What Is IRSF and How Can It Run Up an AI Voice Agent Bill?

Most of the ways an AI voice agent can cost you money are accidents. Someone calls and talks for twenty minutes. A customer tests it ten times. A busy week sends a pile of calls through at once. These are annoying but bounded.

There is one way that is not an accident, and it is not bounded unless you bound it. Somebody makes your voice agent call phone numbers they own, because every minute of that call pays them. The scheme has a name in the telecom industry, international revenue share fraud, usually shortened to IRSF, and it is older than voice AI. What voice AI changed is how easy it is to find a system that will place and hold a call for you without anyone watching.

I want to explain how it works in plain English, walk through a real case with real numbers, and show what stops it. It is one of the six abuse patterns in our guide to securing an AI voice agent, and the one most likely to surprise a business owner, because the bill arrives from your phone provider, not from the AI.

Here's what matters most:

• IRSF means a criminal gets paid a share of the fees when your system calls their numbers. You pay the bill. They collect.
• Any voice agent that can start calls, or be made to transfer calls, to an arbitrary number can be used for it, including a demo that nobody advertises.
• In a documented August 2026 case, one unprotected voice demo made 921 calls in about four hours, 920 of them to one Israeli number range, for a bill of roughly $982.
• The calls were not hacking. Each one used a feature working as designed, which is why checking that callbacks are genuine would not have stopped it.
• The fixes are boring: no outbound dialling unless needed, country and range restrictions, per-call and daily limits, and spend limits that cut calls off automatically.

How IRSF works

Phone calls between countries and networks involve fees. When you call a number, your phone company pays the company that connects the call at the other end. Normally that is a tiny amount, and the fee goes to a real operator serving real customers.

The fraud exploits one fact: in some number ranges, the company that owns the number can share the connection fee with whoever sends it the traffic. A criminal gets hold of numbers in such a range, or sets up a deal with an operator that will pay them a cut, and then needs only one thing, a lot of calls to those numbers. The calls must connect, and the longer they last the better, because the fee is charged per minute.

Where do the calls come from? From other people's systems. The criminal finds a business phone system, a website button, a phone verification form or a voice assistant that will place calls, and uses it to dial their own numbers. Twilio, a large provider of programmable phone services, defines toll fraud, the other name for IRSF, as exactly this: an application exploited to generate a high volume of calls to the fraudster's own premium numbers, with the victim carrying the full cost of each minute.

The industry treats it as a serious problem. The Communications Fraud Control Association, which surveys telecom operators, estimated global telecom fraud losses of about $38.95 billion in 2023, according to secondary reports of its survey. I could not confirm the share attributed to IRSF from a primary source, so I will not quote one. Twilio's own guidance puts the industry-wide cost of IRSF at roughly $10 billion a year, and says it has identified thousands of narrow number ranges used mainly to terminate this kind of call. These are industry figures from parties with an interest in the topic, so read them as a sense of scale, not a precise count.

SMS pumping is the same idea with text messages instead of calls. Attackers feed a signup or verification form lots of phone numbers, the form sends a text to each one, and the business pays for every message. Voice versions exist where a form triggers a phone call with a code instead. Both exploit the fact that a business pays per message or per minute whether or not the person on the end is real.

A real case, with the numbers

In October 2026, Twilio published a first-hand account from one of its developer advocates, Rishab Kumar, of what happened to a voice AI demo he built. It is the clearest case I have found, partly because he had the logs to reconstruct it.

The demo let a visitor pick a model, a personality and a voice, enter a phone number, and receive a call from the AI. The server request that created each call had no login. The code sat in a public repository and ran on a public domain. He had never promoted it and could not tell how the attacker found it.

On August 15, 2026, between about 10:30 in the morning and 2:40 in the afternoon, Central Time, the following happened, according to his logs:

• 1,008 requests hit the call-creation address.
• 921 of them created calls.
• 920 of those calls went to Israeli numbers in the same range, covering 156 different destinations.
• 104 of those numbers were each called seven to ten times, accounting for 851 calls.
• About 98 percent of the calls connected.
• Together they ran for almost 30 hours of connected time inside a four-hour window.

