Is your phone system secure?

Published

October 2026

Length

4 pages

Written for

Owners, office managers and finance managers responsible for the phone account.

A business phone system can be used to make calls that nobody in the business authorised. If an extension, voicemail or administrative account is compromised, calls may be routed to expensive destinations, and charges can accumulate before the next invoice arrives. The exact exposure and responsibility depend on the service, its configuration and the contract, which is why the conversation starts with your provider rather than with a product.

What the report covers

• How the charges can arise
• Knowing what normal looks like on your account
• Practical limits: blocked destinations, alerts and credentials
• Reading the contract before an incident, not after
• What to do when something looks wrong
• The questions to put to your provider

Key points

• Establish which destinations are enabled, who can change settings, what alerts and limits exist, and who responds after hours.
• Review two or three months of itemised call records to learn your normal hours, destinations and spend. The invoice is a reconciliation tool, not an early-warning system.
• Block international and premium destinations the business does not need, use unique strong credentials with multi-factor authentication on the portal, and remove extensions when people leave.
• A spending alert is only useful if someone can act on it. Name a primary contact and a backup, including after hours, and keep a verified support number reachable when the phone system is down.
• A spoofed caller ID does not by itself prove your system was accessed. Record the details and ask the provider to investigate before telling a customer either way.
• Read the contract before an incident: fair-use rules behind "unlimited", fraud-monitoring exclusions, dispute processes, and who investigates which part when three suppliers are involved.

Related