--- title: "VoIP Security: Real Threats and How to Stop Them | Chargezen" description: "The real threats to a business phone line, from toll fraud and SIM swaps to caller ID spoofing and account takeover, and the practical fixes for each." url: "https://chargezen.com/blog/voip-security" lang: "en" updated: "2026-10-19" --- Canonical URL: https://chargezen.com/blog/voip-security # VoIP Security: The Real Threats to a Business Phone Line and How to Stop Them DTC Strategy · 10 min read ![Jerry Abrahamson](https://chargezen.com/assets/blogpost1.6581a30d.png) Jerry Abrahamson Founder & CEO • Oct 19, 2026 ![VoIP Security: The Real Threats to a Business Phone Line and How to Stop Them](https://chargezen.com/og-default.png) Most business phone security problems aren't movie hacks. They're a reused password on the phone system's admin page, a voicemail PIN that's still 0000, a carrier rep talked into moving your number to someone else's SIM card, or a scammer calling your customers while showing your number. Each one is preventable, and most of the fixes take an afternoon. This guide walks through the threats that actually hit small and midsize businesses on VoIP and mobile lines, what each one looks like, and what to do about it. It ends with a checklist and the questions to ask any phone provider. Rules and dates below are from the FCC's own pages, checked October 19, 2026. This is general information, not legal advice. ## Why VoIP needs its own security thinking A [VoIP](https://chargezen.com/glossary/voip-voice-over-internet-protocol) phone system is software on the internet. It has user accounts, an admin portal, apps on phones and laptops, and connections to the public phone network. That brings the usual internet risks (stolen passwords, weak devices) on top of the old phone risks (fraudulent calls, social engineering). The good news is that the fixes are also familiar: strong sign-in, least access, monitoring and a plan. ## 1\. Toll fraud **What it is:** someone gets into your phone system or account and uses it to place calls you pay for, usually to expensive international or premium-rate numbers, often overnight or over a weekend when nobody is watching. The bill can arrive before anyone notices. **How they get in:** a guessed or stolen admin password, a voicemail box with a default PIN that allows calling out, an exposed on-premises PBX, or a staff member tricked into transferring a caller to an outside line. The FCC has long warned businesses about these routes: its "Don't fall for the 90# telephone scam" guide describes callers who trick staff into dialing codes that hand over an outside line, and its [voicemail hacking guide](https://www.fcc.gov/consumers/guides/voicemail-hacking) warns that default PINs are a common weak point and advises turning off remote notification, auto-attendant, call-forwarding and out-paging features you don't use ([FCC 90# scam guide](https://www.fcc.gov/consumers/guides/dont-fall-90-telephone-scam), both checked October 19, 2026). * **Block what you don't need**: Turn off international and premium-rate calling unless you use it. Many providers let you allow only specific countries. * **Set spending alerts and caps**: Ask your provider for usage alerts and a hard limit on calling charges. * **Lock down voicemail**: Long, unique PINs, and no "call out from voicemail" features. * **Train the front desk**: Never transfer an unknown caller to an outside line or dial a code because a caller asks. ## 2\. Account takeover **What it is:** someone signs in to a user or admin account in your phone system. With an admin account they can read texts, listen to recordings, change call routing, add users or export contacts. With a single user account they can impersonate that employee to customers. * **Two-step sign-in everywhere**: Require a code from an authenticator app for every admin and, ideally, every user. Text-message codes are better than nothing but weaker, because of SIM swaps (below). * **Single sign-on where you can**: If your provider supports your Google or Microsoft sign-in, one place to turn people off is safer than ten. * **Offboard the same day**: When someone leaves, remove their phone system access, their app sessions and any numbers routed to their personal cell. * **Fewer admins**: Give admin rights to as few people as you can, and review the list every quarter. ## 3\. SIM swaps and port-out fraud **What it is:** a criminal convinces a mobile carrier to move your phone number to a SIM card they control (a SIM swap) or to a different carrier (port-out fraud). From then on, your calls and texts, including sign-in codes, go to them. For a business, that can mean the owner's number, the number on the website, or the number tied to the bank account. The FCC adopted rules on November 15, 2023 requiring wireless carriers to use secure methods to authenticate customers before a SIM change or port-out, and to notify customers right away when one is requested ([FCC news release](https://docs.fcc.gov/public/attachments/DOC-398483A1.pdf), checked October 19, 2026). The FCC published separate notices on when carriers must comply, so check the FCC's site for the current status. Either way, your own defenses matter. * **Add a port-out PIN or number lock**: Most US carriers let you set an account PIN or a number-transfer PIN, and some offer a number lock. Ask yours, and turn on what it offers for every business line, including the owner's personal cell. * **Move sign-in codes off SMS**: Use an authenticator app or security key for email, banking and the phone system itself. * **Know the warning sign**: A phone that suddenly shows "No Service" or "SOS only" in a place with normal coverage can mean the number has moved. Call your carrier from another phone straight away. * **Keep porting paperwork