Hosted phone system security is less about the cloud and more about one question: who can make calls on your account? Nearly every real-world phone system compromise ends the same way, with strangers placing expensive calls that you pay for. Eavesdropping and data theft matter too, but the bill is what usually arrives first.
The good news is that the defenses are known and mostly unglamorous: strong credentials, limits on where calls can go, current firmware, encrypted connections, and a clear split between what your provider handles and what you handle. This guide walks through each one, using what 3CX and Yealink document for the systems we deploy.
Toll fraud: what attackers actually want
3CX describes call fraud plainly: untrusted parties place calls through your PBX at your expense, usually overnight or when the office is closed, in bulk, to international destinations. Then the monthly bill arrives.
The motive is money. An attacker who controls premium international numbers dials them thousands of times from compromised systems and collects a commission per call or per minute, a scheme known as International Revenue Sharing Fraud. Stolen extension credentials are also resold to anyone who wants a free route to dial out.
3CX notes that in most cases it has seen, several misconfigurations together, not one, let the attacker in. That is why the defenses below are layered.
SIP registration attacks and password guessing
Every desk phone signs in to the phone system with a username and password, called a SIP registration. Automated scanners on the internet try to guess those credentials around the clock. The defenses are simple to state:
- Keep the random credentials. 3CX generates strong random values for each extension’s SIP login, the phone’s web interface and the voicemail PIN. Replacing them with something memorable, or with “temporary” test passwords nobody changes later, is the first mistake on 3CX’s own list.
- Let the blacklist work. In 3CX V20, when someone enters a wrong password more than 10 times, or a phone fails to register more than 5 times, the source IP address is blocked automatically. 3CX also runs a global IP blacklist that shares known attacker addresses between participating systems, and recommends keeping it on.
- Block remote SIP logins you do not need. 3CX extensions ship with “Block remote non-tunnel connections” ticked. The 3CX apps and web client still work, because they connect through 3CX’s tunnel. Untick it only for a remote phone that genuinely needs it.
- Restrict the admin console. 3CX can limit the management console to your office network and named public IP addresses, which stops anyone elsewhere from even reaching the login page.
One side effect worth knowing: because the block is by IP address, a single phone with stale credentials can get the whole office’s public address blacklisted. If several phones drop at once, that is one of the first things we check. Our guide to a Yealink phone that says No Service covers the symptoms.
Limit where your phones can call
The cheapest protection against toll fraud is making sure a compromised extension cannot reach the expensive destinations in the first place.
- Allowed country codes. A new 3CX system allows outbound calls only to its installation country. Add countries your staff actually call, and nothing else.
- Watch the Caribbean loophole. 3CX points out that the North American Numbering Plan lets US callers reach 25 regions and countries, including much of the Caribbean, without an international prefix. Those calls look local to the country filter, so strict outbound rules that block those prefixes belong at the top of the rule list.
- Strict outbound rules. A rule that lets any extension dial any number is what 3CX calls a lazy outbound rule. Define the prefixes, number lengths and extension groups that may dial out.
- A second check at the carrier. 3CX says country blocking on the PBX is a good basic protection but must also be configured at the provider level. Because Telnamix is the carrier as well as the platform operator for its hosted phone systems, that second layer sits with the same team.
Encryption: TLS, SRTP and the 3CX tunnel
A call has two parts: signaling (who is calling whom) and media (the audio). Each is encrypted differently.
- TLS encrypts signaling. 3CX documents Secure SIP over TLS and ships a Let’s Encrypt certificate for 3CX-provided domains. Yealink states that its current SIP phone firmware supports only TLS 1.2 and 1.3 by default.
- SRTP encrypts the audio itself. In 3CX it is set per extension, as “Enabled” (secure and non-secure allowed) or “Enforced” (secure only), and on a Yealink phone under Account, Advanced. Yealink phones show a security icon when an encrypted call is negotiated.
- The 3CX apps use tunnel encryption by default, so TLS and SRTP settings neither apply nor are needed there.
