Most businesses put reasonable effort into securing their computers, their email, and their network. Then they plug in a phone system and never think about it again. That phone system is connected to the same network as everything else — and attackers know most companies aren't watching it.
Toll fraud: your phone bill just became a five-figure problem
Toll fraud is the most common and most expensive VoIP attack vector. Here's how it works: an attacker gains access to your phone system and starts routing calls through it — typically to premium-rate international numbers that they own or earn a cut from. Your business gets billed for every minute. These calls often happen overnight or on weekends when nobody is in the office.
We've seen cases where a compromised VoIP system racked up $20,000 to $50,000 in fraudulent calls over a single weekend before anyone noticed. In one well-documented case, a small business received a $167,000 phone bill after attackers used their system to call premium numbers in Somalia and the Maldives over a holiday weekend. The phone carrier may or may not negotiate the charges — and many won't.
SIP trunk vulnerabilities
Session Initiation Protocol — SIP — is what most VoIP systems use to set up and manage calls. If your SIP ports are exposed to the internet, automated scanners will find them. Attackers run brute-force tools that cycle through thousands of extension/password combinations. Once they find a working extension, they register a softphone and start dialing.
This isn't theoretical. Security researchers regularly document SIP scanning activity across the internet. If your SIP trunk is wide open, it's being probed right now. The fix is straightforward: restrict SIP traffic to known IP addresses (your provider's IP range) and block everything else at the firewall.
Vishing and caller ID spoofing
Voice phishing — vishing — has gotten more sophisticated. Attackers spoof caller ID to make it look like they're calling from a bank, a vendor, or even your own company's main number. They use social engineering over the phone to extract credentials, wire transfer approvals, or access to systems. Unlike email phishing, there's no link to inspect and no sender address to verify. It's a voice on the phone saying they're from IT and they need your password.
Common VoIP security mistakes
- ✓Default admin passwords on phone system hardware and management interfaces — attackers have the default credentials for every major vendor
- ✓Exposed management interfaces accessible from the public internet instead of only from the internal network
- ✓No call logging or alerting — without monitoring, an abnormal spike in international calling might not be noticed until the bill arrives
- ✓Voice traffic mixed with data traffic on the same VLAN — if an attacker compromises a workstation, they have a direct path to the phone system
Practical steps you can take today
The fixes for VoIP security are not complicated, and most don't require buying new hardware.
- Change every default password on your phone system, handsets, and management portals. Use unique, strong passwords for each.
- Put voice on its own VLAN. Segmenting voice traffic from data traffic means a compromised computer doesn't automatically give an attacker access to your phone system.
- Disable international calling on extensions that don't need it. If your front desk never calls outside North America, block those destinations entirely.
- Monitor call logs for anomalies. Set up alerts for unusual call patterns, especially high-volume international calling outside business hours.
- Restrict SIP traffic. Your firewall should only allow SIP connections from your provider's known IP addresses.
Teams Phone and cloud PBX: a different security picture
If you're on a traditional on-premise PBX, you're responsible for every layer of security — the hardware, the software, the network configuration, and the monitoring. Moving to a cloud-based phone system like Microsoft Teams Phone or a hosted PBX shifts a lot of that burden. The provider handles SIP security, patching, and the underlying infrastructure. You still need to manage user accounts properly (MFA on Teams accounts, for example), but the attack surface shrinks considerably.
That said, cloud PBX doesn't eliminate every risk. Toll fraud is still possible if user credentials are compromised. The difference is that cloud providers typically have fraud detection built in — unusual call patterns get flagged and blocked automatically, which is something most on-premise systems won't do without additional configuration.
If you haven't looked at your phone system's security configuration recently, take 15 minutes and check the basics: passwords, exposed ports, and call logs. The attackers are looking. Make sure you're not the easy target.