Skip to content
GoldAgent

Industry

Finance & Professional Services

Finance and professional-services firms face regulatory scrutiny, take payments and instructions by phone, and hold client trust that a telephony incident can damage quickly.

Request an Assessment

Why it matters here

The telephony risk in this sector

Where card details or financial instructions are handled by phone, the telephony layer is in scope for PCI DSS and for the security expectations of clients, insurers and regulators. These firms are also attractive fraud targets, and a single publicised telephony incident can carry reputational cost well beyond the direct loss.

  • PCI DSS scope

    Taking card details by phone brings the PBX, call recording and SIP trunks into PCI scope.

  • Regulatory and insurer expectations

    Independent security assessment is increasingly expected evidence at renewal and audit.

  • High-value fraud target

    Attackers pursue firms that move money and hold sensitive instructions.

  • Reputation risk

    A telephony breach at a trusted firm carries cost beyond the immediate fraud.

Context

What makes finance & professional services different

Financial-services and professional-services firms use the telephone as a business-critical instrument, not just as a way to reach staff. Wealth managers take investment instructions by phone. Insurance brokers issue cover on recorded lines. Payment services firms take card details verbally. Law firms discuss transaction detail with clients on the same lines their receptionist answers. All of that traffic sits on the telephony layer, and all of it inherits whatever security posture the PBX and SIP trunks have.

These firms are attractive fraud targets for a distinct reason: attackers can monetise access to their telephony in more than one way. Toll fraud is the crude route. The more damaging routes are impersonation of the firm to its clients, interception of instructions between the firm and its counterparties, and — in high-value transactions — subtle diversion of payment instructions communicated by phone.

Regulator expectations have moved in the same direction. The FCA's operational-resilience regime (PS21/3, SYSC 15A) requires firms to identify important business services, set impairment tolerances, and evidence that they can stay within those tolerances. For a firm whose telephony carries client instructions, an outage or a compromise of the phone system is very likely to be a material impairment — and the firm's board is expected to have thought about it in advance, not discovered it during an incident.

Attack scenarios

How this typically goes wrong

Sector-specific scenarios GoldAgent has scoped assessments against. Defensive framing only — nothing here is a how-to.

  • ANI spoofing that reaches the firm's own clients

    An attacker who can spoof the firm's public numbers can call clients from an ANI they recognise, using details harvested from the firm's website and public filings to sound convincing. The result is a highly credible authorised-push-payment vishing attempt, and the reputational fallout for the firm is often larger than any direct fraud loss.

  • Toll fraud plus reputation damage in one incident

    Compromised SIP trunks used to route large volumes of premium-rate or international calls in a weekend produce not just the direct bill but a run of complaints and abuse reports attributed to the firm's own numbers. For a firm that trades on client trust, having its lines blocked by carriers as a fraud source is a material event, not just a cost.

  • Eavesdrop on client-instruction calls

    In firms where instructions are given by phone, an attacker who can bridge into a call, or replay a recorded segment, can insert or alter a payment detail with catastrophic consequence. Even where the direct loss is recoverable, the discovery that client-instruction calls were not confidential is the sort of finding that ends banking relationships and triggers regulatory notification.

Compliance driver

PCI DSS, FCA operational resilience and Consumer Duty

Where the firm takes cards by phone, PCI DSS scope applies to the whole telephony chain — PBX, trunks, recorder, IVR — exactly as it does in a contact centre. Alongside that, the FCA's operational-resilience regime requires the firm to identify important business services and demonstrate it can keep them within impairment tolerances; where telephony is the channel by which those services are delivered, its security and availability are directly in scope. The FCA Consumer Duty then layers a further expectation: that a customer taking action on the basis of a phone call is treated fairly and protected from foreseeable harm — which includes harm from impersonation attacks originating from the firm's own numbers. GoldAgent's assessments produce evidence in the shape a compliance function, a broker, an insurer and — if it ever comes to it — a regulator will recognise: authorised, dated, attributable, and technically specific.

Discuss a scoped assessment

Related services

Explore related assessments

Find out exactly how exposed your phone system is

Request an authorised PBX, VoIP or SIP security assessment. We confirm scope and authorisation first, then show you what is exposed and what to fix.

Request an Assessment

Testing is only performed against systems you own or are explicitly authorised to test.