Are VoIP phones secure? VoIP security explained for businesses

Most UK businesses now make their calls over the internet, using VoIP (voice over internet protocol), whether that’s desk phones, a softphone app or Microsoft Teams. With the old analogue phone network being switched off, that move is no longer optional. So it’s a fair question: is it secure?

The short answer: yes, if it’s set up properly. VoIP calls can be encrypted and the system protected like any other business IT. The risks come from careless set-up, and increasingly from criminals using the phone to trick people.

How VoIP security works

A VoIP call has two parts:

• Signalling sets up, routes and ends the call. On good systems it is encrypted with TLS, the same technology behind secure websites.
• Media is the audio itself. On good systems it is encrypted with SRTP, so anyone intercepting it hears nothing useful.

Microsoft Teams Phone encrypts calls by default (Microsoft). With other providers, ask what’s encrypted, and whether that still applies once a call reaches an ordinary mobile or landline number.

The real risks to business VoIP

Risk	What happens	How to prevent it
Toll fraud	Criminals hijack your system and run up huge call bills, often overnight or at weekends	Spending caps, block premium and international numbers you don’t need, alerts on unusual calls
Default or weak passwords	Attackers log in to handsets or the admin portal	Change every default, use strong unique passwords and MFA on the admin portal
Unpatched handsets and software	Known flaws let attackers take control	Keep firmware and apps updated, retire devices that no longer get updates
Exposed admin pages	The phone system’s control panel can be reached from the internet	Restrict access to known locations or a VPN
Eavesdropping	Calls intercepted on an insecure network	Encryption (TLS and SRTP), separate the phone network from guest Wi-Fi
Call diversion fraud	Your numbers quietly redirected to an attacker	Lock down who can change call routing, review settings regularly

The bigger threat: people, not phones

Today the most damaging phone attacks don’t break into the system at all. They target the person answering.

• Spoofed numbers. Caller ID can be faked, so a call can appear to come from your bank, a supplier or your own office.
• Cloned voices. AI can now copy a voice from recordings, such as a video posted online, so the “director” urgently asking for a payment may not be your director.
• Fake IT support calls. Callers pose as your IT provider and ask staff to install remote-access software or read out a code.

The defence is process: confirm any payment request or change of bank details by calling back on a number you already hold, and agree how your IT team will genuinely contact staff. See phishing email examples for the email side of the same tricks.

Prove who’s calling: verification codes

Because caller ID and even voices can be faked, more businesses now verify callers with a one-time code:

• Customers calling you. Before discussing an account or making a change, send a short code by SMS or WhatsApp to the number already on file and ask the caller to read it back.
• You calling customers. Offer the same in reverse: “We’ll send you a code now, so you know it’s really us.” It reassures people who have learned (rightly) not to trust unexpected calls.
• Staff and IT support. Agree that IT will never ask for a password or an MFA code, and use a callback to a known number, or a code sent through your own systems, before acting on any request that changes access or money.

For high-value changes, such as bank details or large payments, don’t rely on one channel. SIM-swap fraud can intercept SMS, so pair a code with a callback, or use an authenticator app or WhatsApp linked to a verified number.

AI voice agents: answering, sales and outbound calls

VoIP has made AI voice agents practical for small businesses. An AI agent can now:

• It can answer calls at any hour as a virtual receptionist: greet callers, answer common questions, take messages and put calls through to the right person.
• It can book and change appointments directly in your calendar.
• It can qualify sales enquiries and pass hot leads to your team straight away.
• It can make outbound calls, such as appointment reminders and renewal check-ins.

Done well, far fewer calls go to voicemail. Done carelessly, they become a new security and compliance risk. The rules we apply:

• Tell callers it’s AI. Be upfront that they’re speaking to an AI assistant, and offer a route to a person.
• Verify before acting. Never let an AI agent change account details, take payments or reset access until the caller has passed a verification step, such as a one-time code sent by SMS or WhatsApp to the number on file.
• Limit what it can reach. Give the agent access only to the calendars, records and actions it needs, and log everything it does.
• Handle recordings as personal data. Call recordings and transcripts fall under UK GDPR: tell callers, keep them secure and delete them on a schedule.
• Follow the marketing rules for outbound calls. Live marketing calls must be screened against the Telephone Preference Service (TPS). Automated marketing calls need the person’s specific prior consent under PECR (ICO), and an AI agent making sales calls is likely to be treated that way, so take advice before using AI for cold outreach. Reminders and service calls to existing customers are a different matter.

We can build these from our agent catalogue: the AI Receptionist Agent ↗ answers calls and web enquiries day and night, and the AI Lead-Response Agent ↗ answers enquiries in seconds and books the appointment. For the fraud side, the AI Payment-Verification Agent ↗ checks bank details and flags suspicious invoices before money moves. The catch: with Jera IT support your first agent is built, supported and maintained free, but you pay for the AI it uses; we give you a rough idea of that cost before you commit.

VoIP security checklist

1. Change all default passwords on handsets, routers and the admin portal.
2. Turn on multi-factor authentication for every admin and user account.
3. Keep handset firmware, apps and routers updated.
4. Use a provider that encrypts signalling and audio.
5. Set spending limits and block call types you don’t use.
6. Keep phones on their own network, separate from guest Wi-Fi.
7. Restrict who can change call routing and diversions.
8. Train staff on spoofed calls and voice-cloning fraud.
9. Verify callers with one-time codes (SMS or WhatsApp) before account or payment changes.
10. If you use an AI voice agent, limit what it can do and require verification before it acts.

What has changed since we first wrote this

• The switch-off. The old analogue phone network (PSTN) is being retired by 31 January 2027 (GOV.UK). See the 2027 phone switch-off.
• Teams as a phone system. Many businesses now run their phones through Microsoft Teams, which brings phone security into the same place as email and files. See setting up Microsoft Teams.
• AI voice fraud. Cloned voices are now a real fraud tool. Verification is the defence.
• AI on your side of the line. AI receptionists are now practical for small businesses, with the limits set out above.

How Jera can help

We set up and look after secure VoIP and Teams Phone systems for businesses across Edinburgh, Glasgow and Aberdeenshire, with encryption and call restrictions set up from the start.

We can also set up an AI voice agent for you, with limits on what it can do and a route to a person. If you’ve moved to VoIP and nobody has looked at the settings since, book a call and bring the checklist above. More on our telecoms services.