Quick answer: VoIP is secure when it is set up properly. The problem is that a lot of businesses switch to VoIP phones for business and never check whether the security controls are actually in place. Default passwords stay unchanged. Admin access is wider than it needs to be. International calls are never restricted. Then something goes wrong and it is expensive to fix. This checklist covers the controls that matter most, explained plainly so you can check them without needing a degree in networking.
The Main Security Risks for Business VoIP
Before getting into the checklist it helps to understand what you are actually protecting against. VoIP systems face a different set of risks compared to traditional phone lines, mostly because they are internet-connected.
| Risk | What It Means | How Common Is It |
|---|---|---|
| Toll fraud | Someone uses your system to make expensive calls you pay for | Very common, costs UK businesses millions yearly |
| Account takeover | Attacker gains access to your admin or user portal | Common, often via weak passwords |
| Call interception | Calls listened to or recorded without permission | Less common but possible on unencrypted systems |
| Vishing | Caller impersonates supplier, IT, or bank to extract information | Growing problem in UK businesses |
| Unpatched devices | Old firmware on phones or routers creates known vulnerabilities | Common, often overlooked |
| Call recording exposure | Stored recordings accessed by wrong people | Becoming more significant under GDPR |
VoIP Security Checklist
| Security Control | What to Check | Why It Matters |
|---|---|---|
| Strong passwords | No default or shared passwords on any account | Default credentials are the first thing attackers try |
| Multi-factor authentication | MFA enabled on admin and user portals | Stops account takeover even if password is compromised |
| Encryption | TLS for signalling, SRTP for voice media | Prevents call interception on the network |
| International call restrictions | Block destinations you never call | Limits toll fraud damage if system is compromised |
| Spend limits | Monthly or daily caps on call costs | Catches unusual activity before it becomes a large bill |
| Admin access controls | Role-based permissions, named admin accounts only | Reduces exposure if one account is compromised |
| Firmware updates | Phones, apps, and routers on current firmware | Patches known vulnerabilities attackers exploit |
| Call recording access | Only relevant staff can access recordings | Protects customer data under GDPR |
| Recording retention policy | Clear rules on how long recordings are kept | Supports legal and data protection obligations |
| Remote worker controls | Approved apps, MFA, device policy for home workers | Personal devices introduce risks office equipment does not |
| Voicemail PINs | Default PINs changed, old mailboxes removed | Default voicemail PINs are widely known and exploited |
| Incident plan | Know who to call and what to do if something goes wrong | Fast response limits damage from fraud or breach |
1. Passwords and Multi-Factor Authentication
Most VoIP breaches start with a weak or default password. When a new phone system is set up, the admin portal often ships with default credentials that are publicly documented. If nobody changes them, the system is effectively open.
Every admin account needs a strong unique password that is not used anywhere else. Multi-factor authentication should be enabled on the admin portal at minimum. If your provider supports MFA on user accounts as well, enable it there too. This one step stops the majority of account takeover attacks.
- Change all default passwords immediately after setup
- Use a business password manager so credentials are not stored in spreadsheets or notebooks
- Enable MFA on every portal that supports it
- Remove access immediately when staff leave
- Never share admin credentials between multiple people
2. Toll Fraud: The Biggest Financial Risk
Toll fraud is where an attacker gains access to your phone system and uses it to make calls to expensive international or premium rate numbers, usually at weekends or overnight when nobody notices. The bill arrives and it can run to thousands of pounds before anyone acts. It is one of the most common and costly VoIP security incidents in the UK.
The controls are straightforward. Block international calls to destinations you never actually call. Set a spend limit that triggers an alert or automatically blocks calling if reached. Restrict out-of-hours calling if your business does not need it. These three changes alone eliminate most of the financial risk from toll fraud.
- Block international calls to high-risk destinations unless specifically needed
- Set daily or monthly spend limits with automatic alerts
- Restrict premium rate numbers at the system level
- Enable out-of-hours call barring for destinations you never call overnight
- Ask your SIP trunk provider what fraud monitoring they run
3. Encryption: TLS and SRTP Explained Simply
Two acronyms come up constantly in VoIP security: TLS and SRTP. Here is what they actually mean without the jargon.
TLS (Transport Layer Security) protects the signalling part of the call. This is the communication that tells the system who is calling, where to route the call, and when it ends. Without TLS this information can potentially be intercepted on the network.
SRTP (Secure Real-Time Transport Protocol) encrypts the actual voice audio. It is what stops someone on the same network from listening to the content of your calls.
Both should be enabled on any credible business VoIP system. When you are evaluating a SIP trunking provider or a hosted cloud platform, ask specifically whether they support TLS and SRTP. Any provider that cannot confirm this clearly is worth questioning further.
4. Admin Access and Permissions
VoIP admin portals give whoever has access a lot of power. They can change call routing, add or remove users, access call recordings, modify billing, and in some cases change where calls are forwarded. That is a lot of damage a compromised account can do.
Keep admin access tight. The fewer people with full admin rights the better. Use role-based permissions where possible so that someone who only needs to pull call reports does not also have access to billing or call routing settings. Every admin account should be named to a specific individual, never shared.
| Access Level | What They Should Be Able to Do | What They Should Not Have |
|---|---|---|
| Full admin | Everything | Only 1 or 2 trusted people maximum |
| IT/technical | Phone config, routing, firmware | Billing, recording access |
| Manager/supervisor | Call reports, recordings for their team | System config, billing |
| Standard user | Make calls, check own voicemail | Other users’ settings or recordings |
5. Keeping Phones and Software Updated
VoIP desk phones run firmware, just like a router or a server. Old firmware contains known vulnerabilities that attackers actively exploit. The same applies to softphone applications on laptops and mobiles.
