# After a security incident

> What to do straight away if you think someone has got into your account or is making calls on it.

- URL: https://kb.voipcloud.online/security/after-a-security-incident/
- Section: Security and compliance
- Type: guide
- Applies to: All countries
- Last reviewed: 2026-11-09

If you think someone has got into your portal account, a SIP device or a SIP trunk, act quickly. Calls made by an intruder are charged to your account. Work through these steps in order.

## Do these now

### 1. Contact the support team

[Contact the support team](https://kb.voipcloud.online/support/support-tickets/) and tell them what you've noticed. For urgent help, call the number shown on **Support** › **Support tickets**. If toll fraud is suspected, the support team can block outbound calls on your account while you secure it, and help you recover.

If money has been taken or your card details may be exposed, also contact your bank or card provider.

### 2. Change your portal password

Change your customer portal password straight away: click your name in the top-right corner and choose **Change password**. Use a long, unique password that mixes letters, numbers and symbols. Don't use birthdays, names or common words.

### 3. Make sure 2FA is on

Go to **Billing** › **Account details** and check that the **2FA** column shows **Enabled** for every administrator in **Account administrators**. If it doesn't, see [Two-factor authentication](https://kb.voipcloud.online/security/two-factor-authentication/).

### 4. Change your SIP passwords

Anyone with a SIP login and password can make calls charged to your account.

1. Go to the **PBX** tab and click **Devices** at the top.
2. Open each SIP device and click **Generate a new password**.
3. For each SIP trunk in **SIP registration** mode, open its settings on the canvas and click **Generate a new password**.
4. Click **Apply configuration**.
5. Enter the new passwords in your desk phones, softphones and other PBX.

It can take up to 5 minutes for a device to connect with its new password.

For Webphone users, open the [User](https://kb.voipcloud.online/pbx/accept-make-divert/user/) and click **Reset password**.

### 5. Stop international calls you don't need

Ask the support team to block the international destinations you don't call. Calls to [high-risk destinations](https://kb.voipcloud.online/security/international-restrictions/) are already blocked by default.

## Then check your account

### 6. Look for changes you didn't make

- **Billing** › **Account details**: check the primary account holder's email and phone, and the **Account administrators** table. Look for administrators you don't recognise and check **Last activity**.
- **PBX** tab: check for devices, SIP trunks, call diversions or external numbers you didn't add.

### 7. Review recent calls and charges

- **Billing** › **Account balance** › **Call charges history**: look for calls to unusual destinations or at odd hours.
- **Reports** › **Call history**: see who made each call.

Report anything unusual to the support team.

### 8. Scan your computers and phones

Run a full malware scan on every computer and phone you use to sign in to the portal or Webphone. Remove anything it finds.

### 9. Change reused passwords

If you used the same password on any other website or service, change it there too.

### 10. Keep watching

Intruders sometimes try to get back in. Keep an eye on your call charges and administrators for the next few weeks. [Balance notifications](https://kb.voipcloud.online/billing/low-balance-notifications/) can warn you about unexpected spending.

## Prevent it happening again

- Lock SIP devices and SIP trunks to your office IP address with **Allow connection from one IP address only** (under **Advanced parameters** in [Devices](https://kb.voipcloud.online/pbx/settings/devices/) and in the [SIP trunk](https://kb.voipcloud.online/pbx/accept-make-divert/sip-trunk/) settings).
- Turn on **TLS encryption** in [General settings](https://kb.voipcloud.online/pbx/settings/general-settings/) to protect SIP traffic. This changes the SIP credentials, so reconnect every device afterwards.
- Never send passwords by email or keep them in plain text files or on paper.
- Change your passwords regularly, at least once every quarter.
- See [Spend tools](https://kb.voipcloud.online/security/spend-tools/) and [International restrictions](https://kb.voipcloud.online/security/international-restrictions/) for more ways to limit fraud.

## Related

- [Two-factor authentication](https://kb.voipcloud.online/security/two-factor-authentication/)
- [Devices](https://kb.voipcloud.online/pbx/settings/devices/)
- [Scam guidance](https://kb.voipcloud.online/security/scam-guidance/)