Common telephone cybersecurity risks for businesses

team working on headset telephones

When answering the phones, being scammed is easier than you may realise. What seems like a harmless business call could lead to an employee giving away confidential company information and buying time for hackers to gain access to your system.

From revealing passwords, bank details or sensitive information regarding the whereabouts of certain files or systems, telephone calls can reveal a lot about a business and cost them millions.

So, what are common telephone cybersecurity risks, and how can companies be aware of them, and train their staff to spot potentially dangerous calls?

Common telephone cybersecurity risks

Telephony can often be overlooked or even ignored by cybersecurity strategies, but it’s an easy way for criminals to gain access to important files and information that can lead to breaches.

Common hacks and risks include:

  1. DoS (Denial of Service) Attacks
  2. Vishing
  3. Toll Fraud
  4. Eavesdropping
  5. Smishing

1. DoS (Denial of Service) attacks

What is it? Denial of Service (DoS) is a simple yet effective hack that involves flooding a network with calls or call signals to bring it down.

Who does it affect? Any business with a phone number. You don’t need to have a lot of extensions to be affected either.

What happens during a DoS attack? A hacker will flood a network, whether this is a phone number, domain, or broadband address, with incomplete call requests, causing the telephone service to become overwhelmed, and bringing the service down or making it increasingly slow.

How do I prevent it? You can help to prevent DoS attacks by limiting the number of people who can access a server, and ensure you have good encryption in place. However, sometimes DoS attacks happen regardless.

2. Vishing attacks

What is Vishing? It’s the voice-based counterpart of phishing and uses scam calls to try and get company details or important information.

Who does it affect? Vishing attacks commonly attack high-value industries, where company information could be worth millions. However, anyone could be vulnerable to a vishing attack.

How does vishing happen? Vishing will happen, commonly, in one of two ways:

  1. A phone call is made to a number, trying to trick staff to share confidential information such as passwords.
  2. An email is sent, saying an account has been compromised, and the recipient is told to ring a number to recover the account. When the number is rung, an automated response is played, asking the person to share account information.

How can I prevent a vishing attack? When it comes to prevention, educating staff is critical. Train your staff to be your human firewall and alert them to popular scam attacks, so they can read the signs of a cyber scam before it happens.

3. Toll fraud

What is it? Toll fraud occurs when hackers use a phone line to make calls to premium rate numbers continually. It’s successful because the hacker gets revenue share of each premium call rate made.

Who does it affect? This will affect anyone who can make a call to the public telephone network.

How does toll fraud happen? Some toll fraud happens through vulnerable phone systems, where a hacker will access a phone number and sell codes for dial-in access to allow people to use a company phone line to ring premium rate numbers.

The other type of toll fraud happens through modern telephone systems, where unsecure access to a phone system allows a hacker to log in and make hidden calls to premium rate numbers. Unless a company regularly checks their phone bill, it can go undetected for weeks.

How to prevent toll fraud: Limit the number of international calls someone can make and limit the spend in each country to prevent excessive spend. A regular budget review of phone spend, as well as tech audits, can help to uncover issues.

4. Eavesdropping

What is eavesdropping in telecoms? On phone lines that aren’t secure, anyone could, theoretically, listen in to your conversation without you knowing.

Who does it affect? Anyone could be at risk of this type of scam. Eavesdropping technology is used by governments, but any hacker could access any phone call at any point in time.

How does it work? All phone calls are transmitted through a phone line, and if that line isn’t secure, or a rogue employee gives someone access, then anyone can listen in to a phone call, and steal important information.

Ways to prevent eavesdropping: Use a secured phone line, and never share sensitive data over the phone.

5. Smishing

What is smishing in telecoms? Smishing is when a malicious text message is sent to a number, often pertaining to collecting information around tax or bank details, or getting you to send over sensitive information, such as healthcare or addresses.

Who does it affect? Smishing is targeted at mobile phone users, and when a mobile phone number is public, such as a work number, this can put a number at greater risk.

How does it work? A malicious text is received which contains a link that either contains a form designed to steal information, or a virus that is installed on a phone.

Ways to prevent smishing: Training is one core way to ensure that people know what to look out for. Similarly, by setting up spam filters and blocklists on your phone, you can remove known spam. Another part of this is being aware of genuine messages, and what isn’t a genuine message. As a general rule of thumb, never click on a link if it seems too good to be true.

How ramsac can help

ramsac provide cybersecurity training for teams and companies looking to create a human firewall and educate their staff on common scams and attacks. As with any ramsac service, everything we do is jargon-free, and helps to make IT simple.

If you’re looking for a jargon-free cybersecurity training company, get in touch today.

Related Posts

  • How to Spot a Scam HMRC Letter 

    How to Spot a Scam HMRC Letter 

    Cybersecurity

    Learn how to spot fraudulent communications, like fake HMRC letters, and take steps to protect your personal information and finances from scammers. [...]

    Read article

  • What is Data Loss Prevention (DLP)?

    What is Data Loss Prevention (DLP)?

    CybersecurityTechnical Blog

    Explore how Data Loss Prevention (DLP) strategies and tools protect sensitive data, ensure regulatory compliance, and mitigate risks from insider threats, enabling organisations to stay secure and resilient in [...]

    Read article

  • AI-Driven Threat Detection and Response

    AI-Driven Threat Detection and Response

    AICybersecurityTechnical Blog

    This blog explores how AI-driven cybersecurity is transforming threat detection and response with real-time, adaptive defenses against evolving cyber threats. [...]

    Read article

  • Why you should invest in Cybersecurity Consultancy

    Why you should invest in Cybersecurity Consultancy

    Cybersecurity

    n an increasingly complex cyber threat landscape, investing in cybersecurity consultancy is essential to protect your business from potential risks and ensure long-term resilience. [...]

    Read article

  • Everything you need to know about the transition to ISO 27001:2022 

    Everything you need to know about the transition to ISO 27001:2022 

    Cybersecurity

    This blog explains the essential steps and timeline for transitioning from ISO 27001:2013 to ISO 27001:2022, ensuring your organisation maintains its certification before the October 2025 deadline. [...]

    Read article

  • Why your organisation needs VMaaS: Turning vulnerabilities into strengths

    Why your organisation needs VMaaS: Turning vulnerabilities into strengths

    Cybersecurity

    Discover how ramsac’s VMaaS can transform vulnerability management from a reactive headache into a proactive strategy that strengthens your organisation’s cybersecurity. [...]

    Read article

Quiz yourself

Are you more cyber savvy than an 11 year old?

11-14 year olds get asked these questions in school. Could you get these right?