private**: Account numbers and transfer PINs are what a thief needs. Treat them like passwords. Our [porting guide](https://chargezen.com/blog/how-to-port-a-phone-number) explains what each one does. ## 4\. Caller ID spoofing and STIR/SHAKEN **What it is:** a caller fakes the number shown on caller ID. Scammers spoof local numbers so people pick up, and sometimes spoof a real business's number to trick its customers. The FCC's [caller ID spoofing guide](https://www.fcc.gov/consumers/guides/spoofing) explains that under the Truth in Caller ID Act, sending misleading or inaccurate caller ID with intent to defraud, cause harm or wrongly obtain anything of value is illegal, with penalties of up to $10,000 per violation. Not all spoofing is illegal: a doctor calling from a personal phone and showing the office number is a legitimate use (checked October 19, 2026). **STIR/SHAKEN** is the industry framework that lets phone companies digitally sign calls to vouch that the caller is allowed to use the number shown. The FCC required voice providers to put it in the internet (IP) parts of their networks by June 30, 2021, with an extension to June 30, 2023 for smaller providers, and it now requires most providers, including gateway and intermediate providers, to authenticate the caller ID on the calls they carry ([FCC caller ID authentication page](https://www.fcc.gov/call-authentication), checked October 19, 2026). See our glossary entry on [STIR/SHAKEN](https://chargezen.com/glossary/stir-shaken). * **Use a reputable provider**: Ask how it signs your outbound calls and what attestation level your calls receive. Calls from numbers the provider can vouch for are less likely to be labeled as spam. * **Register for texting**: Business texts on local numbers need 10DLC registration, and toll-free numbers need verification. Registered traffic is trusted more. See our [10DLC guide](https://chargezen.com/blog/10dlc-registration-guide) and [toll-free verification guide](https://chargezen.com/blog/toll-free-verification). * **Tell customers what you will never ask**: For example: "We will never call or text to ask for your full card number or a login code." Put it on your site and in your order emails. * **Watch for complaints**: If customers report calls "from you" that you didn't make, report it to the FCC and warn customers. You can't stop someone faking your number, but you can make the scam less believable. ## 5\. Eavesdropping **What it is:** someone captures call audio or call setup data as it crosses a network. On modern hosted systems this is rare, because the main risk was unencrypted traffic on shared networks. It's still worth checking. * **Ask about encryption**: Look for TLS for call signaling and SRTP for the audio itself, plus encryption for stored recordings and voicemail. * **Keep office networks separate**: Put desk phones and guest Wi-Fi on separate networks, and change default passwords on routers and desk phones. * **Be careful with public Wi-Fi**: Use the provider's app over cellular data, or a trusted network, for sensitive calls. ## 6\. Recordings, voicemail and message history A phone system collects a lot of private data: recordings, voicemails, transcripts and texts with addresses, order details and sometimes health or payment information. The risk isn't only outsiders. It's also former employees who can still sign in, and recordings kept for years with no reason. * **Record only with a policy**: Know the consent rules where your callers are. Our [call recording consent guide](https://chargezen.com/blog/call-recording-consent) covers the federal rule and the all-party states. * **Set retention**: Delete recordings and voicemails you no longer need, on a schedule. * **Limit who can listen**: Not every user needs access to every recording. Prefer systems that log who played or downloaded what. * **Never take card numbers by voice or text**: Send customers to your checkout or a secure payment page instead. ## 7\. Social engineering of your own team The cheapest attack is a convincing phone call. "This is IT, I need the code we just texted you." "I'm the customer, I've moved, please update the shipping address and resend the order." Scripts help: decide in advance what staff will never do on an inbound call (share codes, change payout or shipping details without checking, transfer callers to outside lines), and back them up when they say no. ## A VoIP security checklist * **Sign-in**: Two-step authentication on for every admin and user; single sign-on if available; no shared logins. * **People**: Admin list reviewed quarterly; leavers removed the same day; front desk trained on transfer and code scams. * **Numbers**: Port-out PIN or number lock on every line, including owners' cells; porting details stored like passwords. * **Calling**: International and premium-rate calling off unless needed; spending alerts and caps on. * **Voicemail**: Unique, long PINs; unused remote features off. * **Data**: Recording policy written down; retention set; access limited and logged. * **Texting**: 10DLC or toll-free verification complete; consent records kept. * **Plan**: A one-page plan: who calls the carrier, who calls the provider, how you warn customers, where the account PINs are. ## Questions to ask any phone provider * **Sign-in**: Do you support two-step authentication and single sign-on? Can I require them for all users? * **Fraud controls**: Can I block international or premium-rate calls, and set spending alerts or caps? * **Encryption**: Is call signaling and audio encrypted in transit? Are recordings and voicemails encrypted at rest? * **Caller ID**: How do you sign my outbound calls under STIR/SHAKEN? * **Number protection**: How do you protect my numbers against unauthorized port-outs? * **Logs**: Can I see who signed in, who