Yes, a well-chosen and properly configured cloud phone system can be secure enough for most UK businesses, and often safer than an ageing on-site PBX that nobody has patched in years. But “can be” is the key phrase. Security depends on the provider’s platform and on how you set up and use it, and both halves matter.
The question is timely. The UK’s legacy phone network is due to be retired on 31 January 2027, and Openreach has said it will not be delayed again. Many firms replacing ISDN are looking at hosted telephony for the first time and, understandably, want to know what they’re trading off.
This guide covers the real risks, what a provider should do and what you need to do yourself.
First, a Fair Comparison
It’s tempting to ask whether the cloud is safe in isolation. A better question is: safer than what?
An old on-site PBX sits in a cupboard, is often forgotten and may run outdated software. Its admin interface may be reachable from the internet with a default password. The UK’s National Cyber Security Centre has warned smaller organisations that they could be exposed to attacks targeting their PBX systems, and its guidance covers both managed cloud-based and on-premises PBX. In other words, neither model is automatically safe.
A cloud phone system moves a lot of the technical burden to a provider with dedicated security staff, monitoring and patching. That’s a genuine advantage for most small firms. But it also puts your phone system on the internet by design, so identity and access controls matter even more.
What “Secure” Means for a Phone System
Security covers three things.
Confidentiality. Can someone listen to calls, read voicemails or access recordings?
Integrity and fraud protection. Can someone use your system to place calls at your expense, change call routing or impersonate your business?
Availability. Can an attack or fault take your phones offline when customers need you?
A strong provider addresses all three. A weak one may focus on one and ignore the rest.
The Main Threats
Toll Fraud
This is the most common and costly risk. Attackers gain access to a phone system and place large volumes of calls to premium-rate or international numbers they profit from. Security guidance consistently highlights that toll fraud can generate large volumes of international calls and substantial charges before anyone notices. Small firms are not exempt. Weak or reused passwords and unmonitored accounts make them attractive targets.
Account Takeover
If an attacker steals an admin or user password, they can change settings, divert calls, listen to voicemails or download recordings. Phishing emails and reused passwords are the usual route.
Eavesdropping
Calls travelling over the internet can be intercepted if they aren’t encrypted. Modern services should protect both the call setup and the voice itself, typically using secure protocols such as TLS and SRTP.
Voicemail Access
Weak voicemail PINs and remote-access features are an old but persistent weakness. Voicemail often contains sensitive information.
Denial of Service and Outages
Attacks that flood a platform or your connection can disrupt calls. Availability is partly a security matter.
Caller ID Abuse
Spoofed numbers can be used to impersonate a business. This is a risk for customers, and it can also harm your own number’s reputation if someone misuses it.
Remote and Home Working
Staff on home Wi-Fi, personal devices or public networks widen the attack surface. Guidance on remote VoIP users notes that unsecured home networks, unmanaged devices and weak authentication create opportunities for eavesdropping, credential theft and toll fraud.
Who Is Responsible for What?
Security in a cloud phone system is shared.
The provider is responsible for the platform: data centres, network security, encryption, patching, monitoring, redundancy and their own staff access. They should also provide tools you can use, such as MFA and fraud controls.
You are responsible for how your people and devices use the system: strong passwords, who has admin rights, handset firmware, your router and firewall, staff awareness, removing leavers and the choices you make about features such as international calling.
Many incidents come from the second group, not the first. A provider with excellent security can’t protect an admin account with a weak password.
What a Good Provider Should Offer
When you assess hosted VoIP systems, ask for specifics, not reassurances.
Encryption
Ask whether signalling and voice traffic are encrypted by default or only on request, and which handsets and apps support it. If encryption is optional, find out how to switch it on.
Strong Access Controls
The admin portal should support multi-factor authentication. The NCSC’s advice is to start with strong passwords and multi-factor authentication for administrator accounts. Role-based permissions let you give staff only the access they need, and audit logs should show who changed what.
Fraud Controls
Look for spending limits, alerts on unusual call patterns, the ability to block high-risk destinations and rapid response if fraud is detected. Ask how quickly the provider acts and who bears the cost if fraud occurs, because the answer varies by contract.
Patching and Platform Security
Ask how the provider handles updates, vulnerability management and monitoring. A good provider will explain this plainly.
Resilience
Ask about data centre redundancy, backup carriers and how the service behaves during an attack or outage. For your own side, plan automatic diversion to mobile numbers and battery backup for your router.
