Protecting your business phone system from toll fraud

Toll fraud is someone else making calls on your phone bill, usually long distance or international, after breaking into your phone system or voicemail. It tends to happen over a weekend or a holiday, and many businesses find out when the phone company calls about unusual activity, or when the bill arrives.

Updated October 16, 2026 · Twisted VoIP

How it happens

Voicemail with a default password. The FCC describes hackers calling into voicemail systems, looking for mailboxes still on a default password, and changing the greeting to something like "yes, operator, I will accept the charges" so collect calls get accepted automatically.
Phone system access codes. Older on-site phone systems often allow outside calls with an access code. Computers can try codes until one works.
Unused extensions. In one case the FBI investigated, hackers found unused extensions on business phone systems and reprogrammed them to make long distance calls billed to the businesses.
Stolen logins. On a cloud phone system, a user's or admin's password works from anywhere, so a reused or guessed password is enough.

Sources: FCC, Voicemail Hacking, FBI, Telecom Hacking Scheme.

Settings that stop most of it

Change every default voicemail PIN, including on mailboxes nobody uses. Use six digits or more, and nothing like an address, a birthday or 123456.
Delete or disable mailboxes and extensions for people who have left.
Turn off international calling for everyone who doesn't need it. If the business only calls a few countries, allow only those.
On a cloud system, use strong, unique passwords and turn on two-step sign-in for admins.
On an older on-site system, turn off remote access features you don't use, like dialing back out from voicemail, and change any access codes from their defaults.

Weekends and holidays are when this usually happens, because nobody notices a changed greeting or a burst of calls until Monday. Check call activity after long weekends.

If you think it happened

Call your phone provider right away. They can block international calling or suspend the account while you sort it out.
Change voicemail PINs and system passwords, starting with admin accounts.
Listen to your voicemail greetings. A strange "yes" greeting is a giveaway.
Ask the provider for a list of the calls, and keep it.

Questions

Am I responsible for fraudulent calls?

It depends on your provider's terms, so read them now rather than after a bad weekend. What every provider can do is block international calling before it starts.

Does a cloud phone system prevent toll fraud?

It removes some old risks, like access codes on an on-site system, but stolen passwords still work. Strong passwords, two-step sign-in for admins and international calling turned off by default are what matter.

How do I know if my voicemail was hacked?

Listen to the greeting on each mailbox, especially unused ones, and watch for calls you don't recognize on the call log or bill. Your provider may also flag unusual activity.

Want help with this?

Tell us what you have today and what you're trying to sort out. We'll come back with a plan and a quote. No obligation.

Related guides

General information, not legal advice. Check your own contracts and equipment.