The short answer
VoIP security for a small business is mostly settings, not a product you buy. Barring the destinations you never ring, turning on a spend alert and putting multi-factor authentication on the admin portal stop most toll fraud. Caller ID spoofing is a separate problem, and there is nothing on your own system to fix.
On this page
Phone systems rarely make the list when a small business thinks about security. The laptops get updates and the email gets a spam filter, while VoIP security sits with nobody, because the phones on the desks look like they always have. They are connected to the internet now, and unlike a laptop they can spend money.
That is the part that surprises people. A compromised email account costs you time and embarrassment. A compromised phone system can run up a bill while the office is closed, because the calls it makes are real calls to real numbers, and somebody has to pay for them.
This guide explains what VoIP security is actually protecting, how toll fraud gets in, the settings that stop most of it, why your number can appear on calls you never made, and a check you can do this month in about 20 minutes.
What is VoIP security actually protecting?
Two separate things, and it helps to keep them apart. The first is your call spend: can anyone other than your staff make calls that land on your bill. The second is your number’s reputation: what happens when your number turns up on calls you did not make.
The first one is yours to control. It lives in settings you or your provider can change today. The second one mostly is not, and knowing which is which saves a lot of wasted effort.
Everything else sits under the ordinary business security you already run. The wider ground, including uptime and the risks worth weighing before a move, is covered in our guide to cloud phone systems and whether they are safe.
How does toll fraud happen on a small business phone system?
Someone signs in as you, then rings expensive numbers. That is the whole mechanism. They do not need to break any encryption. They need one weak way in: a default admin password that nobody changed, a voicemail PIN still set to 1234, an extension belonging to a staff member who left, or an admin portal reachable from the internet with no second factor.
Once in, they point the system at international or premium-rate destinations and dial, usually starting on a Friday night or the first evening of a long weekend. The first anyone notices is the bill, or a provider alert, which is why the timing is deliberate.
Two honest notes on this. Australia has no published figure for how often this hits businesses of 3 to 20 handsets, so treat any precise number you read with suspicion. And the fix is not clever: it is the dull settings below, done once.
The settings that stop most of it
None of these needs a technician, and most are a single change in the admin portal or one request to your provider.
Done together, these five turn a break-in from an expensive night into a failed login. None of them makes the phones harder to use for the people who are meant to be using them.
Why does your number show up on calls you did not make?
Because someone forged it, and that is not a break-in. Caller ID spoofing means a scammer sends your number as the calling number on their own calls, so the people they ring see your business. Nothing on your phone system has been touched, and there is no setting on your side that stops it.
The ACMA explains the mechanism and what it is doing about it in its guidance on caller ID scams. Australian telcos now detect and block these calls at the network, and the ACMA reports that more than 2.7 billion scam calls have been blocked since December 2020 in its quarterly reporting.
What you can do is practical rather than technical. Tell reception what is happening so the angry callbacks do not get treated as real complaints. If the wave is large, record a short message on the main number explaining it. Report it, and let the carrier side do the blocking.
Are voicemail PINs and MFA worth the bother?
Yes, and the admin portal matters far more than the handsets do. A voicemail PIN protects messages. The admin login protects every setting in the system, including the dial plan that decides what the business is allowed to ring.
Put multi-factor authentication on that login. It means a second step beyond the password, so a stolen password on its own is not enough, and the ASD’s guidance on multi-factor authentication covers how to set it up. The same handbook’s section on securing accounts makes the other half of the point: only give administrator access to the people who need it.
For voicemail, the rule is short. No PIN that is four of the same digit, four in a row, or the extension number.
Your router is part of your phone system
It is easy to treat the router as the internet company’s problem and the phones as the phone company’s. The calls do not see it that way: they travel over that connection, through that box, on its settings.
Change the router’s default administrator password, apply its updates, and do not leave remote management switched on unless somebody genuinely uses it. If the phones were installed at the same time as the connection, our guide to how to set up VoIP walks through what sits where, and the piece on business internet explains how much the connection decides about call quality.
Who pays for the calls you did not make?
Ask your provider that question now, in writing, rather than after it happens. Contracts differ, and the answer is a commercial term rather than a rule that applies everywhere, so the only reliable version is the one your own provider gives you.
Three things worth asking: whether fraudulent call charges are disputable, whether there is a spend cap you can set, and how quickly they will bar the service if the pattern looks wrong. If you do end up in a dispute over charges, the Telecommunications Industry Ombudsman handles billing complaints for small businesses and is free to use.
A 20 minute VoIP security check
October is Cyber Security Action Month in Australia, and the phone system is a fair candidate for the hour nobody usually gives it. Open the admin portal and work down one list: who has an extension, who has admin access, what the dial plan allows, whether international and premium calling is on, whether there is a spend alert, and when the passwords and PINs last changed.
Most businesses find two or three things in that list, and all of them are settings. NexGen has been setting up business phone systems for Australian businesses for 17 years, is ISO 27001 Certified, and has an Australian-based support team, and this check is one of the shortest conversations we have.
See how a hosted phone system is set up for a business your size
A hosted setup puts the dial plan, the barring and the alerts in one place you can actually see.