For most of the last two decades, the business phone system was treated as a separate piece of the office, something the telephone company owned and nobody else thought much about. That assumption has been quietly retired. Now that voice traffic travels across the same network, the same internet circuits, and often the same login portals as everything else a business runs, the phone system has become part of the attack surface, and it is being targeted accordingly. In my years reviewing client environments at ComSolutions, I have come to think of the phone system as one of the most commonly overlooked corners of a network, precisely because it still feels like "just the phones" to the people responsible for it.
The trend lines are not subtle. The FCC logged a roughly forty percent rise in toll-fraud incidents during 2025, and industry groups estimate that telecom fraud now costs businesses and carriers billions of dollars each year. Two attack patterns are doing most of the damage. The first is classic toll fraud, in which a compromised phone system is used to place hundreds of long-duration calls to premium-rate international numbers. The second is newer and more unsettling: AI-generated voice cloning, where a few seconds of sampled audio from a webinar or a voicemail greeting is used to impersonate an executive and authorize a payment or a change to the phone system itself.
How Toll Fraud Actually Happens
The mechanics of a toll fraud incident are rarely sophisticated. A weak password on a voicemail box, an unpatched session border controller, or an admin portal protected by nothing more than a reused credential is typically all that is required. Once access has been obtained, calls are placed to carefully chosen destinations, usually beginning on a Friday evening so that two days of weekend call volume hide the activity. The fraud is generally discovered on Monday morning, when either an unusually large phone bill is received or the carrier has shut the account down. By then, thousands of dollars in charges have usually already been accrued, and unlike a credit card charge, telecom fraud losses are not always reversible. The carrier is under no obligation to absorb the cost of calls placed through a business's own hijacked equipment.
A pattern I have seen more than once is a business that invested seriously in firewalls, endpoint protection, and employee security training, while the phone system sat outside all of it, administered through a vendor portal with a password unchanged since installation. The attackers did not need to defeat the security program. They simply walked around it through a door nobody was watching.
What Should Be Done About It
The good news is that VoIP fraud is largely a discipline problem rather than a technology problem, and the controls are well understood. Multi-factor authentication should be required on every administrative portal; as we noted when Microsoft ended text and phone-based MFA, the bar for acceptable authentication has been rising across the entire industry. Outbound calling should be restricted to the countries and call types a business actually uses, with international dialing disabled by default. Spending caps and after-hours call alerts should be configured so that an anomaly is flagged within minutes rather than days, and firmware should be patched on the same schedule as the rest of the network.
Voice cloning deserves its own mention, because the defense is procedural rather than technical. Any request that arrives by voice, no matter how convincing, and involves money, credentials, or changes to account information should be verified through a second channel before it is acted on. That habit costs nothing and defeats the technology entirely.
None of this requires an enormous budget, but the phone system must be treated as part of the IT environment rather than as a utility bill, a distinction we discuss in how much a small business should spend on IT. A plain-language overview of current telecom threats can also be found in the FCC's fraud, scam, and alert guides. The phone system has earned a place on the security checklist, and the businesses that give it one will be spared the Monday morning phone call nobody wants to receive.
