The security model - TLS/SRTP encryption, credential handling, MFA, toll-fraud controls, and what to do in the first hour after a suspected compromise.

How do I prevent toll fraud on a phone system?

The security model - TLS/SRTP encryption, credential handling, MFA, toll-fraud controls, and what to do in the first hour after a suspected compromise.

Support Center / Technical Reference

Security on Signal — Encryption, Access, and Fraud Controls

Signal's security model has three layers: encrypted transport (TLS signaling, SRTP media), credential hygiene (generated per-extension secrets, one-click reset, MFA on the portal), and blast-radius controls (per-extension dialing permissions that cap what stolen credentials are worth). Most real-world phone fraud is defeated by the third layer.

Encryption

Signaling: TLS 1.2+ by default for provisioned devices.
Media: SRTP negotiated with capable endpoints.
Provisioning: HTTPS; configuration (including SIP secrets) never traverses plaintext.

Access control

Portal: per-user logins with role-based permissions; enforce MFA account-wide from account settings. Administrators who can read SIP credentials should be a short list.
SIP: per-extension generated passwords; no shared trunks between users. Reset disconnects all registered devices instantly.

Toll-fraud economics, and beating them

Stolen VoIP credentials are monetized within minutes by pumping traffic to premium international numbers — usually overnight or on weekends. Controls, in order of value:

International dialing off by default, enabled per-extension on need — a credential that can't dial internationally is nearly worthless.
Distinct credentials per device/appliance; reset on any personnel or vendor change.
Review after-hours outbound in call reports; alerting on unusual patterns catches what prevention misses.

Suspected compromise — first hour

Reset the affected extension's SIP password (kills active registrations).
Disable international dialing account-wide temporarily.
Pull call detail records for the extension; note destinations and times.
Rotate portal passwords for admin users; verify MFA is enforced.
Open a support case with the CDR extract.

Compliance note: for healthcare deployments, pair these controls with your HIPAA program — voicemail-to-email destinations, recording retention, and BAA coverage are the usual gaps.

Last reviewed August 6, 2026. Still stuck? Contact Signal Support from your portal — include what you expected, what happened instead, and one example phone number or extension.