The short version
- Toll fraud is the big financial risk: attackers break into a PBX or SIP account and route expensive international or premium calls through it.
- Strong unique SIP passwords, no open SIP ports to the internet, and international call restrictions stop most attacks.
- Set spending caps and fraud alerts with your provider. They're your safety net when everything else fails.
- Voicemail PINs and admin portals are frequent weak points. Use MFA wherever it's offered.
Why attackers target phone systems
A phone system is a way to turn stolen access into money directly. Attackers scan the internet constantly for SIP servers, guess extension passwords, and once they're in, push calls to premium-rate or international numbers that pay them a share of the revenue. These attacks often start late on a Friday so they can run all weekend before anyone notices the bill.
The other risks are real too (eavesdropping, voicemail access, caller ID abuse, denial of service), but toll fraud is the one that turns up as a five-figure invoice.
The checklist
Accounts and passwords
- Every SIP extension has a long, random, unique password. Never the extension number, "1234", or a shared default.
- Voicemail PINs are at least six digits and not the extension number or a simple sequence.
- Admin and user portals use multi-factor authentication.
- Remove extensions, users and devices for people who've left, the same day.
Network exposure
- For on-premises or self-hosted PBXs, don't expose SIP (5060/5061) to the whole internet. Allow only your provider's and your remote users' addresses, or use a session border controller.
- Use fail2ban or the PBX's built-in intrusion blocking to lock out repeated failed registrations.
- Prefer SIP over TLS (port 5061) and SRTP so signalling and audio are encrypted.
- Keep PBX software, phone firmware and router firmware patched.
- Change default admin passwords on every phone's web interface, or disable it.
Call restrictions
- Block international calling for everyone who doesn't need it, and limit it to specific countries for those who do.
- Block premium-rate (19xx) and satellite numbers by default.
- Restrict after-hours outbound calling if your business doesn't need it.
- Limit concurrent outbound calls on SIP trunks to what you actually use.
- Disable call forwarding to external or international numbers unless required, a common way to abuse voicemail access.
Provider safety nets
- Set a daily or monthly spending cap on your account.
- Turn on alerts for unusual call volumes, international calls or spend.
- Know who to call at your provider to suspend outbound calling out of hours.
- Read your contract: who pays for fraudulent calls? Usually it's you.
People and process
- Staff know never to share voicemail PINs or portal codes over the phone, even with "IT support".
- Someone reviews call records weekly for unusual destinations or overnight activity.
- You have a written plan for what to do if fraud is detected.
If you think you've been hit
- Call your provider immediately and ask them to block international and premium calling on your account.
- Change all SIP, voicemail and admin passwords.
- Check for new extensions, forwarding rules or trunks you didn't create.
- Export call records for the period as evidence.
- Report to the Australian Cyber Security Centre via cyber.gov.au.
A hosted cloud phone system moves much of this work to the provider: they run the servers, patch them, and usually enforce strong credentials. You still own user passwords, portal access, call restrictions and spending limits. A self-hosted PBX puts all of it on you.