Your phone system has passwords too: a security checklist for UK businesses

When people talk about passwords at work, they usually mean email and Microsoft 365. Your phone system has passwords too. There’s a login for the online admin portal and one for each person’s phone app. Every voicemail box has a PIN, and every desk phone has its own settings page.

Those logins decide who can change where your calls go, and who can make calls on your account. If one of them is weak, the cost tends to show up on the phone bill.

This guide covers six checks worth making and what to do if your call charges suddenly jump. You can use it with any business phone system, and we’ll point out where ChromeX, Chrome’s hosted phone system, fits in.

Last reviewed 26 October 2026. Written by John McGilveray at Chrome Telecom.

Key takeaways

• A phone system has several logins: the admin portal, each person’s app, voicemail PINs and the settings page on each desk phone.
• Whoever gets into the admin portal can change where your calls go, so it needs MFA as well as a strong password.
• Barring calls you never make limits what a misused account can cost.
• Business phone contracts usually make the account holder pay for calls made through the account, even unauthorised ones.

Your phone system security checklist

Here are the six checks. Most are settings changes rather than new equipment, and your provider can make any you can’t make yourself.

1. Change voicemail PINs that are still the default or easy to guess.
2. Protect the admin portal with a unique password and multi-factor authentication.
3. Bar international and premium rate calls your business never makes.
4. Close down leavers’ phone access, including apps on their own mobile and any call forwarding.
5. Check your desk phones aren’t still on the maker’s default admin password.
6. If call charges suddenly jump, call your provider and check your call records.

Which parts of a phone system have passwords?

A hosted phone system, sometimes called cloud telephony or VoIP (voice over internet protocol), runs over your internet connection. People can take calls on a desk phone, a laptop or a mobile, and each of those ways in has a login.

Your provider should only make changes for people you’ve authorised, so keep that last list current.

Why would anyone target a phone system?

The main risk is someone using your account to make calls. It’s called dial-through fraud, or toll fraud. Calls are routed through your system to expensive international or premium rate numbers, and the charges land on your bill.

With a premium rate number, part of every call’s charge goes to whoever runs the number, which is what makes it worth abusing. The same trick works with high-cost international numbers. Europol calls it international revenue sharing fraud (IRSF): a criminal agrees with whoever runs the number to split the money from the calls.

There’s a quieter risk too. Someone who can sign in to the admin portal can change your call routes, for example forwarding your main number somewhere you didn’t choose.

Passwords can also leak in ways you don’t control. The National Cyber Security Centre (NCSC) says the most common way passwords are stolen is a data breach at an organisation that holds them. Criminals then try those passwords on other accounts, because so many people reuse them.

None of this means an attack is coming. It means the phone system deserves the same care as your email.

Why do voicemail PINs matter?

Many phone systems let people collect voicemail by ringing in from another phone and entering a PIN (personal identification number). That’s handy when you’re out, but it turns the PIN into a password that anyone with the number can try.

Get Safe Online, a UK internet safety advice site, lists remote-access voicemail among the features misused in dial-through fraud. Its advice is to set secure PINs for remote voicemail access.

A good voicemail PIN:

• isn’t the default the system came with
• isn’t 1234, 0000, a repeated digit or your extension number
• isn’t based on a birthday or anything else people could find out about you
• is as long as your system allows

The NCSC suggests a 6-digit PIN for phones and tablets, which is a sensible minimum for voicemail too.

If someone only picks up voicemail in the app or by email, ask your provider whether dial-in access to their mailbox can be switched off. On ChromeX, people can check voicemail in the desktop and mobile apps, and the Pro+ licence can turn voicemails into text.

How do you secure the admin portal?

The admin portal is the website where authorised people manage the phone system. On ChromeX, that includes adding users and extensions, managing numbers, updating call routes and setting opening hours. Whoever signs in can change where your calls go.

The portal can be reached from the internet, so a password on its own isn’t enough. The NCSC says signing in to an online service with only a password isn’t strong enough to protect sensitive data. It also says any form of MFA beats relying on passwords alone.

• Turn on MFA. It adds a second check when someone signs in, such as a code from an app or a prompt on their phone. A stolen password on its own then isn’t enough.
• Use a unique password. Don’t reuse one from email or anywhere else. The NCSC suggests joining three random words, which gives you something long and strong that you can still remember. A password manager can create and store one for you.
• Give each person their own login. A shared admin login makes it hard to tell who changed what. Give people the access their role needs, then review the list every few months, as the NCSC suggests for important accounts.

The ChromeX portal supports MFA. It also offers single sign-on with supported Microsoft and Google accounts, so people can sign in with the work account they already use. If you’re a Chrome customer and MFA isn’t switched on yet, ask us and we’ll talk you through it.

To find out when work logins linked to your email domain turn up in leaked data, our dark web monitoring can alert you.

