In short
VoIP security means protecting your phone system from toll fraud, account takeover, eavesdropping and denial of service. The NCSC's PBX best practice sets out the controls: change default passwords, use MFA for admin, lock firewalls to trusted addresses, patch the PBX and phone firmware, encrypt with TLS and SRTP, and limit international and premium-rate dialling.
Get a quote for VoIP security
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Is VoIP secure?
A well-run VoIP phone system is secure. Like email or any other internet service, its security depends on how it is set up and looked after rather than on the technology itself.
The NCSC's guidance on Private Branch Exchange (PBX) best practice explains how attackers get in: they use scanners or exploit weaknesses such as unchanged default passwords, open SIP ports, or firewalls that are badly managed or missing. It also makes the stakes clear. As the PBX owner, you are responsible for the security of your phone system, and while your provider may have systems to help detect fraud, the business is expected to pay the bill.
The good news is that the controls are well known, and most of them are settings rather than extra products. The rest of this page sets them out.
VoIP security risks
| Risk | What happens | Main controls |
|---|---|---|
| Dial-through (toll) fraud | Attackers route calls to high-rate international or premium-rate numbers through your system, often many times over a long period | Dialling limits, strong credentials, firewalls locked to trusted IPs |
| Account takeover | A stolen admin or user login lets someone change call routing, forward calls or listen to voicemail | MFA for admin, strong passwords, audit of unused accounts |
| Eavesdropping | Unencrypted signalling or audio is captured on the network | TLS for signalling, SRTP for media, separate voice VLAN |
| Denial of service (DoS) | Floods of traffic or call attempts tie up the system or the connection | Firewalls, IDS/IPS, the platform's own protections |
| Call forwarding abuse and vishing | Forwarding sends calls to costly numbers, or lets a fraudster present your number as caller ID | Restrict forwarding and transfer to external numbers; staff awareness |
The NCSC notes that dial-through fraud attacks are generally prolonged, with expensive numbers dialled hundreds or even thousands of times, which is why limits on what can be dialled are so effective.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
VoIP toll fraud: how dial-through fraud works
Toll fraud targets the phone system's ability to make outbound calls. Once inside, criminals route calls to numbers that pay them a share of the call charge, usually high-rate international or premium-rate numbers. The calls look like your own traffic, so they appear on your bill.
The NCSC recommends limiting dialling to what the business needs:
- Disable international calling if your company does not call outside the UK
- Block premium-rate and personal numbers, which usually carry a high call cost
- Consider restricting calls out of hours, at evenings, weekends and holidays
- Restrict call forwarding and transfer to numbers outside the business
Train staff to recognise the signs too. The NCSC lists repeated short calls, many incoming calls that hang up when answered, a sudden increase in freephone or high-cost calls, very long calls and changes in after-hours calling patterns.
VoIP security best practices from the NCSC
The NCSC recommends these controls for all PBX systems, whether in the cloud or on site:
- Passwords: change default passwords on every PBX component and phone, use strong passwords, and change any default admin codes that can be dialled during a call
- MFA: use multi-factor authentication for administrative access
- Accounts: audit user accounts and disable any that are unused or unauthorised
- Firewalls: lock inbound and outbound PBX traffic down to trusted addresses, such as your SIP trunk provider, and use intrusion detection and prevention
- Patching: keep the PBX software and firmware, and the firmware on VoIP phones, up to date, with automatic updates where possible
- Encryption: use TLS between PBX components; for hosted systems, TLS for signalling and SRTP for media
- Monitoring and logs: track call volumes and patterns, and store logs securely
- Backups and recovery: back up the configuration regularly and plan how to restore the system
- Testing: regular security audits and penetration tests
Is VoIP security the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Hosted and on-premise VoIP security
Where the phone system runs changes who does what.
Hosted and cloud platforms: the NCSC advises checking that the provider applies updates automatically and encrypts data in transit and at rest, using TLS for signalling and SRTP for media streams. Cisco, for example, recommends SRTP over UDP for Webex Calling media. Your part is the accounts, dialling limits, devices and the office network. Our sister site covers hosted VoIP phone systems.
