222 and set up off prem notification with *72PPP01........
Then they got into mailbox 102 and setup off prem to do a *73.
I have yet to see this!
Most ones it’s a CallPilot. Thanks for the help.