- Router phones and SBCs. A hosted 3CX system needs a router phone or session border controller on the office network, and 3CX lists encrypting all voice traffic to the hosted system as one of its jobs. The Yealink T53, T53W, T54W and T57W can act as router phones.
Be wary of anyone who promises blanket end-to-end encryption. 3CX, for example, does not officially support TLS on desk phones except for locally provisioned phones with a custom template. Ask which legs of a call are encrypted on your system and how.
Phone firmware and provisioning
Desk phones are small computers, and they get security fixes like any other. In August 2025 CISA published an advisory covering a long list of Yealink phone models and Yealink’s provisioning service, and the fix for the phones was a firmware update.
On 3CX, the admin console checks daily for new phone firmware that 3CX has tested, highlights out-of-date phones in red, and can update phones individually, in bulk or automatically. Yealink states that its phones accept only firmware carrying Yealink’s SHA-256 signature, boot only trusted software, and encrypt their configuration files.
Provisioning matters because the provisioning file carries the phone’s credentials. 3CX provisions phones through a secure provisioning link, delivered by the vendor’s redirect service or plug-and-play on the local network, and it recommends against STUN-based remote phones, which it does not support. When we deploy Yealink phones they arrive pre-configured, so nobody types a SIP password into a handset by hand.
Network segmentation
A flat office network where phones, laptops, guest Wi-Fi and the card terminal all share one segment makes every device a stepping stone to the others. Putting phones on their own VLAN (virtual LAN) limits that.
Yealink phones can pick up a voice VLAN automatically from the switch over LLDP or CDP, from DHCP, or from manual settings. They also support 802.1X, so a switch port only admits devices that authenticate, which Yealink notes prevents unauthorized access to the VLAN. Both features depend on the switches and firewall being set up for them, which is where our managed network service comes in: the same team runs the phones and the network they sit on.
Voicemail PIN hygiene
A voicemail box can be reached from an inbound call, which has always made it a target. 3CX assigns each mailbox a random PIN and temporarily locks a mailbox after repeated wrong guesses. Keep it that way:
- Do not change a PIN to 1234, the extension number, or anything printed on a desk card.
- Leave PIN authentication switched on for each extension.
- Treat a mailbox that locks repeatedly as a signal worth checking, not just an annoyance.
Our guide to a 3CX voicemail PIN that is not working or blocked explains the lockout and how to reset a PIN safely.
What your provider handles, and what you handle
Security on a hosted system is shared. This is how it splits on the systems we run:
| Telnamix (provider) | Your business |
|---|---|
| Platform maintenance, upgrades and monitoring | Who in your company has admin access |
| Strong credentials and secure provisioning for every phone | Telling us the day someone leaves, so their extension and apps are shut off |
| Phone firmware updates | Reporting a lost phone or laptop that has the app signed in |
| Outbound calling limits on the PBX and at the carrier | Approving which countries your staff need to call |
| Anti-hacking and blacklist settings | Keeping voicemail PINs private and unguessable |
| Office network, if you use our managed network service | Office network and firewall, if you run them yourselves |
The last row on the right is the human one. Social engineering, such as a caller posing as “the phone company” asking for a password or a forwarding change, gets past every technical control, so a short briefing for whoever answers the main line is time well spent.
Is a hosted system safer than one in your closet?
Usually, for practical reasons. An on-site PBX is only as secure as its last patch, and its data lives in one room. Our hosted platform is maintained daily and runs in geographically redundant data centers, so a fire or theft at your office does not take your phone system or voicemail with it. Settings still matter, which is why we keep a list of the 3CX phone settings that cost real money.
If you think something is wrong
Unusual international calls, a sudden spike in call volume overnight, or phones that all stopped registering at once deserve a call the same day. 3CX’s advice is not to panic and to capture logs before changing anything, so the evidence survives. If you are a Telnamix customer, email [email protected] or call (833) 835-6269 and we will lock it down and work out what happened. If you are weighing a move and want to know how your current system measures up, talk to us.