Which calls should you bar?

Call barring stops your phone system from dialling certain kinds of number. If the system can’t dial a number, nobody can run up charges calling it. Barring works on whole types of call, such as every 09 number, rather than blocking one number at a time.

Get Safe Online’s advice is to restrict any destinations you wouldn’t normally dial. Its examples are premium rate numbers, international numbers and operator services such as directory enquiries.

Numbers worth thinking about:

• 09 numbers. Premium rate lines. Ofcom says the service charge can be up to £3.60 a minute, plus your phone company’s access charge.
• 118 numbers. Directory enquiries. The service charge is capped at £3.65 for every 90 seconds.
• International numbers. If nobody in your team rings abroad, bar them. If a few people do, ask whether barring can be set person by person or limited to the countries you deal with.

Ofcom’s figures are a guide for home phones, and business tariffs vary.

Barring shouldn’t stop emergency calls. Ofcom’s rules say providers must make sure everyone can call 999 and 112, but check this with your provider when the barring is set up.

While you’re talking to your provider, ask whether it can alert you or set a limit if call spending suddenly rises. Get Safe Online notes that some providers watch for unusual spikes, or cut services off at an agreed threshold. It’s also worth asking whether it can cap how many outside calls run at once.

ChromeX includes account controls and call restrictions to reduce the risk of unauthorised use. We’ll go through which call types your team actually needs and how the restrictions should be set.

What happens to phone access when someone leaves?

When someone leaves, their email and laptop are usually top of the list. Their phone access belongs on it too. The NCSC points out that accounts belonging to people who’ve left often stay active without anyone noticing, and advises removing or disabling them.

For a phone system, check:

• Their extension. Reassign the number or point it at a colleague, so customers who ring it still reach someone.
• Apps on their own devices. If the phone app is still signed in on a personal mobile or laptop, they can still call out on your account.
• Call forwarding. If their extension forwards to their personal mobile, business calls will keep reaching them until it’s removed.
• Admin access. Remove any portal login they had, and change any shared password or PIN they knew.
• Ring groups. Take them out of any group of phones that rings together, so callers aren’t waiting on a phone nobody answers.

Are your desk phones still on default passwords?

Each desk phone has its own small settings page, which you open in a web browser from your office network. Many desk phones ship with a default admin login, and makers publish those defaults on their own websites so installers can find them.

If nobody has changed that login, anyone on your network who knows it could change the phone’s settings. The NCSC’s advice for devices is simple: if one comes with a default password, change it.

On a hosted system, the provider can set that password centrally when it sets the phones up. Ask yours whether it has, especially for phones you bought yourself or kept from an old system. If Chrome set up your phones, ask us and we’ll confirm how they were configured.

What do unexpected call charges mean?

A sudden jump in call charges doesn’t always mean fraud. Someone may have started ringing a supplier abroad, or a forwarding rule may be sending calls to a mobile. It’s still worth checking the same day.

Signs worth a closer look:

• calls to countries you don’t do business with
• calls made while the office was closed
• calls from an extension nobody uses, or one that belonged to someone who’s left
• a bill much higher than usual

If something doesn’t look right:

1. Call your provider straight away. Phone rather than email, and ask them to check the account and bar the numbers involved.
2. Look at your call records. Check which extension made the calls, when, where to and for how long. ChromeX reporting covers outgoing calls as well as incoming ones, including the time, number, destination and duration.
3. Change the logins involved. Reset the portal password and any voicemail PINs. Look for changes you didn’t make, such as new users or forwarding rules.
4. Report it. If you’re in England, Wales or Northern Ireland, report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101. Report Fraud replaced Action Fraud in December 2025.

Keep notes of what you found and what you changed, with times. Your provider and the police may ask for them.

Then check your contract. Business phone contracts usually make the account holder responsible for charges from unauthorised use, and Chrome’s own terms say the same. That’s why barring and spending alerts are worth setting up before you need them.

If you’re a Chrome customer, call 03333 212 707. A suspected security problem counts as urgent. Our office hours are 8.30am to 5pm, Monday to Friday, and cover outside those hours depends on your agreement.

How Chrome helps

We look after business IT, cyber security and phones as one team, so your phone system can go on the same leavers checklist as Microsoft 365.

With ChromeX, we’ll set the system up around the way your business works. We’ll help you choose access levels, explain the security options, including MFA and call restrictions, and train your team on everyday basics like voicemail. If something looks wrong on your bill, you’ll have one team to call.

If you’re on another provider’s system, the same checks apply, and we can go through them with you.

A sensible place to start

Start with two checks this week. Switch on MFA for the admin portal, and ask your provider which call types your system can dial today. Then work through the rest of the list.

If you’d like a second opinion on your wider setup, take our free IT health check. It’s eight questions and gives you a score straight away. Or speak to our team on 03333 212 707.