Business phone fraud: how it gets in and how to stop it

An unexpected phone bill is not always the provider’s mistake. It may point to compromised credentials, a misconfigured extension, an unauthorised call forward or calls to destinations the company does not use. Business phone fraud can be mistaken for a legitimate international call or a one-off use of a line.

Training staff helps, but it is not enough. A company needs to decide who can make calls, to which destinations, at what times and within what limits. It also needs to check call forwarding, access permissions and call records before unusual activity becomes a bill that is hard to dispute.

A cloud PBX lets you set these rules for users and extensions. Security depends on more than the technology: you need to configure permissions, spot unusual calling patterns and have a procedure for blocking access when unauthorised calls appear on company lines.

What is phone fraud in a small business, and why does it go unnoticed?

Phone fraud means someone uses a company’s phone service without authorisation to make money or run up costs. An attacker might use an account, an extension, a call forwarding rule or the company’s numbers. The call appears to come from the business, but no one on the team authorised it.

Fraud does not always start with an obvious spike in the bill. It may first appear as a single call to a destination the business regularly uses. It can also blend into the work of someone who calls customers, suppliers or offices in other countries. Spain’s INCIBE covers types of impersonation and communications abuse in its business security alerts.

Three assumptions can hide the problem:

• It is a billing error. The person responsible spots an unexpected charge and contacts the provider without checking who placed the calls, from which extension and at what time.
• It is a legitimate international call. A business with customers or suppliers abroad may assume the destination is valid. The warning sign is a call pattern that does not fit that person’s or department’s work.
• The extension owner made the call. The call is linked to a real user. That does not prove they made it: their credentials may have been exposed, or someone may have exploited an open configuration.

The question is not just “How much has the bill increased?” It is “Who could make calls, through which access point, at what times and with what permission?” Without that record, the business reacts to the charge but cannot identify where the call came from.

Training the team helps, but it is not enough. Prevention means controlling permissions, destinations and calling hours before an unauthorised call reaches the bill.

Four ways phone fraud gets in

Spain’s INCIBE lists several forms of communications fraud and impersonation in its business alerts. For a small business operating across countries, these are four places to check before looking for the cause in the phone bill.

1. Compromised credentials

An employee reuses a password across several services. Someone obtains those credentials and accesses the phone system’s admin panel. From there, they can create extensions, change permissions or place calls using the company’s identity.

The risk grows when several people share one login. It also grows when no one disables the account of someone who has left the company.

2. Misconfigured extensions

An extension may have outbound calling permissions it does not need. A reception desk, for example, might be allowed to make international calls. A temporary user might be able to call any destination.

This can go unnoticed when a business assigns default permissions and never checks what each extension can do. The call appears legitimate because it comes from a real user account.

3. Unauthorised call forwarding

A change to call forwarding can send incoming calls to another number. It can also alter the routing of a call queue, a schedule or an extension. A third party could then intercept calls or use an existing configuration to hide their activity.

Checking who made the calls is not enough. Check who changed the settings and when the forwarding takes effect.

4. High-risk destinations and numbers

Unauthorised calls may go to international destinations or numbers with high call charges. A compromised extension can generate traffic to destinations the business never uses, while the rest of the phone system works as usual.

Spain’s CNMC publishes information on its measures against number spoofing, but each business still needs its own limits: allow only the destinations it needs and block the rest.

The warning signs before an unexpected phone bill

Phone fraud in small businesses often leaves a trail before it shows up on the bill. The problem is that many businesses do not check for these patterns until an unfamiliar charge appears. One unusual call does not prove fraud. Several warning signs together call for an immediate review.

Watch for these changes:

• Calls outside normal working hours. An extension making calls overnight, on a public holiday or while the office is closed deserves attention. Check for on-call staff, an emergency service or an authorised campaign before blocking it.
• New destinations. Review the first calls to countries, dialling codes or number ranges the business does not normally use. The destination may not match any known customer, supplier or international team.
• Longer calls. An extension making calls that last much longer than usual may be under someone else’s control. Check for consecutive calls of similar length, too.
• Unusual extension activity. A rarely used extension that starts generating call traffic is a warning sign. So are calls made while its user is away. Compare the call records with what the employee was doing.
• Changes to call forwarding. A new forwarding rule to a mobile number, an international number or a destination nobody recognises needs a direct check. Do not assume the change is legitimate just because it appears in the cloud PBX settings.

Compare current activity with each user’s normal pattern, not just the total on the bill. Record who spotted the anomaly, when it appeared and which calls occurred around it. That context helps distinguish a legitimate business need from unauthorised access and speeds up the response if the pattern continues.

How to limit phone fraud through your cloud PBX settings

Training helps, but it is not enough. Someone can fall for a scam and hand over their credentials. Your settings must limit what happens next.

Start with permissions for each user. Not every extension needs to make international calls, set up call forwarding or change routing rules. A receptionist can have different permissions from an administrator. Keep management accounts separate from extensions used for everyday calls.

Next, restrict destinations. Block international dialling codes your business does not use, and allow only the countries you need to call. Apply the same rule to premium-rate numbers and any other destination with no business purpose.