changed settings and who accessed recordings? * **Certifications**: Which independent audits (for example SOC 2) do you have, and can I see the report? ## How Chargezen handles the parts it owns Chargezen isn't a VoIP line or a PBX, so some items above, like desk phones and outbound call routing to other countries, aren't part of it. Here is what it does on the parts it does own: * **Your business number, not personal cells**: Customers call and text the business number, and teammates reply from Finn or the browser, so no employee's personal number is the one customers know. See [why that matters](https://chargezen.com/blog/stop-texting-customers-from-personal-phone). * **Two-step sign-in**: Each teammate can turn on two-step authentication for their own Chargezen sign-in. * **Recording by your rules**: Set each number to your policy. Callers hear your notice before recording starts, you choose how long recordings are kept, and every playback and download is logged with a reason. See [call recording](https://chargezen.com/concierge/features/call-recording). * **A US business number that calls and texts**: Get a local or toll-free US number, search open numbers by area code on [phone numbers](https://chargezen.com/phone-numbers), or [bring the number you already have](https://chargezen.com/concierge/features/bring-your-number). Chargezen files the 10DLC or toll-free registration texting needs. See [business phone number](https://chargezen.com/concierge/features/business-phone-number). * **Changes wait for approval**: You decide what Concierge does alone and what waits for a person, such as refunds and credits. See [approvals](https://chargezen.com/concierge/features/approvals). To be plain about what Chargezen is not: it doesn't sell VoIP lines, desk phones or a PBX. It has no IVR or phone menu, no ring groups, no call forwarding or simultaneous ring to personal phones, no business-hours routing, no extensions and no international numbers. It offers US (+1) local and toll-free numbers only. If you need those things, buy a phone system built for them, and use Chargezen where it fits. Concierge Starter is $20 a month with 20,000 credits. Pro is $199 a month with 199,000 credits, or $1,990 a year. Texts are 2¢ per message part and calls are billed as you use them, with no per-user fees. See [pricing](https://chargezen.com/pricing). Related terms: [STIR/SHAKEN](https://chargezen.com/glossary/stir-shaken), [number porting](https://chargezen.com/glossary/number-porting), [call recording consent](https://chargezen.com/glossary/call-recording-consent) and [10DLC](https://chargezen.com/glossary/10dlc-10-digit-long-code). Related guides: [how to choose a VoIP provider](https://chargezen.com/blog/how-to-choose-voip-provider), [what Wi-Fi calling is](https://chargezen.com/blog/what-is-wifi-calling) and [how to port a phone number](https://chargezen.com/blog/how-to-port-a-phone-number). ## Frequently asked questions ## Is VoIP less secure than a landline? Not by nature. A well-run hosted VoIP system with encryption and two-step sign-in can be safer than an old office PBX nobody has updated in years. The risks are different: VoIP adds internet-style account risks, so sign-in security matters more. ## What is the most common VoIP attack on small businesses? Account and voicemail compromise leading to toll fraud, plus social engineering of staff, are the classic ones. SIM swaps target the owner's mobile number, often to get at bank and email accounts. ## Can I stop someone spoofing my business number? Not completely. STIR/SHAKEN makes spoofed calls easier for carriers to spot and label, but you can't block someone from typing your number into a spoofing tool. Warn customers, report it to the FCC and tell people what you will never ask for. ## Does STIR/SHAKEN stop all robocalls? No. It verifies whether a caller is allowed to use the number shown. It doesn't decide whether a call is wanted, and calls that pass through older non-IP networks may not carry the signature. ![Jerry Abrahamson](https://chargezen.com/assets/blogpost2.32f70dbd.png) Written by ### Jerry Abrahamson Jerry is the Founder and CEO of Chargezen, helping brands build sustainable omni-channel businesses. With over 10 years of experience in omni-channel commerce and SaaS, he's passionate about helping brands create recurring revenue streams. [](https://twitter.com/chargezenjerry)[](https://linkedin.com/in/jerry-a) ## Related Articles [ ![What Is VoIP? A Plain-English Guide for Small Businesses](https://chargezen.com/og-default.png) DTC Strategy · 8 min read ### What Is VoIP? A Plain-English Guide for Small Businesses What VoIP is, how it differs from a landline or cell plan, the kinds of VoIP service, the 911 limits to know, and how to tell if your business should switch. ](https://chargezen.com/blog/what-is-voip)[ ![How Does VoIP Work? A Step-by-Step Look at an Internet Phone Call](https://chargezen.com/og-default.png) DTC Strategy · 7 min read ### How Does VoIP Work? A Step-by-Step Look at an Internet Phone Call Follow one VoIP call from dial to hang-up: SIP signaling, codecs, packets, jitter buffers and the gateway to regular phones, plus bandwidth math and fixes. ](https://chargezen.com/blog/how-does-voip-work)[ ![How Much Does VoIP Cost? Every Fee, and How to Compare Quotes](https://chargezen.com/og-default.png) DTC Strategy · 7 min read ### How Much Does VoIP Cost? Every Fee, and How to Compare Quotes What VoIP really costs: per-user plans, extra numbers, texting registration, devices, taxes and add-ons, with published prices and a quote worksheet. ](https://chargezen.com/blog/voip-cost) ## Ready to Grow Your Subscription Revenue? Join leading brands using Chargezen to reduce churn, increase revenue, and automate operations. [Get Started](https://admin.chargezen.com/signup)