VoIP Security Essentials: Protecting Your Business Communications
VoIP security is the set of controls that protect a voice-over-IP system from unauthorized use, interception and fraud across its signalling, media and management layers. Unlike a traditional PBX sitting behind a locked door, a VoIP system is reachable from the internet by design, which means the attack surface includes anything that can register a device, place a call, or read a packet.
Most VoIP security failures are not exotic. They are weak passwords, open ports and unencrypted trunks — the same mistakes that compromise any internet-facing system, applied to a service that happens to cost money by the minute when it goes wrong.
What are the real attack vectors against a business phone system?
Four patterns account for most incidents.
SIP registration abuse and credential stuffing. SIP endpoints authenticate with a username and password, much like a web login. Attackers scan the internet for exposed SIP ports, then attempt large volumes of common or leaked credential pairs against every extension they find. A weak or reused password on even one extension gives an attacker a registered device that can place calls as if it were a legitimate employee.
Toll fraud. This is the financially dangerous one. Once an attacker controls a compromised extension or trunk, they route high volumes of calls to premium-rate or international numbers — sometimes numbers they control themselves, which pay them a share of the connection revenue. This typically happens outside business hours, over a weekend, when nobody is watching a dashboard. A single compromised extension can generate thousands of pounds or dollars in charges in a few hours, because the cost scales with call volume and destination rate, not with how carefully anyone was watching.
Eavesdropping on unencrypted trunks. SIP signalling carries call setup information — who is calling whom — and RTP carries the actual audio. If either runs unencrypted over a network an attacker can observe, both are readable. On a shared or public network, unencrypted VoIP traffic is not meaningfully more private than an open phone line.
Caller-ID spoofing and vishing. The SIP protocol lets a caller declare whatever caller ID it wants, which is why spoofed numbers that impersonate banks, suppliers or internal extensions are so common. Combined with social engineering — a technique called vishing, or voice phishing — this is used to extract credentials, payment authorizations or sensitive data from employees who trust a familiar-looking number.
How does toll fraud actually happen, step by step?
- An attacker finds an exposed or weakly protected SIP endpoint, usually through automated internet-wide scanning rather than a targeted attack.
- They guess or brute-force the extension’s credentials, often succeeding because the password is a default, a dictionary word, or reused from another breach.
- The compromised extension registers as if it were a legitimate device, inheriting its calling permissions.
- The attacker places a high volume of calls to international or premium-rate numbers, frequently timed for nights and weekends when detection is slowest.
- The organization discovers the fraud when the bill arrives or a carrier flags unusual usage — by which point the cost has already been incurred.
This is why toll fraud is expensive quickly: it is a volume-and-rate problem, not a one-off theft, and the window between compromise and detection is where the cost accumulates.
What controls actually stop these attacks?
Encrypt signalling and media
Require TLS 1.3 for SIP signalling and SRTP for the media stream on every trunk, endpoint and softphone. This closes the eavesdropping vector directly: even if traffic is intercepted, it is not readable. Treat unencrypted SIP as a configuration error, not an acceptable fallback — if a device cannot support TLS and SRTP, it should not be on the network.
Use strong, unique credentials and least privilege
Every extension needs its own high-entropy credential, not a shared or default one. Beyond authentication strength, apply least privilege: an extension used only for internal calls should not have international or premium-rate dialling enabled at all. Fraud prevention is partly about making the compromise of one account less consequential.
IP allowlisting
If your SIP trunks and remote softphones connect from a known, finite set of IP ranges — your office network, a known cloud provider, a defined VPN exit — allowlist them and reject registration attempts from anywhere else. This alone eliminates the broad, opportunistic scanning that drives most credential stuffing.
Geo-restrictions and international dialling limits
Most organizations do not need to call, or receive calls from, most countries. Blocking or flagging traffic from regions outside your operating footprint removes a large share of fraud destinations before a single credential is ever tested. Pair this with hard caps on international call volume or spend per extension, so that even a successful compromise hits a ceiling rather than an open-ended bill.
Rate limiting
Throttle repeated authentication failures and unusually rapid call attempts from a single source. A legitimate user does not attempt fifty logins a minute or dial forty numbers in sixty seconds. Rate limiting turns an automated attack that depends on speed and volume into one that is slow enough to be caught.
STIR/SHAKEN
STIR/SHAKEN is a framework that cryptographically attests the calling number at the point of origin, letting receiving carriers verify that a caller ID has not been spoofed. It is required for US carriers and directly addresses caller-ID spoofing on outbound calls, while making inbound spoofed calls easier for your own team to flag and filter.
Logging, alerting and incident response
Centralise call detail records and authentication logs somewhere they can be queried quickly, and set real-time alerts for the patterns that precede fraud: failed login spikes, calls to unusual destinations, or volume well outside normal hours. Write the incident response plan — who disables a compromised extension, who contacts the carrier, who reviews the bill — before an incident, not during one.
Which controls map to which threat?
| Control | Stops | Does not stop |
|---|---|---|
| TLS 1.3 + SRTP | Eavesdropping on signalling and media | Credential compromise, fraud after login |
| Strong credentials + least privilege | Account takeover, limits fraud blast radius | Spoofing, network interception |
| IP allowlisting | Opportunistic scanning and registration abuse | Fraud from an already-trusted IP |
| Geo-restrictions + dial limits | Toll fraud destinations and cost ceiling | Domestic fraud, spoofing |
| Rate limiting | Credential stuffing, rapid-fire fraud calls | Slow, low-volume abuse |
| STIR/SHAKEN | Caller-ID spoofing | Toll fraud, eavesdropping |
| Logging + alerting | Detection speed, post-incident review | Prevention — it tells you after the fact |
No single row is sufficient. The point of the table is that each control closes a different door; fraud and interception exploit whichever one is left open.
What goes wrong in practice?
The most common failure is treating encryption as the whole security programme and stopping there. TLS and SRTP stop eavesdropping, but they do nothing against a stolen password or a spoofed caller ID — an organization can be fully encrypted and still lose thousands to toll fraud over a weekend.
The second common failure is granting broad international dialling permissions by default because restricting them individually is administratively tedious. This is precisely backwards: the default should be restrictive, with exceptions granted per extension to people who demonstrably need them.
The third is alerting that nobody is watching. Logs that exist but are not reviewed, or alerts that fire into an inbox nobody checks on a Saturday, provide no practical protection — the fraud pattern above specifically exploits the gap between occurrence and detection.
Finally, incident response plans that exist only as documents and have never been rehearsed tend to fail under real pressure, because the first fraud incident is not the time to discover who actually has the authority to disable an extension or call a carrier.
How do you roll these controls out without disrupting the business?
- Encrypt signalling and media across all trunks and endpoints — this has no user-facing downside and closes the eavesdropping vector immediately.
- Audit and rotate credentials, moving every extension to a unique, high-entropy password as part of the same pass.
- Build the IP allowlist from real traffic logs, not guesswork, so you do not lock out legitimate remote workers.
- Set geo-restrictions and dialling caps based on your actual calling patterns over the past few months, then tighten gradually.
- Enable rate limiting with conservative thresholds first, widening them only if legitimate traffic is affected.
- Turn on STIR/SHAKEN for outbound caller authentication.
- Stand up centralised logging and alerting, then run at least one tabletop exercise against the incident response plan.
Doing this in order matters: encryption and credential hygiene close the widest doors first, while the more granular controls — geo-restrictions, rate limits — can be tuned without risking an outage if you get the threshold slightly wrong on day one.
Next steps: read our full VoIP security and compliance overview, see how SIP trunking handles encrypted carrier connections, or contact us to review your current configuration.