After a security incident

Last updated 10 Nov 2026View as Markdown

What to do straight away if you think someone has got into your account or is making calls on it.

If you think someone has got into your portal account, a SIP device or a SIP trunk, act quickly. Calls made by an intruder are charged to your account. Work through these steps in order.

Do these now

1. Contact the support team

Contact the support team and tell them what you’ve noticed. For urgent help, call the number shown on Support › Support tickets. If toll fraud is suspected, the support team can block outbound calls on your account while you secure it, and help you recover.

If money has been taken or your card details may be exposed, also contact your bank or card provider.

2. Change your portal password

Change your customer portal password straight away: click your name in the top-right corner and choose Change password. Use a long, unique password that mixes letters, numbers and symbols. Don’t use birthdays, names or common words.

3. Make sure 2FA is on

Go to Billing › Account details and check that the 2FA column shows Enabled for every administrator in Account administrators. If it doesn’t, see Two-factor authentication.

4. Change your SIP passwords

Anyone with a SIP login and password can make calls charged to your account.

Go to the PBX tab and click Devices at the top.
Open each SIP device and click Generate a new password.
For each SIP trunk in SIP registration mode, open its settings on the canvas and click Generate a new password.
Click Apply configuration.
Enter the new passwords in your desk phones, softphones and other PBX.

It can take up to 5 minutes for a device to connect with its new password.

For Webphone users, open the User and click Reset password.

5. Stop international calls you don’t need

Ask the support team to block the international destinations you don’t call. Calls to high-risk destinations are already blocked by default.

Then check your account

6. Look for changes you didn’t make

Billing › Account details: check the primary account holder’s email and phone, and the Account administrators table. Look for administrators you don’t recognise and check Last activity.
PBX tab: check for devices, SIP trunks, call diversions or external numbers you didn’t add.

7. Review recent calls and charges

Billing › Account balance › Call charges history: look for calls to unusual destinations or at odd hours.
Reports › Call history: see who made each call.

Report anything unusual to the support team.

8. Scan your computers and phones

Run a full malware scan on every computer and phone you use to sign in to the portal or Webphone. Remove anything it finds.

9. Change reused passwords

If you used the same password on any other website or service, change it there too.

10. Keep watching

Intruders sometimes try to get back in. Keep an eye on your call charges and administrators for the next few weeks. Balance notifications can warn you about unexpected spending.

Prevent it happening again

Lock SIP devices and SIP trunks to your office IP address with Allow connection from one IP address only (under Advanced parameters in Devices and in the SIP trunk settings).
Turn on TLS encryption in General settings to protect SIP traffic. This changes the SIP credentials, so reconnect every device afterwards.
Never send passwords by email or keep them in plain text files or on paper.
Change your passwords regularly, at least once every quarter.
See Spend tools and International restrictions for more ways to limit fraud.