Common telephone cybersecurity risks for businesses

team working on headset telephones

When answering the phones, being scammed is easier than you may realise. What seems like a harmless business call could lead to an employee giving away confidential company information and buying time for hackers to gain access to your system.

From revealing passwords, bank details or sensitive information regarding the whereabouts of certain files or systems, telephone calls can reveal a lot about a business and cost them millions.

So, what are common telephone cybersecurity risks, and how can companies be aware of them, and train their staff to spot potentially dangerous calls?

Common telephone cybersecurity risks

Telephony can often be overlooked or even ignored by cybersecurity strategies, but it’s an easy way for criminals to gain access to important files and information that can lead to breaches.

Common hacks and risks include:

  1. DoS (Denial of Service) Attacks
  2. Vishing
  3. Toll Fraud
  4. Eavesdropping
  5. Smishing

1. DoS (Denial of Service) attacks

What is it? Denial of Service (DoS) is a simple yet effective hack that involves flooding a network with calls or call signals to bring it down.

Who does it affect? Any business with a phone number. You don’t need to have a lot of extensions to be affected either.

What happens during a DoS attack? A hacker will flood a network, whether this is a phone number, domain, or broadband address, with incomplete call requests, causing the telephone service to become overwhelmed, and bringing the service down or making it increasingly slow.

How do I prevent it? You can help to prevent DoS attacks by limiting the number of people who can access a server, and ensure you have good encryption in place. However, sometimes DoS attacks happen regardless.

2. Vishing attacks

What is Vishing? It’s the voice-based counterpart of phishing and uses scam calls to try and get company details or important information.

Who does it affect? Vishing attacks commonly attack high-value industries, where company information could be worth millions. However, anyone could be vulnerable to a vishing attack.

How does vishing happen? Vishing will happen, commonly, in one of two ways:

  1. A phone call is made to a number, trying to trick staff to share confidential information such as passwords.
  2. An email is sent, saying an account has been compromised, and the recipient is told to ring a number to recover the account. When the number is rung, an automated response is played, asking the person to share account information.

How can I prevent a vishing attack? When it comes to prevention, educating staff is critical. Train your staff to be your human firewall and alert them to popular scam attacks, so they can read the signs of a cyber scam before it happens.

3. Toll fraud

What is it? Toll fraud occurs when hackers use a phone line to make calls to premium rate numbers continually. It’s successful because the hacker gets revenue share of each premium call rate made.

Who does it affect? This will affect anyone who can make a call to the public telephone network.

How does toll fraud happen? Some toll fraud happens through vulnerable phone systems, where a hacker will access a phone number and sell codes for dial-in access to allow people to use a company phone line to ring premium rate numbers.

The other type of toll fraud happens through modern telephone systems, where unsecure access to a phone system allows a hacker to log in and make hidden calls to premium rate numbers. Unless a company regularly checks their phone bill, it can go undetected for weeks.

How to prevent toll fraud: Limit the number of international calls someone can make and limit the spend in each country to prevent excessive spend. A regular budget review of phone spend, as well as tech audits, can help to uncover issues.

4. Eavesdropping

What is eavesdropping in telecoms? On phone lines that aren’t secure, anyone could, theoretically, listen in to your conversation without you knowing.

Who does it affect? Anyone could be at risk of this type of scam. Eavesdropping technology is used by governments, but any hacker could access any phone call at any point in time.

How does it work? All phone calls are transmitted through a phone line, and if that line isn’t secure, or a rogue employee gives someone access, then anyone can listen in to a phone call, and steal important information.

Ways to prevent eavesdropping: Use a secured phone line, and never share sensitive data over the phone.

5. Smishing

What is smishing in telecoms? Smishing is when a malicious text message is sent to a number, often pertaining to collecting information around tax or bank details, or getting you to send over sensitive information, such as healthcare or addresses.

Who does it affect? Smishing is targeted at mobile phone users, and when a mobile phone number is public, such as a work number, this can put a number at greater risk.

How does it work? A malicious text is received which contains a link that either contains a form designed to steal information, or a virus that is installed on a phone.

Ways to prevent smishing: Training is one core way to ensure that people know what to look out for. Similarly, by setting up spam filters and blocklists on your phone, you can remove known spam. Another part of this is being aware of genuine messages, and what isn’t a genuine message. As a general rule of thumb, never click on a link if it seems too good to be true.

How ramsac can help

ramsac provide cybersecurity training for teams and companies looking to create a human firewall and educate their staff on common scams and attacks. As with any ramsac service, everything we do is jargon-free, and helps to make IT simple.

If you’re looking for a jargon-free cybersecurity training company, get in touch today.

Related Posts

  • Celebrating Cybersecurity Awareness Month

    Celebrating Cybersecurity Awareness Month

    Cybersecurity

    October is Cybersecurity awareness month, follow us on LinkedIn or Twitter for daily tips on how you can protect your organisation against Cybercrime. [...]

    Read article

  • How cybercrime costs the UK economy nearly £27B every year

    How cybercrime costs the UK economy nearly £27B every year

    Cybersecurity

    Cybercrime costs claims nearly £27 billion of the UK economy almost every year. Cybercrime has only become more common, affecting many industries. Read more. [...]

    Read article

  • What is Zero Trust security and where should you start?

    What is Zero Trust security and where should you start?

    Cybersecurity

    Zero Trust security removes assumptions about trusting a user, even when they're inside your network. This means users and devices must be verified. Read here. [...]

    Read article

  • Why are charities increasingly being attacked by cyber criminals? 

    Why are charities increasingly being attacked by cyber criminals? 

    Cybersecurity

    More than a quarter of charities were reportedly the target of cybercrimes in the last year alone. But why are charities increasingly the victims of cyberattacks? Find out here… [...]

    Read article

  • Introducing the Cyber Resilience Certification from ramsac

    Introducing the Cyber Resilience Certification from ramsac

    Cybersecurity

    ramsac is committed to helping organisations to protect themselves against cybercrime, to help organisations understand where they are on their cyber resilience journey, we have created the ramsac cyber [...]

    Read article

  • How aware are you when it comes to social engineering?

    How aware are you when it comes to social engineering?

    Cybersecurity

    Cybercrime is huge; indeed, no other criminal activity is quite so lucrative, thus it is imperative that you prepare and protect both your business and your personal life to [...]

    Read article