Where MSPs See the Biggest Voice Security Risks

Plus What to Do About Them

In our Safer Internet Day poll, MSPs identified user behavior as their primary voice security concern. This aligns with guidance from the FCC on toll fraud prevention, which emphasizes that unauthorized access often stems from weak credentials and misconfigured features rather than sophisticated network attacks.

The Cost of VoIP Security Gaps

The Communications Fraud Control Association reports that toll fraud caused $6.69 billion in losses globally in 2021. According to industry reports, compromised VoIP systems can generate thousands of dollars in fraudulent international calls within hours—often discovered only when the bill arrives.

Most service provider contracts place financial responsibility for fraudulent calls on the customer, even when resulting from unauthorized access. This makes prevention not just a security issue, but a direct financial risk.

Federal agencies have issued specific guidance for VoIP security across three key areas: identity controls (NIST SP 800-63), toll fraud prevention (FCC), and system hardening (general cybersecurity best practices).

1. Identity & Authentication Controls (NIST SP 800-63)

NIST’s Digital Identity Guidelines (SP 800-63-3, now superseded by SP 800-63-4) establish authentication assurance levels for systems requiring security. While not VoIP-specific, these identity standards apply to administrative and user access to communication systems.

Recommended controls include:

  • Strong, unique passwords
  • Multi-factor authentication (MFA) for administrative access
  • Role-based access control (RBAC)
  • Removing shared accounts
  • Timely credential revocation during offboarding

If administrative access to a VoIP system is weak, other technical safeguards can be undermined. An attacker with admin credentials can disable encryption, modify call routing, and export call detail records—regardless of how well you’ve configured the rest of the system.

2. Toll Fraud Prevention (FCC Guidance)

The FCC identifies toll fraud as a major risk in VoIP environments. Toll fraud typically involves abuse of legitimate features after unauthorized access is obtained.

Common contributing factors include:

  • Compromised credentials
  • Weak voicemail PINs
  • Unrestricted international dialing
  • Misconfigured call forwarding
  • Failure to monitor outbound call activity

FCC-recommended protections include:

  • Disabling unnecessary international dialing
  • Setting spending thresholds or alerts
  • Reviewing call detail records (CDRs)
  • Enforcing strong password policies
  • Changing default credentials

One documented case involved a Florida company that had their phone system breached over a weekend through compromised call forwarding, resulting in thousands of calls to premium-rate numbers in Africa and significant financial losses.

3. VoIP Configuration & Network Hardening

General cybersecurity guidance for VoIP deployments emphasizes configuration security and network hardening.

Recommended measures include:

  • Changing all default credentials
  • Applying regular software updates and patches
  • Disabling unused services and features
  • Encrypting SIP signaling using TLS
  • Encrypting media using SRTP where supported
  • Avoiding direct exposure of VoIP services to the public internet
  • Implementing network segmentation

Technical clarification: Even when SIP signaling uses TLS, RTP (the audio stream) typically uses UDP for transport. When SRTP is implemented, the audio is encrypted but still transmitted over UDP.

Encryption protects confidentiality. Access controls protect usage rights. Both are important components of VoIP security.

Where VoIP Risk Commonly Emerges

Federal guidance doesn’t point to dramatic zero-days or sophisticated attacks—it points to preventable gaps: weak authentication, default credentials, over-permissioned accounts. The same issues that enable toll fraud also enable eavesdropping, call hijacking, and data exfiltration.

Infrastructure misconfiguration can create exposure. So can compromised credentials or unrestricted call features. VoIP security typically breaks down when identity controls, system configuration, and visibility aren’t aligned.

It’s rarely one big failure. It’s layered oversight.

Practical VoIP Security Controls for MSPs

  • Aligning with FCC, NIST, and general cybersecurity guidance starts with tightening identity and access.
  • Administrative access should require strong authentication—ideally MFA—especially for users who can modify call routing or dial plans.
  • International dialing should be restricted unless necessary. Many providers allow geographic restrictions that prevent calls to high-risk destinations.
  • Call activity should be monitored for unusual patterns. Sudden spikes in international calls, especially during off-hours, often indicate compromise.
  • Voicemail and extension credentials must follow strong policies. Default PINs like “0000” or “1234” are still common and represent significant risk.
  • Unused features should be disabled. Auto-attendant options, call forwarding to external numbers, and remote access features can all be exploited if left unrestricted.
  • Where supported, SIP signaling should use TLS and media should use SRTP. Not all systems support these protocols, but they should be enabled when available.
  • Regular access reviews help ensure former employees and legacy accounts don’t quietly increase risk. Quarterly audits of who has administrative access and what features are enabled can catch security gaps before they’re exploited.

Next Steps for MSPs

Start with these high-impact controls:

Identity Layer:

  • Implement MFA for administrative access to VoIP systems
  • Enforce strong password policies for voicemail and extensions (minimum 6 digits, no common patterns)
  • Review and remove unnecessary administrative accounts
  • Eliminate shared credentials

Toll Fraud Prevention:

  • Disable international dialing by default; enable only when requested by specific users
  • Set spending alerts (e.g., notify if daily international charges exceed $100)
  • Review call detail records (CDRs) weekly for anomalies
  • Block high-risk destinations (premium-rate services, known fraud hotspots)
  • Restrict after-hours calling if not needed for business operations

System Hardening:

  • Change all default credentials immediately on new deployments
  • Apply security patches within 30 days of release
  • Use TLS for SIP signaling and SRTP for media where supported
  • Disable SIP on public-facing interfaces unless absolutely necessary

Monitoring & Response:

  • Set up automated alerts for unusual call patterns
  • Review CDRs monthly for international calls, premium numbers, and high-volume users
  • Document normal calling patterns so anomalies are easier to spot
  • Have a response plan for suspected compromise (who to contact, how to shut down access)

Regular Audits:

  • Quarterly access reviews to remove former employees and legacy accounts
  • Annual review of enabled features to disable what’s no longer needed
  • Periodic testing of authentication controls
These controls align with FCC, NIST, and general cybersecurity guidance while remaining practical to implement. Layered controls reduce toll fraud and unauthorized access—without making the phone system harder to use for legitimate business purposes.