The cost was $971.50 from the phone and voice-agent charges, of which $828.68 was outbound connection fees and $137.34 the voice assistant service, plus $10.58 for the language model, $982.08 in total. By my own arithmetic from his figures, that works out to about 54 cents per connected minute.

What did the attacker's calls look like from inside? The assistant's logs recorded 8,363 prompts with only 541 distinct lines, mostly the same prompts asking the conversation to continue. Some calls played unrelated recorded audio. One recorded line was "Thanks for calling our numbers. We wish you a happy trafficking." No scam script, no attempt to sell anything. Nobody was being deceived. The calls existed to stay connected.

The author could not work out who profited or who controlled the numbers, and said so. I would not guess either.

Why a voice agent is the ideal vehicle

My view is that a voice agent solves a problem for the fraudster that older tools did not. Keeping a call alive used to need a recording, a hold queue or an automated menu, which look automated. A voice assistant keeps a call going by itself. It answers, it talks, it responds to whatever it hears, and it does so in a human-sounding voice. The 98 percent completion rate in the Twilio case is what a healthy, successful call looks like in your reports.

Two features make this worse.

Voice agents are quick to build and slower to protect. A demo can be assembled in a day, and the limits around it are easy to leave for later. The Twilio case is exactly that: a working demo, public, with no login on the call-creation request.

A call transfer is a dial-out in disguise. This is my reasoning, not a documented case, so treat it as such. Many voice agents have a "transfer the call to a number" ability so they can hand customers to a person. If an attacker can influence which number the agent transfers to, or if the transfer destination is not restricted to a short list, the transfer is a way to start a call to an arbitrary number. The defence is simple. Transfers should only ever go to numbers on a fixed list that someone in the business approved.

One more lesson from the Twilio case deserves its own paragraph, because it surprises people. Providers sign the messages they send back to your app, so your app can check that a callback is genuine. This is a good practice. In this attack it would have made no difference. The author's own app made the request to place each call, so the later callbacks were all genuine. The attack worked because the first step, asking for a call, was open to anyone. Authentication belongs on the request that starts the call. Signature checks belong on the messages coming back. Both are needed.

The warning signs

IRSF has a recognisable shape, and if you know it, you can spot it quickly in a call log. Telesign, a company that sells fraud tools, and a switching vendor, ConnexCS, both describe a similar pattern:

• Calls clustered on one prefix or range. Normal business calls spread across many countries and numbers. Fraud concentrates on a handful of ranges. In the case above, 920 of 921 calls went to one range.
• The same numbers called repeatedly. Real customers rarely get called seven to ten times in a few hours.
• Calls at odd hours. Telesign notes that attacks are often timed for nights and weekends, when nobody is watching. The Twilio attack ran in the morning on a Saturday in the author's time zone, but it ran four hours without anyone noticing.
• A high completion rate with no business result. Plenty of connected minutes, no bookings, no sales.
• Spend that jumps without a matching rise in real activity. Compare daily cost with real leads.

The log fields to keep are simple: time, destination country and prefix, duration, source address, and the result of the call. A monthly invoice is far too late to notice. Look at it daily for anything that can place calls, and set alerts for sudden jumps.

What stops it

Every control below is cheap. The point is that none of them is the AI's job.

Do not give the agent the ability to dial out unless it needs it. An inbound-only receptionist has no reason to place an outbound call. If the ability is not enabled, the attack cannot use it.

Authenticate whatever starts a call. For a website button, that means the request must come from your own pages and be limited per visitor. For an internal tool, it means a login. Twilio's author recommends requiring authentication on the call-creation and configuration requests, using expiring access codes for events, and keeping outbound calling off by default.

