Cloud PBX • Security

Cloud PBX voicemail security: shut the door toll fraudsters use

The voicemail box is the most overlooked door into a business phone system, and a weak PIN is all an attacker needs to run up a bill in expensive international minutes. Here is how to lock it, in an afternoon.

Last verified 10 June 2026 By the WhichVoIP editorial team 7 min read

Weak PINsthe most common way in

Toll fraudyour bill, their profit

MFAlocks the admin portal

One afternoonto close the gap

The short answer

How do I protect my Cloud PBX voicemail from being hijacked?

Close the four doors attackers use. Enforce unique six-digit-or-longer voicemail PINs and scrap every default; disable remote voicemail access for anyone who does not need it; turn on multi-factor authentication for the admin portal; and watch your call logs for unexpected international traffic. None of it is hard. It just has to be done deliberately, because the defaults that ship with a new system are not safe to leave.

digit minimum for a voicemail PIN worth trusting

US$ in global telecom fraud a year (CFCA)

default settings most teams never change after setup

default PINs like 1234 that are ever safe to keep

A business desk phone with a padlock icon symbolising secured voicemail on a Cloud PBX — The voicemail box rarely gets a second look after setup. That is exactly why it is the door attackers reach for first.

How a voicemail hijack actually works

This is not a clever new trick. It is an old, reliable one that keeps working because businesses leave the defaults in place.

The attacker guesses or already knows a weak voicemail PIN, often a default like 0000 or 1234, and gets into a mailbox. From there the damage is real. They can listen to sensitive client messages, intercept the password-reset codes that some services read out to a business number, and, most expensively, set up call forwarding or outbound routing to premium-rate international numbers they control. Every call placed earns them a share of the charge, and your business is left holding a bill that can reach thousands of rands before anyone notices.

The path from a weak PIN to your bill

The reason it keeps working is simple: most businesses configure a phone system once and never revisit the security settings. Attackers know this, and they scan for it. Globally, the Communications Fraud Control Association put telecom fraud losses at roughly US$38.95bn a year in its 2023 survey, with about US$6.23bn of that in international revenue-share fraud, the category this attack feeds. The fix is not exotic; it is housekeeping that most teams simply skip.

Five steps to secure your voicemail today

Do not assume your provider has done this for you. Work through the list and verify each item yourself.

Run a full voicemail PIN auditHave every user reset their PIN now. Enforce a real policy: at least six to eight digits, no sequences like 345678, no repeats like 555555, and no birth years. Then disable the extensions of anyone who has left, because dormant boxes are easy targets.

Restrict remote voicemail accessThe attack depends on reaching voicemail from an outside line. Ask whether each user genuinely needs to check voicemail from another number. Where they do not, switch remote access off on that extension. This single change closes the main entry point.

Put MFA on the admin portalThe administrator portal controls everything. If it is guarded by a password alone, it is exposed. Turn on multi-factor authentication so a second code is needed to log in, and account takeover becomes far harder even if a password leaks.

Watch the call logs and set limitsReview call logs monthly, and ask your provider to flag or cap calls to high-risk international destinations. A sudden spike in premium-rate traffic is usually the first visible sign of a hijack, so the sooner you see it, the smaller the bill.

Brief your teamTell staff why the PIN rules exist and what a suspicious voicemail or unexpected forwarding setting looks like. The people using the system every day are the ones most likely to notice something is wrong first.

Watch-out: if your provider cannot show you how to enforce PIN rules, disable remote voicemail access and turn on admin MFA, that is a security gap on their side, not just yours. Ask the question directly before you renew.

Red flags versus safe actions

A quick self-check. If you recognise the left column anywhere in your setup, move it to the right.

Area	Red flag (vulnerable)	Safe action (secure)
PINs	Default PINs like 1234 or the extension number	Unique six-digit-plus PINs for every user
Remote access	Off-net voicemail open for everyone by default	Remote access off unless a user needs it
Admin portal	Protected by a password only	Mandatory MFA on the admin login
Monitoring	Call logs never checked	Monthly log review and international-call alerts
Ownership	Assuming the provider handles all security	Verifying each control yourself

Voicemail toll fraud is not a sophisticated hack. It is an unlocked door, and the businesses that get hit are the ones who never went back to check the locks.

WhichVoIP editorial view

A Cloud PBX admin portal login screen requesting a multi-factor authentication code — Multi-factor authentication on the admin portal is the highest-leverage control here: it protects every extension at once.

Our verdict

Voicemail hijacking endures because it preys on neglect, not on any weakness unique to cloud telephony. A business that enforces strong PINs, closes off unnecessary remote access, puts MFA on the admin portal and actually reads its call logs removes almost the entire attack surface in a single afternoon. The cost of doing it is an hour of admin time. The cost of skipping it is a fraud bill, a reputational dent, and the scramble of regaining control of your main phone line.

Our recommendation: treat this as standing maintenance, not a one-off. Re-audit PINs and access whenever someone joins or leaves, and make admin-portal MFA and international-call alerts non-negotiable on any provider you stay with.

Is your provider helping you stay secure?

If you are struggling to enforce these controls, or your provider treats security as an upsell, it may be time to compare. See South African VoIP and Cloud PBX providers and get a quote that puts security on the table.

Get Cloud PBX quotes Read the fraud-prevention guide

Frequently asked questions

What is a voicemail hijack scam?

It is a form of toll fraud where an attacker uses a weak or default voicemail PIN to access a mailbox, then sets up call forwarding to premium-rate international numbers they profit from. The business is billed for the calls. It also lets them hear sensitive messages and intercept reset codes sent to the number.

How do I set a secure voicemail PIN?

Use at least six to eight digits. Avoid sequences (345678), repeats (555555), the extension number, and personal information like birth years. Change it from any default the system shipped with, and have every user do the same across the whole Cloud PBX.

Should employees be able to check voicemail remotely?

Only those who genuinely need it. Remote, off-net voicemail access is the main entry point for a hijack, so disable it on extensions that do not require it. Restricting this single feature closes the most common attack path with no real loss of function for most staff.

Does MFA stop voicemail toll fraud?

MFA on the admin portal is one of the strongest controls, because it protects the settings that govern every extension, including call forwarding. Combined with strong PINs and restricted remote access, it makes both account takeover and mailbox hijacking far harder.

How would I know if my PBX has been compromised?

The clearest early sign is unexpected call traffic, especially a spike in calls to international or premium-rate numbers, in your logs. Reviewing logs monthly and asking your provider to alert on high-risk destinations means you catch it while the bill is small.

Is voicemail security my provider’s job or mine?

Both, but the responsibility ultimately sits with you to verify. A good provider gives you the tools, PIN policies, access controls, MFA and alerting, but the settings have to be switched on and maintained on your account. Never assume it has been done for you.

Keep reading

The full VoIP fraud-prevention guide Compare Cloud PBX providers and get quotes

Sources: Communications Fraud Control Association (CFCA) 2023 Global Telecom Fraud Survey (US$38.95bn total, US$6.23bn IRSF) for industry context; standard PBX/voicemail security and toll-fraud-prevention practice (PIN policy, remote-access restriction, admin MFA, call-log monitoring). No provider-specific claims. Verified 10 June 2026.