For a medical, dental, or vision practice, a phone outage is more than an inconvenience. Patients may miss appointment reminders, staff may lose a key way to coordinate care, and an exposed phone system can generate unexpected charges or create another path for attackers to exploit.

Hosted VoIP is still a network service. It depends on accounts, devices, internet connections, and configuration choices, so it needs the same deliberate protection as other business technology. Begin by checking not only whether calls work, but who can change phone settings, where calls can go, and how unusual activity will be spotted.

How phone fraud targets a practice

Toll fraud happens when someone gains unauthorized access to a phone account or system and uses it to place calls that create charges for the business. Attackers may target the phone administrator portal, a user’s credentials, voicemail, a phone, or a network device. They may then make international or premium-rate calls, sometimes outside business hours.

Phone fraud can also involve people, not just phone-system settings. A caller may impersonate a carrier, vendor, insurer, or support technician and pressure an employee to share credentials or change call-forwarding or voicemail settings. A related text message, often called smishing, may direct a staff member to a fake sign-in page.

The important distinction is that this article focuses on the practice’s phone system and the financial and operational harm it can face. A convincing phone call can be the opening move; unauthorized dialing, changed call flows, or compromised accounts may be the result.

“A phone system is only as dependable as the access rules, call permissions, and monitoring behind it.”

As you assess your setup, treat phone security as part of your practice’s broader IT plan, not a task to leave solely to the phone vendor.

What a fraudster might do in the first hour

This is an illustrative walkthrough, not a prediction of how every incident unfolds. The timing and techniques vary, but a short scenario helps clarify why quick detection matters.

1. Find an opening. An attacker may use a stolen password, an exposed administration interface, a compromised device, or information obtained through an impersonation call.
2. Test access. They may try to sign in, explore account privileges, or determine whether an extension, voicemail box, or forwarding rule can be changed.
3. Change a setting or begin calling. If permissions allow it, the attacker could enable outbound dialing, alter call routing, or place a burst of calls to costly destinations.
4. Continue until noticed. A practice with no after-hours alerts, destination limits, or spending controls may not spot unusual activity until staff return or a bill arrives.

The FBI’s report on a telecom hacking scheme describes criminals misusing business phone systems to place long-distance calls to premium numbers. The practical lesson is straightforward: limit what an account can do, and make suspicious use visible quickly.

Put these defenses in place

Use this section as a starting point for a conversation with your hosted VoIP provider or IT partner. Exact settings differ by provider and system, so confirm what is available in your environment.

1. Secure the administration portal

Require a strong, unique password for every administrator and enable multifactor authentication (MFA) wherever the provider supports it. Avoid shared administrator logins. Give each person only the permissions needed for their role, and remove accounts promptly when staff or vendors no longer need access.

Ask whether the provider records administrative changes and sign-in attempts. Keep the portal, devices, and any supporting software updated, and avoid exposing management interfaces directly to the public internet when a more restricted access method is available.

2. Restrict expensive outbound calls

Disable international and premium-rate calling by default if your practice does not need it. If international calling is necessary, allow only the destinations required for business. Ask the provider whether restrictions can be enforced at both the tenant and carrier levels, and whether per-user or account-wide spending limits are available.

Do not assume that “hosted” means your potential loss is automatically capped. Ask how unusual call patterns are detected, when service can be suspended, how quickly alerts are sent, and how disputed charges are handled.

3. Separate voice traffic from practice systems

Where your network supports it, place phones and voice services on a dedicated voice VLAN rather than leaving them on the same flat network as clinical workstations and administrative devices. Segmentation can help limit unnecessary communication between systems if a device or account is compromised.

This is a design decision to plan with your IT provider: voice services still need the right connections to work. Review firewall rules, remote access, and any vendor-managed equipment so that necessary traffic is allowed without making management services broadly accessible.

4. Review call flow and after-hours rules

Check where calls go during business hours, after hours, and when lines are busy. Confirm that voicemail access and call forwarding are assigned to the right people. Disable unused extensions and features, and review who is allowed to change greetings, forwarding, or routing.

Treat unexpected changes as an event worth verifying. If a caller claims to be a vendor and asks staff to alter call handling, have employees confirm the request through a known contact method, not a number or link supplied during the call.

5. Monitor for unusual activity

Set up notifications for activity that does not fit your practice’s usual pattern: a sudden increase in outbound calls, calls to unfamiliar international destinations, repeated failed sign-in attempts, long calls after hours, or changes to call-forwarding settings. Tune the alerts with your provider to reduce noise while ensuring that someone responsible will receive and act on them.

Review call-detail records (CDRs) regularly, not only when the monthly invoice arrives. Make sure the practice knows who receives alerts and who can ask the provider to suspend international dialing or affected accounts in an emergency.

Train staff on phone-system-specific scams

Keep training practical and tied to the work employees actually do. Tell staff never to share passwords or MFA codes with a caller, even if the person claims to represent a phone vendor, insurer, or IT support team. Ask them to pause and verify unusual requests through a known, trusted channel.

Teach employees to report suspicious calls and texts quickly, especially if they entered credentials, approved an unexpected sign-in, or changed a phone setting. This is not about blaming staff; it is about making early reporting easy so the practice can respond before a small incident grows.

The FCC’s VoIP consumer guide explains that VoIP can support local, long-distance, wireless, and international calling. Check what your particular service permits rather than assuming the system’s default settings match your practice’s needs.

Hosted VoIP security checklist

Use this checklist during your next review with your phone provider or IT partner:

• MFA is enabled for administrator accounts, with unique credentials for each user.
• Unused accounts, extensions, and features are disabled.
• International and premium-rate dialing is blocked unless specifically required.
• Necessary destinations are allowlisted, with spending limits or alerts configured where available.
• Voice traffic is separated from clinical and administrative devices where practical.
• Phone management interfaces and remote access are restricted and reviewed.
• Business-hours, after-hours, voicemail, and forwarding rules have named owners.
• Alerts cover unusual call volume, destinations, sign-ins, and configuration changes.
• Someone reviews call records and knows how to contact the provider’s fraud team.
• Staff know how to report suspicious calls and verify requests to change phone settings.
• Your practice has a documented process to suspend dialing, secure accounts, and preserve call records if fraud is suspected.

If you suspect toll fraud, contact your provider immediately to restrict outbound calling and secure affected accounts. Preserve relevant call records, alerts, and administrative logs. Ask the provider to investigate and explain its process for reviewing charges. If the incident may involve patient information, assess it through your practice’s established privacy and security response process.

Don’t confuse a phone feature with HIPAA compliance

A hosted phone service is not automatically HIPAA-compliant simply because it is used by a healthcare practice. Evaluate how the system handles information that could identify a patient, including voicemail, recordings, messages, and account data. Confirm appropriate vendor agreements and safeguards with your compliance adviser, and include the phone service in your security risk analysis where applicable.

The CISA Healthcare and Public Health Sector Mitigation Guide offers broader guidance for reducing technology risk in healthcare environments. Use it as a reference alongside provider-specific documentation and advice from your IT and compliance professionals.

Make the phone system part of your continuity plan

Reliable phones help your practice stay connected to patients and staff. Begin with access controls, restrict costly calling, separate voice traffic where practical, and monitor for changes that do not fit your normal pattern. Then document who will act if an alert arrives after hours.

ClearPath360 helps Michigan businesses bring managed IT and cybersecurity into a coordinated plan. If your practice is in Genesee County or nearby, explore ClearPath360’s services and discuss how to strengthen phone-system security as part of your wider technology environment.