Limit where calls can go. Turn on only the countries you serve. Twilio's geographic permissions let you switch calling to high-risk ranges off per country, and Twilio says it updates that high-risk list several times a month without publishing it. Other providers offer similar controls. Where a call must reach a specific person, restrict it to an approved list of numbers.

Limit each call. The author capped calls at 120 seconds after the incident. A hard maximum length and a silence timeout turn a thirty-minute fraudulent call into a two-minute one.

Limit the count. A per-number daily limit is useful, but the author points out its weakness himself: it would still allow hundreds of calls spread over 156 destinations. You need a global ceiling on calls per hour and per day as well.

Limit the money. Set usage triggers and budgets at your phone provider and at your AI provider, and connect them to an automatic action such as disabling outbound calling. A spend alert that emails a person is a notification. A trigger that shuts off the ability is a defence.

Separate the risky thing from the important thing. Run a public demo under its own account with its own budget, not inside the account that handles real customer calls. If the demo is attacked, the damage is capped to the demo.

Monitor by destination, not just in total. Subex, a telecom analytics company, points out that watching only the aggregate can miss the signal, because the fraudulent traffic is small compared to your total. Watch answered calls per country and per prefix.

If you only do three things, I would do these: switch off the countries you do not serve, cap the length of every call, and set a spend limit that actually cuts calls off.

What this means if your voice agent is inbound-only

A fair objection is "my agent only answers calls, so this does not apply to me." Partly true. If your agent only receives calls and never dials or transfers out, classic IRSF cannot use it as a vehicle. You can still be hit by the cheaper cousin: a stream of long inbound calls that waste your minutes, which is the ordinary denial of wallet that the standard list of AI application risks, published by OWASP, names as unbounded consumption.

For the businesses we think about most often, such as clinics, trades and property managers, the right posture is the same: inbound only unless there is a reason, a short fixed list of transfer numbers, a maximum call length, and a daily cost ceiling. It is a short list of settings. It is also the difference between an annoying month and a bill that makes you question the whole project.

You can talk to one of our demo agents below. It runs on a web page, not on a phone number, which means it cannot place calls to anyone's phone.

If you are building or buying a voice agent that can place calls or transfer them, this is part of what we design when we build AI voice agents. For how junk calls cause a different kind of damage, read how to stop fake leads reaching your CRM from a voice agent. For the full set of abuse types, see our AI voice agent security guide.

FAQ

What is IRSF fraud?

International revenue share fraud is a scheme where a criminal gets a share of the connection fees when calls reach numbers they control. They use other people's phone systems, apps and voice agents to generate those calls, and the victim pays the full cost. It is also called toll fraud. The calls are typically long, concentrated on a few number ranges, and made at times when nobody is watching.

How does toll fraud affect AI voice agents?

A voice agent that can place calls, or be made to transfer them, can be used to dial the criminal's numbers. In a documented August 2026 case, a public voice demo with no login made 921 calls in about four hours, 920 of them to one Israeli range, costing roughly $982. The agent held the calls open with ordinary conversation, so they looked like successful calls.

How do I know if my phone system is being used for IRSF?

Look for calls clustered on one country or prefix, the same numbers called repeatedly, activity at odd hours, a high completion rate with no business results, and spend that rises without a rise in real leads or bookings. Review call logs daily for anything that can place calls, and set alerts on sudden jumps by destination.

How do I block IRSF on my voice agent?

Disable outbound calling unless needed, require authentication on whatever starts a call, switch on only the countries you serve, restrict call transfers to a fixed list, cap every call's length, add a global daily call limit and set spend triggers that disable calling automatically. Providers such as Twilio offer geographic permissions that block high-risk number ranges.

Is an inbound-only AI receptionist safe from toll fraud?

It is safe from the classic version, because it cannot place calls. It is still exposed to long inbound calls that run up minutes. Cap call length, add a silence timeout, limit simultaneous calls, and set a daily cost ceiling.