What to Do If You've Been Compromised

Call your VoIP provider's support line right away. Ask them to:

1. 1
   Temporarily disable outbound calling on your account
2. 2
   Block any suspicious destinations or international routes
3. 3
   Flag your account for investigation

Log in to the Manager Portal and change every administrator password immediately. If you have multiple admin accounts, change them all — you don't yet know which credentials were compromised.

1. 1
   Log in to the Manager Portal
2. 2
   Navigate to account settings
3. 3
   Change your password to something strong and unique (16+ characters)
4. 4
   Repeat for every admin-level account

Use Dial Permissions to disable international and premium-rate calling across all users. You can selectively re-enable it later once the situation is contained.

1. 1
   Go to Dial Permissions in the Manager Portal
2. 2
   Set international calling to disabled for all extensions
3. 3
   Save changes and verify the restriction is active

Review every extension and registered device on your system. If you see anything you don't recognize — an unfamiliar extension number, a device MAC address that doesn't match your inventory, or a registration from an unexpected IP address — disable it immediately.

1. 1
   Open the device/extension list in the Manager Portal
2. 2
   Compare against your known inventory
3. 3
   Disable or delete any unrecognized entries
4. 4
   Document what you found before removing it

Your Call Detail Records are the primary evidence for understanding what happened. Export and review them carefully.

1. 1
   Export CDRs for at least the past 7 days
2. 2
   Filter for international and premium-rate calls
3. 3
   Look for calls to unusual destinations (countries you don't do business with)
4. 4
   Identify high-volume periods — especially nights, weekends, and holidays
5. 5
   Note the extensions that placed the suspicious calls

Beyond extensions, check which devices are actively registered to your system. Attackers sometimes register rogue softphones or SIP clients to place calls.

1. 1
   Review the active registrations in your portal
2. 2
   Cross-reference IP addresses with your known office locations
3. 3
   Look for registrations from foreign IP addresses or VPN services
4. 4
   Deregister anything suspicious

If your portal provides login audit logs, review them for:

• Logins from unfamiliar IP addresses or geographic locations
• Access at unusual times (late night, weekends)
• Multiple failed login attempts followed by a successful one
• Any admin-level actions you didn't perform

Change the SIP username and password for every affected device — and consider resetting all devices on the system if the breach scope is unclear.

1. 1
   Generate new, strong SIP credentials for each extension
2. 2
   Update the credentials on each physical device or softphone
3. 3
   Verify each device re-registers successfully with the new credentials
4. 4
   Confirm no old registrations remain active

If MFA isn't already active on your Manager Portal, enable it now for every admin account. This is one of the most effective ways to prevent future unauthorized access.

1. 1
   Go to account settings in the Manager Portal
2. 2
   Enable Multi-Factor Authentication
3. 3
   Set up an authenticator app (not SMS if possible)
4. 4
   Require MFA for all admin-level users

Now that the immediate threat is contained, review and tighten your Dial Permissions to follow the principle of least privilege — each user should only be able to call the destinations they actually need.

1. 1
   Review each user's calling needs with their manager
2. 2
   Disable international calling for users who don't need it
3. 3
   Set appropriate outbound call limits per extension
4. 4
   Block premium-rate number ranges if not needed

Create a thorough written record of the incident. This is essential for your provider, your management team, and any insurance claim.

Your documentation should include:

• Timeline — when the fraud was first detected, when each response step was taken
• CDR exports — the raw call data showing fraudulent calls
• Affected extensions — which extensions were compromised
• Actions taken — every change you made to contain and remediate
• Financial impact — estimated charges from fraudulent calls
• Provider communication — notes from your calls with support