Data Location and Data Protection
Under UK GDPR, call data, voicemail and recordings can be personal data. Your provider will usually act as a processor on your behalf, so you need a written agreement that sets out what they do with the data. Ask where data is stored, whether it leaves the UK, who can access it and how long it’s kept. Ask what happens to your data if you leave.
Independent Assurance
Certifications such as Cyber Essentials, a UK government-backed scheme, or ISO 27001, an international information security standard, can be useful signals. They aren’t guarantees, so ask what’s covered and who audited it.
Incident Response
Ask what happens if there’s a breach or attack: how will you be told, how quickly and what support will the provider give?
What You Need to Do Yourself
These steps cost little and prevent most common problems.
- Turn on multi-factor authentication for every admin account, and for users where it’s available.
- Use strong, unique passwords and a password manager.
- Limit admin rights to people who genuinely need them, and remove leavers promptly.
- Restrict international and premium-rate calling to the users and destinations that need it.
- Set spending limits and alerts, and check usage reports regularly.
- Change default voicemail PINs and disable remote voicemail access if you don’t need it.
- Keep handsets and routers updated, and don’t expose phone admin pages to the internet.
- Give remote staff clear guidance on home networks, devices and phishing.
- Test your failover so you know what happens in an outage.
Cloud Phone Systems for Small Businesses
A cloud phone system for a small business is often more secure than what it replaces, mainly because the provider handles the technical heavy lifting. But small firms rarely have an IT department to manage settings, so choose a provider that makes the secure option the default: MFA switched on, fraud limits preset and clear guidance. A cloud-based phone system for business use should feel simple to protect, not a project in itself.
For regulated firms, such as solicitors, financial advisers and healthcare providers, security questions go further: recording, retention, access logs and data location may carry compliance obligations. Involve your compliance lead early.
A Realistic Example
A 20-person architecture practice in Bristol is moving from an old PBX to a cloud phone system. The partners worry that moving calls onto the internet is riskier.
When they review the old setup, they find the PBX admin page is reachable from outside the office, the software hasn’t been updated in years and several former staff still have voicemail access. On the cloud platform, they enable MFA for admins, restrict international calling to two people, set daily spending alerts, assign roles and ask the provider for its data protection terms. They also train staff on phishing and check router firmware.
They conclude that the new setup is better protected than the old one, mainly because they now manage access properly, not because the cloud is magic.
A Simple Checklist for Providers
- Is encryption applied to calls and signalling, and by default?
- Is MFA available for admins and users?
- What fraud controls, limits and alerts are included?
- Who bears the cost if fraud occurs?
- Where is data stored, and who can access it?
- What does your data processing agreement cover?
- Which independent certifications do you hold, and what do they cover?
- How do you handle patching and incident response?
- What redundancy protects the service?
- What happens to my data if I leave?
Wavetel Business is one example of a UK provider you might speak to about this, and any provider offering a hosted telephony system should be willing to answer these questions in writing and explain how responsibility for security is shared.
Frequently Asked Questions
Are cloud phone systems more secure than traditional phone systems?
Often, because providers handle patching, monitoring and infrastructure security. But an old on-site PBX can still be better protected than a poorly configured cloud account. Both need good access controls.
Can someone listen to my calls on a cloud phone system?
Not easily if calls are encrypted, but you should confirm that encryption is applied to both signalling and voice, and that your handsets and apps support it.
What is toll fraud, and how do I prevent it?
Toll fraud is when attackers use your phone system to place costly calls. Use MFA, strong passwords, restricted international calling, spending limits and alerts.
Is a cloud phone system GDPR compliant?
Compliance depends on how it’s set up and managed. Ask your provider about data location, processing agreements, retention and security, and take advice if you handle sensitive data.
Who pays if my cloud phone system is hacked and used for fraud?
It depends on your contract and how the breach occurred. Ask providers before you sign, and ensure fraud limits and alerts are switched on.
Conclusion
Cloud phone systems can be secure enough for UK firms, but security isn’t something you simply buy. It comes from a provider with solid encryption, access controls, fraud protection and resilience, combined with your own sensible habits around passwords, permissions and monitoring.
The practical takeaway is to ask providers for specifics, switch on multi-factor authentication from day one and set spending limits and alerts before you go live. Do it well ahead of January 2027, so you have time to configure and test securely.
