Security
VoIP Security
By Myroslav Orshak · operates licensed carrier infrastructure · Updated September 2026
VoIP security is about protecting your phone system from people who want to make calls at your expense, listen to your conversations, or take over your number. The first of these is by far the most common.
How it works
Because a phone system is now software on a network, it faces the same threats as any other online account. Attackers scan the internet for phone systems, try common extension numbers with weak passwords, and when one works, they place expensive international calls through it. This is toll fraud, it runs automatically at scale, and it usually happens overnight or over a weekend so nobody notices until the bill arrives.
The other two risks are real but rarer. Eavesdropping means intercepting the audio, which is prevented by encryption: TLS protects the call signaling and SRTP protects the audio itself. Hijacking means someone impersonating your business to take control of your number or redirect your calls, which is prevented by your provider's account security rather than anything you configure.
Why it matters
Toll fraud deserves attention because of who pays. Calls placed through your system are legitimately yours as far as the network is concerned, and a compromised extension can generate thousands of dollars in international calls in a single night. Providers vary enormously in whether they absorb that loss, cap it, or bill it — which makes it a question worth asking before you sign, not after.
The reassuring part is that defending against it is not technical work. Strong passwords on every extension, international calling switched off unless the business actually needs it, a spending cap, and encryption enabled will stop essentially all of it. The businesses that get hit are almost never the ones that were targeted specifically — they are the ones running an extension with the password 1234.
Turn off international dialing unless it is needed, set a daily spend cap, use a long random password for every extension (never the extension number), and enable TLS plus SRTP. Four settings prevent the overwhelming majority of real incidents.
Related terms
Ready to pick a provider?
Compare providers on security terms →Frequently asked questions
Are VoIP calls encrypted?
Only if encryption is switched on, and on many systems it is not by default. TLS protects the signaling and SRTP protects the audio. Ask your provider whether both are enabled on your account, because the answer is often no and the fix is usually a checkbox.
Who pays if someone makes calls through my system?
Usually you, which is the part that surprises people. The calls were placed with valid credentials, so the network treats them as yours. Some providers cap or absorb fraud losses, so ask what happens in that scenario before you sign a contract rather than after.
Can someone listen to my calls?
It is possible in theory and rare in practice, because it requires access to the network the call crosses. Encryption removes the risk. If your business discusses health, legal or financial matters, confirm encryption is on rather than assuming it.
What is the single most important thing to do?
Give every extension a long random password. Almost every toll-fraud case starts with an extension whose password was the extension number, a default left in place, or something guessable. Automated scanners find those within days of a system going online.