A controller at a 40-person manufacturing company logged in on Monday morning to find $12,000 in international calls billed over the weekend — calls no one at the company made. Attackers had exploited a default password on an unused VoIP extension, routed hundreds of calls to premium-rate numbers overseas, and disappeared before anyone noticed.
This is toll fraud, and it is just one of five security risks that come with running your phone system over the internet. VoIP gives your business flexibility, lower costs, and powerful integrations with tools like CRMs and video conferencing. But because VoIP traffic runs on the same network as your data, it inherits every vulnerability that network carries — plus a few that are unique to voice.
Here are the five most common VoIP threats, how they work, and exactly what you can do to stop them.
Vishing is phishing delivered by voice. An attacker calls an employee, spoofs the caller ID to display an internal extension or a known vendor’s number, and asks for credentials, payment details, or remote access. Because people inherently trust phone calls more than emails, vishing attacks succeed more often than you might expect.
A typical scenario: someone posing as your IT department calls an employee and says they need the employee’s VoIP portal password to “fix a system issue.” The employee complies, and the attacker now owns that account.
How to stop it:
A Denial of Service (DoS) or Distributed Denial of Service (DDoS) attack floods your VoIP servers with fake traffic — thousands of SIP requests per second — until legitimate calls cannot get through. Your phones go silent, customers cannot reach you, and internal communication stops.
For businesses that depend on phone-based sales, support, or dispatch, even 30 minutes of downtime translates directly into lost revenue.
How to stop it:
Toll fraud — the scenario from the opening of this article — happens when attackers gain access to your VoIP system and route calls through it, typically to international or premium-rate numbers they control. The calls generate revenue for the attacker, and the charges land on your bill.
The most common entry point is a weak or default password on a VoIP extension, voicemail box, or admin portal.
How to stop it:
A business telephone provider that actively monitors call activity and flags anomalies adds another layer of protection beyond what you manage internally.
VoIP systems that transmit voice data without encryption are vulnerable to interception. An attacker with access to your network can capture VoIP packets and reconstruct entire conversations. One well-known technique, called VOMIT (Voice over Misconfigured Internet Telephones), specifically targets misconfigured VoIP devices to extract unencrypted audio.
Beyond eavesdropping, malware installed on VoIP servers, gateways, or IP phones can harvest credentials, redirect calls, or open backdoors into your broader network.
How to stop it:
Platforms like 1stConnect centralize monitoring across your communication infrastructure, making it easier to verify that encryption is active and configurations have not drifted.
Spoofing lets an attacker disguise their phone number so it appears to come from a trusted source — your CEO’s extension, your bank, or a vendor. Combined with social engineering, spoofed calls can trick employees into authorizing wire transfers, sharing sensitive data, or granting system access.
In a man-in-the-middle attack, the attacker inserts themselves between two parties on a call, intercepting or altering the conversation without either side knowing.
How to stop it:
What is the single most important step to secure a VoIP system? Encrypt everything. Enable TLS for signaling and SRTP for media on every device and trunk. Encryption blocks eavesdropping, prevents packet reconstruction attacks like VOMIT, and stops man-in-the-middle interception. Without it, every other security measure is working around an open door.
How do I know if my business is a target for toll fraud? Every business with a VoIP system is a potential target. Attackers use automated scanning tools to find systems with weak passwords or default credentials. Small and mid-sized businesses are hit frequently because they are less likely to have dedicated security monitoring. If you have any extensions with default passwords, unused accounts still active, or no restrictions on international dialing, your risk is elevated.
Can VoIP be as secure as a traditional landline phone system? Yes — and in many cases more secure. Traditional landlines were not encrypted, so anyone with physical access to the copper line could tap a call. A properly configured VoIP system with TLS/SRTP encryption, MFA, network segmentation, and active monitoring provides stronger protection than a legacy phone system ever did.
What should I look for in a VoIP provider’s security practices? Ask whether the provider encrypts all traffic by default, offers built-in DDoS protection, supports STIR/SHAKEN for caller ID authentication, monitors for toll fraud in real time, and provides regular security updates. A provider that cannot answer these questions clearly is not one you want handling your business communications.
How often should we train employees on VoIP security? At minimum, run training annually with a refresher whenever a new threat emerges. Vishing tactics evolve quickly, and a one-time training session loses effectiveness within months. Short, scenario-based exercises — like simulated vishing calls — are more effective than lengthy presentations.
VoIP security is not a set-it-and-forget-it task. Attackers adapt, and your defenses need to keep pace. The five risks outlined here — vishing, DoS attacks, toll fraud, malware and eavesdropping, and spoofing — are preventable when you combine encryption, MFA, network segmentation, employee training, and active monitoring.
If you are evaluating your current phone system’s security posture or considering a move to VoIP, 1stel can help. We provide business telephone services with built-in security controls, business internet with DDoS protection, and 1stConnect for unified communications that keeps your voice, video, and messaging secure under one platform. Contact 1stel today to discuss how to lock down your business communications.