On-premise systems: the NCSC recommends putting the PBX on its own VLAN or subnet, separate from the rest of the network, and keeping backups off site. 3CX makes the same point for on-premise installations: firewall and access rules should stop the phone system reaching sensitive parts of the network. A next-generation firewall in front of the system adds intrusion prevention; see Cisco Secure Firewall on our sister site.
Both: router and firewall settings matter. Turning SIP ALG off and allowing only the platform's published traffic is covered in VoIP router settings.
VoIP password security and admin access
Passwords are the front door of a phone system, and there are more of them than people expect: the admin portal, each user's account and voicemail PIN, the web interface on every desk phone, and SIP credentials for phones and trunks.
- Change every default password and PIN before the system goes live, including phone web interfaces
- Use long, unique SIP passwords that nobody needs to type
- Turn on MFA for anyone with admin rights, and limit how many people have them
- Remove accounts and extensions as soon as people leave
- Keep portal access to named people rather than shared logins
On Microsoft Teams Phone, admin access runs through your Microsoft 365 accounts, so the identity controls and MFA you already use for email protect the phone system too. In Webex Control Hub, admin roles such as full, read-only and support admin let you give people only the access they need.
How we help
Forever Systems can build these controls into the VoIP phone system we set up for you: dialling limits that match how you work, strong credentials, MFA for admin, firewall rules and patched devices. We can also review an existing system against the NCSC's checklist and recommend changes. See how security fits into the wider project in VoIP phone system installation.
Contact us with the phone system you use today, and we can help you close the gaps.
How Forever Systems helps you choose a VoIP phone system
We supply and support several VoIP platforms, so we can recommend the one that fits how your team takes calls rather than fitting your business around one product.
- Platform advice across hosted 3CX, Microsoft Teams Phone, Webex Calling, Forever UC and Forever Teams, with SIP trunks for phone systems you already own
- A requirements check of your broadband, network and routers before anything goes live
- Numbers and porting: we can help you keep your existing business numbers and plan the move away from analogue and ISDN lines
- Handsets and headsets that suit each platform, bought outright or, in some cases, included in your monthly rental, with the options confirmed at quote
- Set-up and changes: call flows, users and devices configured for you, and help with moves, adds and changes afterwards
- For BT Cloud Voice, see our sister site cloudvoice.cloud, and for hosted and cloud platforms in depth, cloudphone.cloud
We work with businesses, schools, charities and public sector organisations.
Frequently asked questions
Is VoIP secure?
Yes, when it is set up and maintained properly. The NCSC says attackers usually get in through scanners, unchanged default passwords, open SIP ports or poor firewalls. Strong credentials, MFA for admin, firewalls locked to trusted addresses, patching and encryption close those gaps.
What is VoIP toll fraud?
VoIP toll fraud, or dial-through fraud, is when criminals break into a phone system and route calls to high-rate international or premium-rate numbers. The NCSC notes these attacks are often prolonged, and that the PBX owner is expected to pay the bill.
How do I prevent toll fraud on my phone system?
Limit dialling to what you need: block international and premium-rate numbers if you do not use them, restrict out-of-hours calls and forwarding to external numbers. Change default passwords, use MFA for admin, lock the firewall to trusted addresses and patch the system and phones.
Can VoIP calls be intercepted?
Unencrypted calls can be captured on the network. The NCSC recommends TLS between phone system components and, for hosted systems, TLS for signalling and SRTP for media, which protects calls against eavesdropping. A separate voice VLAN adds another layer.
Is a hosted phone system more secure than an on-premise PBX?
Neither is automatically more secure. A hosted provider looks after the platform and its updates; you still manage accounts, dialling limits and devices. On-premise systems need their own VLAN, firewall, patching and backups, as the NCSC sets out.
What are the signs of phone system fraud?
The NCSC lists repeated short calls, many incoming calls that hang up when answered, a sudden rise in freephone or high-cost calls, very long calls and changes in after-hours calling patterns. Staff should know how to report them.
Still have a question about VoIP security?
Ask us and a member of our team will reply by email.
More VoIP phone system guides
3CX VoIP3CX as a VoIP PBX: where it runs, the editions, licensing and SIP trunks.VoIP call qualityEcho, choppy audio, one-way audio and dropped calls: causes, tests and fixes.