Klytic

Home›Guides›Telephony

Telephony · Understand

Securing IP telephony and limiting fraud

Phone fraud does not steal a file: it places calls, often abroad or to premium-rate numbers, at the company’s expense. It takes advantage of an account with a weak password, an exposed phone system or overly permissive calling rules. A few simple controls, and monitoring of usage, greatly reduce the risk.

Updated October 20267 minOfficial sources cited

What phone system fraud costs

Hijacking a phone system is nothing new; it is also known as phreaking. A practical guide published as part of the business workshops of Arcep, the French telecoms regulator, describes its most common form: lines diverted to destinations abroad, to premium-rate numbers, through automatically generated calls. The fraudster earns money from these numbers.

The same guide cites the case of a French département council that received, in November 2015, a bill of €43,000 for fraudulent calls to Africa. The order of magnitude is enough to grasp what is at stake: the bill goes to the company whose line was used, sometimes several weeks after the fact.

The guide also notes that phone systems, PBX or IP PBX, are prime targets because their security is often less closely monitored than that of IT servers. A phone system installed years ago, whose passwords nobody has changed, is exactly what a fraudster is looking for.

What is exposed

IP telephony has to accept connections from the Internet: that is what allows a traveling employee to make calls with the app on their phone. Three entry points concentrate the risk.

  • Accounts that register from the Internet. Each phone, softphone or app connects to the phone system with an identifier and a secret. If this secret is short, a default value or reused, it can be guessed or tried in bulk.
  • Administration and voicemail passwords. Left at their installation values, they give access to the settings, including forwarding to outside numbers. The Arcep guide calls for changing all passwords at installation, then regularly.
  • Overly permissive calling rules. A reception phone that can call any country, at any time, turns a stolen account into an open line to the whole world.

The connection to the carrier, the SIP trunk, is a fourth point. Its credentials give access to the outlet to the public network. They must never be used anywhere other than on the phone system.

Reducing the risk

Effective controls are few. The Arcep guide emphasizes passwords, usage policy, updates and monitoring. Applied to IP telephony, they look like this.

  1. Long, unique secrets for each phone account, changed at installation, then whenever someone leaves or a compromise is suspected. Voicemail codes are not left at their default values.
  2. Calling rights by profile. A phone that does not need to call internationally does not have access to it. Premium-rate numbers are blocked by default. Forwarding to outside numbers is only enabled for people who need it.
  3. Time windows. Calls to expensive destinations can be limited to business hours, when someone is around to notice an anomaly.
  4. Encryption from phones to the platform, TLS for signaling and SRTP for voice. It prevents credentials and conversations from being read in transit, for example on public Wi-Fi.
  5. Updates to the phone system, phones and apps, tracked in the operations contract.
  6. A non-public administration interface, accessible only from identified addresses or accounts, with two-factor authentication if available.

These measures are decided at the organization level, with the phone system operator. They do not require any particular technical skill from users.

Signs of a hijacked account

A hijacked account shows up first in usage, rarely in security logs. Signals to watch for:

  • an abnormal volume of outgoing calls for one phone or for the phone system as a whole;
  • destinations never called before, especially international or premium-rate numbers;
  • bursts of short, repeated calls;
  • activity at times when the office is closed, at night or on weekends;
  • a phone connecting from an unusual country or network;
  • call forwarding to an outside number that nobody requested.

These signs can be read in the call history, provided someone looks at it. That is why the Arcep guide also recommends asking the carrier whether it analyzes traffic and cuts off calls to abnormal destinations, especially outside business hours. Automatic detection of abnormal usage, by the operator or the carrier, is more reliable than manual review.

What to do at the first sign

The priority is to stop the spending, then to understand.

  1. Shut down the account concerned, or the destinations involved, without waiting for the analysis to finish.
  2. Change the secrets of the account, and of all accounts that shared the same password.
  3. Review the call history to date the start of the abuse and list the numbers called.
  4. Alert the carrier that connects the phone system, to block the destinations and document the billed calls.
  5. Check forwarding and any modified settings, then gradually reopen the necessary rights.