Set calling hours. An extension used only during working hours should not be making calls in the middle of the night. Outside normal hours, require additional authorisation or block outbound calls. This does not replace monitoring, but it limits the opportunity for abuse.

Add usage limits. If your cloud PBX supports them, you can cap call duration, spending or the number of calls per period. Decide what happens when a limit is reached: block further calls, alert the person responsible or require a manual review.

Pay particular attention to call forwarding. Keep a list of approved numbers and require approval before anyone changes it. Forwarding calls to an unknown mobile number can take customer calls outside the channels your business controls.

Protect access with unique passwords, stronger authentication where available and a credential recovery process controlled by the person responsible. Revoke accounts as soon as people leave the business.

Finally, review permissions, destinations, calling hours, limits, forwarding rules and call logs every month. Cloud PBX security depends on regular checks, not on settings nobody looks at again.

What to do in the first hours after spotting suspicious calls

Act in this order. The aim is to stop further calls and preserve the evidence needed to work out what happened.

1. Block the compromised access. Disable the extension shown in the call records. End active sessions and change its password. If several people share credentials, replace them with individual accounts. Do not delete the user or its settings yet.

2. Check extensions and call forwarding. Identify which extensions made the calls, which devices they used and what permissions they had. Check active forwarding rules: an unauthorised change could send incoming calls to another number or allow outgoing calls through a route your team does not use.

3. Temporarily restrict outgoing calls. If your cloud PBX allows it, block destinations that are not needed for daily operations. Keep only essential routes open until you understand the scope of the incident. Do not restore every permission just for convenience.

4. Preserve the records. Export or save the available details: date, time, extension, destination, duration, call direction and recent configuration changes. Record who spotted the problem and when. Avoid altering this data during the investigation.

5. Contact your provider. Send a specific list of the calls, affected extensions and steps you have taken. Ask whether the provider can see any further access, changes or patterns. Request guidance on blocking destinations and recovering the accounts safely.

6. Check your billing. Separate legitimate calls from suspicious ones and compare the cloud PBX records with your operator’s itemised call records. Do not assume every unfamiliar call is fraudulent: check who was supposed to make it and why.

7. Document the incident. Keep emails, screenshots, records and provider responses together in one case file. This information will help you correct permissions, explain the impact and decide which controls should remain in place after the block.

How to check each month that your phone system is under control

Cloud PBX security does not end with the initial setup. Permissions change, new users join and exceptions can stay active longer than necessary. Set aside time each month to review the settings and record what you find.

Use this checklist:

• Users and permissions. Compare the user list with your current staff list. Remove accounts belonging to people who have left the company. Check who can make external calls, change call forwarding or edit business-hours rules.
• Allowed destinations. Check which countries, prefixes and number types each user or department can call. Remove exceptions that no longer serve an operational need.
• Calling hours. Review when outbound calls are allowed and what happens outside normal business hours. An extension that can make calls overnight needs a clear reason.
• Call records. Filter by destination, duration, user and time of day. Look for calls that do not fit the team’s work: new destinations, unusually long calls or activity concentrated on one extension.
• Configuration changes. Check who changed permissions, call forwarding, hours and call routes since the last review. If you cannot identify who made a change, treat it as an incident.
• Active call forwarding. Confirm that every forwarded call still goes to the intended number. Remove forwarding rules linked to former colleagues, finished campaigns or completed tests.
• Account access. Confirm that each user has only the access they need. Change credentials if you suspect a problem, and review how accounts are recovered.

Record the date, the person responsible, the changes made and any approved exceptions. That turns an informal check into a repeatable control. If you spot an unusual pattern, do not wait for the bill: block the affected access and investigate.

Frequently asked questions

How can I tell if a business call is fraudulent?

A call may be suspicious if it is made outside normal business hours, goes to an unfamiliar destination or comes from an extension that should not make that type of call. Check the call logs, extension permissions and call forwarding settings before assuming it is a billing error.

What should I do if someone has used my cloud PBX to make calls?

Block the credentials and restrict outgoing calls while you investigate. Then check extensions, call forwarding settings and recent changes. Preserve the call logs, notify your phone provider, review the bill and document what happened.

How can I block unauthorised international calls?

Set destination restrictions and allow only the country codes your business needs. Apply the rule by user or extension, and review it when team roles change. High-risk destinations and available controls depend on your provider and the product you use.

Can a cloud PBX restrict calls by user and time of day?

Yes, a cloud PBX may offer user permissions, time-based restrictions and destination limits, if those features are included in your product. Before deploying one, ask the provider which controls are available, how to configure them and what records they produce.

Who pays for fraudulent calls?

There is no single answer. It depends on the contract, the type of service and how the unauthorised access happened. Report the incident to your phone provider as soon as possible, request an itemised call record and review the applicable terms before accepting or disputing the charge.

See how a cloud PBX can restrict call destinations, hours and permissions for your business.

Sources

• Avisos de seguridad para empresas — INCIBE — 2026-09-03
• Telecomunicaciones — ámbito de actuación — CNMC — 2026-09-03