The £900 Call You Never Made: A Small-Business Guide to VoIP Fraud

Toll fraud rarely announces itself. There is no dramatic alarm, no red light on the handset. Instead, a small UK business gets a phone bill with a cluster of international calls it never made, often placed in the early hours when the office is empty. By the time someone spots the pattern, the fraudster has moved on and the provider is asking who authorised the calls. The good news is that most of this is preventable with a handful of settings and a few awkward questions.

Why your phone system is interesting to a criminal

A modern VoIP phone system is a computer that makes calls. That is useful for a hybrid team, but it also means it can be scanned from the internet like any other service. Fraudsters run automated tools that look for exposed phone systems, default passwords, open admin pages and extensions that can dial out without restriction. They are not targeting your business personally. They are looking for weak settings at scale.

Once inside, they use your lines to route calls to international or premium-rate numbers. You get the bill; they get a share of the termination fee. A burst of calls to Uzbekistan is the classic example, but the destination changes. The pattern is what matters: lots of calls, odd hours, numbers nobody recognises.

The warning signs on a bill

Most SMEs only look at the total. That is exactly how fraud stays hidden. Open the call detail report, not just the summary page. Look for a sudden jump in international calls, calls to premium-rate prefixes such as 09, repeated short calls, calls from extensions that should only take internal calls, and activity outside normal office hours. Check voicemail too. A compromised voicemail PIN can let someone dial out through your system.

If your provider offers fraud alerts, make sure they go to a shared inbox that someone actually monitors. An alert that lands in a former employee's mailbox is not an alert.

The controls that actually help

The first move is to block what you do not need. Ask for international and premium-rate calls to be barred by default, then allow specific numbers for specific people. Most SMEs do not need every extension to dial abroad. Reception might need to call a European supplier; the accounts team probably does not need premium-rate access at 2am.

Next, tighten the basics. Change default admin passwords. Use strong voicemail PINs and lockout rules. Give each person their own permissions rather than sharing an admin login. Turn off unused extensions and services. Keep the phone system's admin interface off the open internet, or restrict it to trusted IP addresses. If your provider manages the system, ask them to confirm these settings in writing.

Finally, set a tripwire. A daily call-volume alert or a spend cap will not stop every fraudster, but it shortens the window. Make sure someone knows what to do when the alert arrives: call the provider's fraud team, bar outbound international and premium-rate calls, change passwords, and review call logs. In the UK, you can also report fraud to Action Fraud.

A short checklist for your provider

Use these questions at renewal or before you sign up. The answers should be clear, not buried in a PDF.

• Can you block all international and premium-rate calls by default on our account? What is the process to allow a specific number later?
• Do extension PINs and voicemail PINs have minimum strength and lockout rules? Can we set different outbound permissions by user?
• Can we restrict calling by extension, time of day, or destination? Is that included or an extra charge?
• What unusual-call alerts do you send, to whom, and how quickly? Can we set a spend cap or daily call-volume alert?
• If fraud happens, who is liable for the calls? What is the escalation path and how do we reach the fraud team out of hours?
• Can you give us call detail records in a usable format, and can you help us review them once a quarter?

Do not wait for the bill

Phone fraud is boring, which is why it works. A few default settings and a quarterly look at call records will stop most of it. You do not need a security project. You need twenty minutes with your provider, a clear list of who can dial what, and someone who checks the alerts. That is a lot cheaper than explaining a four-figure international bill to your finance director.

If you are reviewing your telecoms setup for 2026, put fraud controls on the agenda alongside price. The cheapest phone system is the one that does not pay for someone else's calls.