Filing a police complaint can be useful, particularly for later discussions about the bill. Your legal advisor will tell you whether it is appropriate in your case.

This guide describes controls, not attack techniques. Detailed operating parameters are set with your phone system’s operator.

Example: a firm closed on weekends

A hypothetical case. On Monday morning, the manager of an eight-person firm receives an alert from her provider: the meeting room phone placed dozens of short calls to the same country between 2 a.m. and 5 a.m. on Sunday. The account had been automatically disabled after a few minutes.

The firm changes the phone’s secret, realizes it has never needed to call internationally and removes that right. The fraud cost a few minutes of calls, instead of an entire weekend.

Frequently asked questions

Is a hosted phone system less exposed than an on-premises IP PBX?

It is monitored and updated by the operator, which eliminates the forgotten phone system. Accounts and calling rules still need to be configured. See VoIP, SIP, IP PBX and UCaaS.

Who pays for fraudulent calls?

The bill is sent to the line holder. Any sharing of costs depends on the contracts with the carrier and the operator: review them before an incident.

Is encryption enough against fraud?

No. It protects the path. An account with a weak password can still be used by a third party, even over an encrypted connection.

Are recordings also a risk?

Yes, if too many people can access them. See Who can listen to recordings in Klytic Tel.

Where Klytic fits

With Klytic Tel, each organization has its own phone server: an account hijacked at another customer does not give access to yours. Klytic operates this server, keeps track of its updates and monitors it, whether it is hosted in the Klytic cloud or installed on your premises.

Communications between phones or apps and the platform are encrypted with SRTP and TLS. The landline calling plans offered by Klytic include fraud protection through detection of abnormal usage. It is a control run by the operator, not a dashboard you have to build yourself.

The exact exposure depends on the connection. If you keep your carrier, part of the monitoring of the outlet to the public network is also its responsibility: ask what it provides. Calling rights by profile and time windows are defined with Klytic during setup. Support answers in French by phone, and in all languages by email through a ticketing tool.

Klytic is not a SecNumCloud-qualified offering, and no service completely eliminates the risk of fraud.

Sources

Consulted in October 2026.

  • Arcep, practical guide “La fraude téléphonique : une menace pour les entreprises” (Phone fraud: a threat to businesses), from the business workshops (updated May 2, 2016): diversion of lines to premium-rate numbers abroad, example of a €43,000 bill, recommendations on passwords, usage policy, updates and traffic analysis by the carrier. arcep.fr
  • IETF, RFC 3261, “SIP: Session Initiation Protocol”: SIP is the application-layer signaling protocol that establishes, modifies and terminates sessions, including calls. rfc-editor.org
  • Klytic, Klytic Tel page: dedicated server, SRTP and TLS encryption, fraud protection through detection of abnormal usage on landline plans. klytic.com
  • Klytic, Security & backup: continuous monitoring, security updates tracked by the Klytic team. klytic.com

Review your telephony

We look with you at the calling rights, accounts and connectivity of your phone system.

Talk to an advisor →

Discover Klytic Tel

Further reading

Understand · TelephonyVoIP, SIP, IP PBX and UCaaS: which architectureVoIP, SIP, IP PBX, UCaaS: definitions useful when buying, then the choice between a shared service, a dedicated server or on-premises, and multi-site setups.7 min readRead →Understand · TelephonyWhat a phone platform knows about your companyA call leaves traces even without recording: call history, directory, voicemail, logs, backups. Who holds them, and who can see the numbers.7 min readRead →Use · TelephonyWho can listen to recordings in Klytic TelWhere your recordings are in Klytic Tel, how to restrict listening to a few people, which lines to record, and the case of voicemail sent by email.5 min readRead →

Welcome offer

30 days free trial, migration support included

No-commitment trial. An advisor calls you back to understand your needs and prepare your Klytic workspace.

🚀 Start the free trial See pricing