Cheap to run, easy to leave open
Voice over IP saved small businesses a lot of money. A cloud phone seat costs €8 to €25 a month, against hundreds per extension for a traditional phone system, with no hardware to buy and no engineer to call when you add a user.
It also moved your phone system onto the internet. NIST's guidance on VoIP is blunt about the trade-off: putting voice on a data network inherits the data network's threats, and needs its own controls rather than the ones inherited from the old phone world[1]. If you run Microsoft Teams Phone, RingCentral, 3CX or any SIP service, the configuration of that system is your responsibility, not your provider's.
Threat one: toll fraud
Toll fraud is the expensive one. An attacker gets into your phone system, usually through a weak extension password or an unpatched on-premises PBX, and uses it to place thousands of calls to premium-rate numbers that they or an accomplice collect revenue from. You get the bill. Telecoms fraud is tracked as a multi-billion problem industry-wide, and international revenue share fraud of exactly this kind is one of the categories the fraud control body reports on year after year[2].
The arithmetic is what surprises people. One extension placing 200 simultaneous international calls at €0.50 a minute generates €6,000 an hour. It happens on a Friday night because nobody is watching until Monday. Most providers cap something, eventually, but the first few thousand euros usually go through.
Six settings stop nearly all of it:
- Long, random SIP passwords, 16 characters or more, never the extension number
- International calling blocked outside business hours, and blocked entirely on extensions that never need it
- A concurrent call limit per extension - most people need one or two
- A spend or minute cap per extension per day
- Unused extensions disabled the day they stop being used
- SIP access restricted to your office IP ranges where the provider supports it
Threat two: SIP registration and interception
SIP is the protocol that sets up calls. It is reachable from the internet, which means it is scanned constantly.
| Attack | What happens | What it looks like |
|---|---|---|
| Registration hijacking | Someone registers as one of your extensions | Calls from IPs and countries that make no sense |
| Call interception | Traffic is captured in transit | Nothing. The calls work normally |
| Toll bypass | Your system is used to route other people's calls | Call volume to a handful of destinations |
| Scanning and flooding | Probing for open ports and extensions | Firewall logs full of SIP probes, dropped calls |
The defence is encryption in both directions: SIP over TLS for the signalling, SRTP for the audio. NIST's VoIP guidance treats confidentiality and integrity of both the signalling and the media as core requirements rather than options[1]. Microsoft's Teams security documentation shows what that looks like when the provider does it by default, with encrypted signalling and media and identity handled through Entra ID[3]. If your provider cannot offer encrypted SIP, that is a reason to change provider.
Threat three: a voice that sounds like your director
This is the threat that changed. Voice cloning needs very little source audio, and a conference recording or a LinkedIn video is enough. ENISA's threat reporting puts AI-assisted social engineering, including cloned voice and video, among the trends reshaping how these attacks are run[4].
The call is short and simple. "It's me, I'm in a meeting, we need to pay this today, can you handle it." It is the same fraud as a spoofed email, with a channel your team trusts more. The FBI's crime reporting continues to rank business email compromise and its variants among the highest-loss categories, and voice is now one of its delivery routes[5].
| What to notice | Why it matters |
|---|---|
| Urgency plus secrecy | Removes the second opinion that would catch it |
| A new payee, new bank, or new country | The whole point of the call |
| A number that is not their usual one | Cheap to fake, easy to check |
| Refusal to switch to video or to be called back | The tell |
There is no technical control that reliably catches this, so use a procedural one: any payment instruction that arrives by phone is verified on a second channel, by calling back the number you already have on file. Written down, applied to everyone including the founder, no exceptions for urgency.
Threat four: voicemail
Voicemail is the part people forget. Default PINs - 0000, 1234, the extension number - are still the most common way in. Someone in a mailbox can listen to client details and contract discussions, set up call forwarding to their own number, and enumerate your other extensions. Force a PIN change on first login, require six digits or more, turn voicemail off for extensions that do not use it, and review access logs monthly.
The compliance side
Call recordings and voicemail usually contain personal data, so a VoIP breach is a personal data breach: under the GDPR a notifiable breach must reach the supervisory authority without undue delay and within 72 hours of becoming aware of it[6]. If your business falls in scope of NIS2, phone system security sits inside the network and information security measures you are expected to have in place, and default credentials on an internet-facing service are not a defensible measure[7]. In Israel, call recordings containing personal data fall under the Privacy Protection Law and its amended enforcement regime[8].
Actually
VoIP security is a configuration job, not a purchase. Strong SIP passwords, call routing limits, spend caps, encrypted SIP and voicemail PIN rules take about two hours and remove most of the exposure. The cloned-voice problem is the exception, and it is solved with a callback rule rather than a product.
If you run a cloud phone system and nobody has reviewed its settings since it was installed, book a free 30-minute call and we will go through the credentials, routing rules, international limits and voicemail settings with you.