UK telecom fraud: how it works, what it costs SMEs, and how to lock it down

UK telecom fraud is unglamorous and expensive. A compromised PBX dialled-through over a weekend can rack up four-figure bills before Monday morning. A voice-phishing scam can drain a finance account on Tuesday afternoon. A "slammed" number can disappear from your control with no warning.

Five common patterns in 2026, what they actually cost UK SMEs, and the controls every business should have on their phone system this year. Practical, no scare-marketing.

1. Dial-through (toll fraud)

Hackers compromise your PBX or a SIP extension — usually a weak password on a softphone, a forgotten admin login, or a mis-configured trunk — and use it to make calls. The favourites are international premium-rate numbers (often obscure satellite carriers in the Pacific) where the criminal takes a kickback from the destination operator. They run for hours over a weekend or bank holiday when nobody's watching, and the bill arrives the following month.

Typical cost: £500–£20,000 per incident on an unprotected setup. UK SMEs are hit thousands of times a month.

How to lock it down

• Strong passwords on every extension. No default 1234, no shared admin password.
• Disable international dialling by default. Most UK businesses don't call overseas. Whitelist the countries you do call, block everything else.
• Block premium-rate destinations. Premium ranges (09, satellite, audiotext) should be blocked outright unless you genuinely need them.
• Cap concurrent outbound calls. A business of 10 people doesn't need 25 simultaneous outbound calls. Set a sensible ceiling.
• Set spend alerts. Daily/weekly bill thresholds that fire an email or text when exceeded.
• Monitor weekends and bank holidays. The classic dial-through window.

With NumberGroup Membership we apply sensible defaults out of the box — international blocks, premium-rate blocks, concurrent-call caps, anomaly alerts. You can relax any of them, but they start switched on.

2. Voice phishing (vishing)

A scammer rings your finance team pretending to be a supplier, the bank, HMRC, or — in the more sophisticated version — your own CEO. They ask for a payment, an account change, an authorisation code, a password reset.

Modern vishing uses AI voice cloning to mimic actual people. Three minutes of a CEO's podcast audio is enough to generate a convincing impersonation that asks the finance team to push £50,000 to a new supplier "urgently."

How to lock it down

• Out-of-band verification for payment changes. If a supplier emails new bank details, ring them back on the number you already have on file — never the number in the email.
• Two-person sign-off above a threshold. Anything above £5k requires a second person to authorise. Sounds slow — saves your bacon when it counts.
• Code word. Agree a phrase with senior staff that confirms identity on urgent unsolicited calls requesting money or sensitive action.
• Train the team. Quarterly "how would you respond to this scenario" exercises beat one-off posters.

3. SMS phishing (smishing)

Text messages pretending to be from Royal Mail ("your parcel is held"), HMRC ("you have a tax refund"), DVLA ("your driving licence has expired"), or a bank. Click the link and it leads to a credentials-harvesting site or a malware install.

UK smishing has industrialised since 2022 — much of it delivered through compromised SIM gateways and SIP trunks.

How to lock it down

• Personal phones: don't click unsolicited links. Forward suspect SMS to 7726 (free, spells SPAM) to report.
• Business mobiles: deploy mobile device management (MDM) with link-scanning if you can.
• Outbound SMS from your business: use a licensed UK provider that signs messages with a verified sender ID, so customers know it's genuinely you.

4. Number slamming

A rogue provider initiates a porting request to move your telephone number to their network, using fraudulent or forged authorisation. If your current provider doesn't spot it, the number transfers — and now belongs to whoever ran the slam.

Ofcom has tightened the porting process significantly (the UK Calling reforms and subsequent General Conditions updates) but slamming still happens, particularly to businesses with weak provider relationships.

How to lock it down

• Use a carrier with proper porting controls. We require authenticated authorisation before processing any port-out. Resellers in long supply chains are weaker on this.
• Ask us to flag your numbers. We can put a port-freeze / extra authorisation step on your numbers so an unauthorised port-out can't complete silently — just ask the team to enable it.
• If a port-out fires unexpectedly: report to your carrier immediately. Reverse-porting is possible if caught fast.

5. Premium-rate abuse

Closely related to dial-through but worth calling out: a compromised system that's used to call premium-rate numbers operated by the attacker. They register a 09 number with a revenue-share at £3/min, then use your PBX to call it for hours.

How to lock it down

Same controls as dial-through — block premium-rate destinations, cap concurrent outbound, set spend alerts. If you don't legitimately call 09 numbers, block the range entirely.

2026 minimum-defence checklist

Every UK SME phone system in 2026 should have:

• Strong unique passwords on every extension and admin login.
• International dialling disabled or whitelisted by country.
• Premium-rate destinations blocked.
• Concurrent outbound calls capped to a sensible business ceiling.
• Daily/weekly spend-anomaly alerts that fire to a phone, not just an email.
• Two-factor authentication on the admin portal.
• Documented procedure for unexpected payment-change requests (out-of-band verification).
• Documented procedure for unexpected port-out activity.
• Quarterly user-awareness refresher (10 minutes, not a 90-minute training course).

Most of these are configuration choices, not paid bolt-ons. Membership applies the technical ones by default — talk to our UK team if you want to walk through your current setup.

If it happens anyway

• Lock the system immediately. Disable outbound calling, change admin passwords, lock SIP registrations.
• Report fraud calls to Action Fraud(UK's national fraud reporting centre) — required for insurance claims.
• Notify your bank if money moved. Speed matters.
• Talk to your carrier. Some fraud charges can be challenged with the wholesale terminating operator — particularly on premium-rate dial-through patterns. With NumberGroup we'll help you build the case.