This is one of the most commonly neglected security controls. A VoIP phone that was set up three years ago and never updated is running software with multiple known security issues. Check your phone models, look up the current firmware version on the manufacturer website, and update anything that is out of date. Most business VoIP providers and SIP trunk providers include guidance on firmware management as part of their support offering.
- Audit all phone models on your system and their current firmware versions
- Subscribe to manufacturer security bulletins for your hardware
- Update softphone apps on laptops and mobiles as regularly as other business software
- Replace end-of-life hardware that no longer receives security updates
6. Call Recording and GDPR
If your business records calls, those recordings are likely to contain personal data about your customers. Under GDPR, that means you need clear rules about who can access them, how long they are kept, and how they are deleted.
Most businesses are fine on the basic requirements but fail on the detail. Recordings are kept indefinitely because nobody set a retention period. Former employees still have access to the recording portal. There is no process for responding to a subject access request that includes call recordings.
- Set a defined retention period based on your business need and delete recordings when that period expires
- Restrict access to recordings to people who genuinely need it for their role
- Ensure recordings are stored on encrypted storage, not on a shared drive anyone can access
- Include call recordings in your data processing register
- Have a process for responding to subject access requests that covers recordings
7. Remote Workers and Home Devices
Remote working introduced a significant security complexity for business phone systems. When an employee connects to the VoIP system from home, they are doing so from a network and a device the business does not control. If their home router has default credentials and their laptop has not been updated in months, the connection between them and your phone system is only as secure as the weakest link.
The practical steps are: ensure staff use approved VoIP applications rather than random softphone apps they found online, require MFA for remote access, have a clear policy on what devices can be used for work calls, and make sure access is removed promptly when someone leaves. That last one matters more than people realise. A former employee who still has active VoIP credentials is a security risk.
8. Vishing: The Human Risk
Vishing is phone-based social engineering. An attacker calls your business pretending to be from IT support, a supplier, a bank, or a regulator, and tries to get someone to reveal information or take an action they should not. It is a growing problem because it bypasses technical controls entirely.
Training is the main defence. Staff should know never to give passwords or access credentials to anyone over the phone, regardless of who the caller claims to be. Any request for login details should trigger a callback to a verified number rather than trusting the incoming caller. Internal requests for urgent payment changes or credential resets should go through a separate verification process.
SIP Trunking Security Considerations
If you are running SIP trunking for business rather than a fully hosted cloud system, there are additional security considerations specific to your setup. SIP trunks connect directly to your IP PBX, and that connection needs to be properly secured.
- Restrict SIP registration to trusted IP addresses only where possible
- Use a SIP-aware firewall rather than relying on standard network firewall rules
- Enable authentication on all SIP extensions
- Monitor SIP logs for unusual registration attempts or failed authentications
- Ask your SIP trunk provider what authentication and fraud controls they apply at the network level
Choosing a reputable SIP trunk provider matters here. Providers with good network-level fraud monitoring catch unusual call patterns before they become a large bill. It is a reasonable question to ask during any evaluation: what does your fraud monitoring actually do, and what happens when something unusual is detected?
Questions to Ask Your VoIP or SIP Provider About Security
- Is MFA available for admin and user accounts?
- Do you support TLS and SRTP for all calls?
- Can we block international and premium rate calls at the system level?
- Do you monitor for unusual or fraudulent calling patterns?
- What happens when your fraud monitoring detects something?
- Where are call recordings stored and how are they encrypted?
- Can we set role-based permissions for different types of users?
- How quickly can we disable a user account if someone leaves?
- What is your process if we suspect our account has been compromised?
- What is your platform uptime and how do you handle service disruption?
Why Almens Consult
Almens Consult sets up VoIP phone systems and SIP trunking solutions with security controls configured from the start, not as an afterthought. That means fraud controls in place before go-live, proper admin permissions set up correctly, encryption confirmed, and staff briefed on the basics. If you are taking over a system that was set up by someone else and you are not sure whether any of this has been done, they can run through it and tell you what the current state is. Getting the security fundamentals right takes a few hours at setup. Fixing a toll fraud incident takes considerably longer.
FAQs
Is VoIP safe for UK businesses?
Yes, when properly configured. VoIP systems with strong authentication, encryption, fraud controls, and up-to-date firmware are as secure as any other business communication system. The risk comes from systems that are set up without these controls in place.
What is toll fraud and how do I stop it?
Toll fraud is when an attacker uses your phone system to make expensive calls that you end up paying for. The main protections are blocking international and premium rate calls you do not need, setting spend limits, enabling unusual activity alerts, and ensuring your admin portal is properly secured with a strong password and MFA.
Do I need to tell customers their calls are being recorded?
Yes. UK law requires that callers are informed when calls are being recorded. Most businesses do this with a recorded message at the start of the call. The recordings themselves are subject to GDPR, which means you need a clear retention policy and must handle subject access requests that relate to recorded calls.
What is the difference between TLS and SRTP in VoIP?
TLS encrypts the signalling part of the call, which is the communication that sets up and manages the call. SRTP encrypts the actual voice audio. Both should be enabled on a properly secured VoIP system. If your provider only supports one or neither, that is worth raising.
How do I check if my VoIP system is secure?
Work through the checklist in this guide. Start with passwords and MFA since those are the most commonly neglected. Then check your international call restrictions, confirm your provider supports TLS and SRTP, review who has admin access, and check firmware on your phones is current. If you are not sure where to start, a telecoms consultant can run through the current state of your setup and tell you what needs attention.