We have a customer that was experiencing toll fraud.  I noticed the FastEthernet0 interface did not have an ACL tied to it.  They do not use SIP.  They have FXO lines only.

Could someone explain to me how someone would be able to come in through the WAN port and go out through the FXO port?

This is where I think the toll fraud was happening but I want to make sure.

Thanks to anyone that can help.