How secure is VoIP for business calls?

Is VoIP less secure than a landline?

It's a fair worry, but mostly the wrong way round. An analogue line isn't encrypted at all: anyone with physical access to the wiring can listen in. Modern cloud phone systems encrypt both the call setup and the audio. Microsoft Teams, for example, encrypts signalling with TLS and call audio with SRTP by default (Microsoft Learn).

What changes with VoIP is where the risk sits. Your phone system is now a set of online accounts, apps and internet-connected devices, so it needs the same care as email or Microsoft 365. Most VoIP incidents aren't clever eavesdropping. They're a guessable password, an admin account without multi-factor authentication, or an old handset left exposed to the internet.

The switch-off makes this question urgent. The analogue network closes on 31 January 2027 (Openreach, confirmed September 2026), so the choice isn't whether to use VoIP but how to run it securely.

What is toll fraud, and how do you stop it?

Toll fraud is the risk that costs businesses real money. Criminals get into a phone system, often out of hours, and use it to make large numbers of calls to premium-rate or international numbers they profit from. The first sign is often the bill.

It's big business. The Communications Fraud Control Association estimated global telecoms fraud at $38.95 billion in 2023, about 2.5% of telecoms revenue, and listed PBX (phone system) fraud and account takeover among the top methods. It also named the UK as one of the main countries fraud originates from (CFCA, November 2023).

Old on-site phone systems are a classic target, particularly voicemail boxes with default PINs and remote-access features nobody switched off. Cloud systems are attacked through stolen user or admin credentials instead. The controls are the same either way:

• Bar what you don't need. If nobody calls premium-rate or international numbers, block them. Allow exceptions per user, not for everyone.
• Set spend limits and alerts so unusual call volumes are flagged within hours, not at month end.
• Change every default PIN and password, including voicemail, and remove accounts for leavers on the day they go.
• Restrict out-of-hours outbound calling where the business doesn't need it.
• Keep handsets and phone system software patched, and never expose admin interfaces directly to the internet.

Are VoIP calls encrypted?

On the major platforms, they can be and usually are. Two standards matter. TLS (Transport Layer Security) encrypts the signalling: who's calling whom, and the call setup. SRTP (Secure Real-time Transport Protocol) encrypts the audio itself. Teams uses both by default, and uses TLS 1.2 or later with AES-256 (Microsoft Learn). 8x8 and 3CX support TLS and SRTP too, but on systems that use SIP trunks and third-party handsets, encryption has to be switched on and tested, not assumed.

One limit is worth knowing. Once a call leaves your provider's platform and reaches the public phone network, for example a call to a customer's mobile, your encryption stops at that boundary. That's the same for every business phone system. If a conversation is sensitive enough that this matters, use an end-to-end encrypted Teams call or meeting between the people involved.

How do you secure the accounts behind the phone system?

Treat phone system admin accounts like Microsoft 365 admin accounts, because they can do similar damage: redirect your main number, change call routing or create new users who can make calls.

That means multi-factor authentication on every admin and user portal that supports it, a small number of named admins rather than a shared login, and removing access when people leave. With Teams Phone, the same Microsoft Entra ID sign-in, MFA and conditional access that protect email protect the phone system. For 8x8 and 3CX, check who has admin rights at least once a year.

Phone-based phishing ("vishing") is the other human risk. Phishing was the most common type of attack reported by UK businesses in 2026, experienced by 38% of them (DSIT, April 2026), and it doesn't only arrive by email. Callers pose as the bank, a supplier or "IT support" and ask staff to read out a code or approve a sign-in. Make sure finance staff have a rule: payment detail changes are confirmed by calling back on a number you already hold, never the one the caller gives.

Can you call 999 on VoIP, and what happens in a power cut?

Yes, but there are two things to get right.

Location. Under Ofcom's General Conditions, phone providers must give access to 999 and 112 and pass accurate caller location information to the emergency services. In November 2025 Ofcom opened a compliance programme on exactly this, reminding providers that penalties can reach 10% of relevant turnover (ISPreview, November 2025). For a business, the risk is softphones. If someone dials 999 from a laptop app at home, the call may be reported as coming from the office address. Make sure every user and site has the right emergency address registered with your provider. Teams Phone supports emergency addresses and location-based emergency calling. Tell staff working remotely to call 999 from a mobile if they can.

Power cuts. An analogue phone was powered down the line, so it worked in a power cut. A VoIP phone and router need mains power. Ofcom's guidance requires providers to offer at least one solution that lets customers reach the emergency services for a minimum of one hour during a power cut at the premises, free of charge for those who depend on their landline (Ofcom, October 2018). The PSTN Charter signed by providers in December 2023 commits them to go beyond that one-hour minimum and not to migrate telecare users until a working solution is confirmed (House of Commons Library, April 2026).

For a business, the practical answer is a mobile phone on site, a small uninterruptible power supply (UPS) on the router and key switches if calls must survive short cuts, and a check that alarms, lift phones and any telecare equipment have their own battery or 4G backup.

Is call recording legal under UK GDPR?

Yes, if you do it properly. A call recording is personal data, so you need a lawful basis (usually legitimate interests or a legal obligation), a clear purpose such as training, quality or dispute resolution, and a retention period you actually enforce. Tell callers they may be recorded, typically in a message before the call connects, and tell staff in your workplace monitoring policy. The ICO's guidance on monitoring workers (October 2023) expects employers to be transparent and proportionate, and often to carry out a data protection impact assessment. The legal basis for businesses to record calls sits in the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018.

Two traps catch businesses out. First, card payments: never record card security codes. Pause recording while card details are taken, or use a payment method that keeps them off the call, to stay within PCI DSS. Second, access: recordings should be available only to the people who need them, and deleted on schedule. People can ask for copies of recordings of themselves through a subject access request.

Example: a 20-person booking office at a leisure venue records every call for quality and disputes. A sensible set-up would be a pre-call announcement, automatic pause during payments, 90-day retention unless a call is flagged, and access limited to two managers. That's illustrative, not a rule: set the retention period to match your purpose.

How Indigo does this. Indigo supplies 8x8, 3CX and Microsoft Teams Phone, secures admin access with MFA, sets call barring and spending alerts, and provides the managed connectivity and firewalls the calls run over. We're certified to ISO 27001:2022 for information security, with a scope that includes hosted telecoms, and hold Cyber Essentials Plus. Business phone systems →

What to do next

1. Turn on MFA for every phone system admin and user portal, and list who has admin rights.
2. Bar premium-rate and international calls you don't need, and set spend alerts with your provider.
3. Check emergency addresses for every site and remote worker, and tell home workers to use a mobile for 999 where possible.
4. Review call recording: announcement, lawful basis, retention period, access, and a pause for card payments.
5. Check power resilience for the router, key switches, alarms and lift phones. If you're still on analogue lines, start with the free PSTN switch-off check.