Call forwarding fraud is the unauthorised redirection of telephone calls from a legitimate number to another destination. Attackers usually change forwarding settings through a compromised carrier account, phone system, or voicemail control, so calls and verification codes can be intercepted without the owner noticing immediately.
What Call Forwarding Fraud Is and Why It Matters
Call forwarding fraud is a trust-boundary abuse: the attacker does not need to break the phone network itself, only to alter where calls are delivered. That makes it especially dangerous for organisations that still use voice calls for callbacks, one-time passcodes, urgent approvals or customer escalation paths, because the legitimate number may continue to look normal while traffic is silently diverted.
The main security issue is interception. Once forwarding is changed on a carrier account, PBX, voicemail or hosted telephony portal, the victim may miss calls, verification prompts and human verification checks. The abuse can be temporary and low-noise, which is why it often persists long enough for the attacker to capture codes or impersonate the real owner in time-sensitive workflows.
How Call Forwarding Fraud Happens
Most cases begin with account takeover of a telecom, VoIP or voicemail administration interface, or with social engineering against support staff who can reset forwarding settings. In some environments, the attacker only needs access to a legacy administrative path or a poorly protected customer service workflow. The fraud works because call routing is a control plane function, not just a user convenience feature.
Forwarding abuse is often paired with other identity compromise. If an attacker has already obtained a password, session token or help-desk reset path, changing call routing can help them intercept one-time passcodes, verify a false request, or keep the real owner from noticing suspicious activity in time. A related class of protective controls is documented in NHIMG’s Deepfake CEO Fraud Response Playbook, which shows how callback verification and escalation discipline reduce voice-based fraud success.
Operational Impact on Verification and Business Process
Call forwarding fraud is disruptive because it weakens any workflow that assumes a phone call reaches the right person. That includes password resets, customer support callbacks, treasury checks, executive approvals, and high-friction exception handling. If an organisation relies on voice as a trust signal, the attacker can turn that signal into a delivery channel for fraud.
The business impact is often broader than the call itself. Intercepted verification calls can enable follow-on account takeover, payment diversion, or unauthorised changes to account settings. In a mature control environment, voice should be treated as one factor among several, not as proof that a person or request is genuine. Practical finance-team controls for callback and approval discipline are covered in NHIMG’s Business Email Compromise Awareness for Finance Teams Guide.
Detection, Review and Hardening
Because forwarding changes can be subtle, detection usually depends on reviewing telephony configuration changes, account notifications, unusual admin logins and unexpected changes to voicemail or call routing rules. A good inventory of business-critical numbers, admin consoles and support-reset paths is essential, especially where the same number is used for security callbacks and customer-facing operations.
Hardening should focus on reducing the chance that one account compromise changes call delivery without challenge. That means tightening admin access, requiring step-up checks for forwarding changes, limiting who can modify routing, and removing voice-only verification from high-risk processes where possible. Guidance on choosing and validating deepfake and voice-fraud detection tooling is available in NHIMG’s Deepfake Detection Buyer’s Guide, which is useful where attackers combine forwarding abuse with synthetic voice social engineering.
Risk and Threat Considerations
Call forwarding fraud is risky because it turns a legitimate communications channel into an interception point. The main threat is not just missed calls, but silent access to codes, callbacks and human trust paths that other controls assume are private.
Failure mechanism: An attacker who compromises telecom, voicemail or support access changes forwarding rules and receives calls that should have reached the owner, enabling interception of verification steps or impersonation.
Impact: The result can be account takeover, payment fraud, missed incident notifications, or prolonged compromise because the legitimate owner keeps using the right number while calls are diverted elsewhere.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Call forwarding abuse often follows compromised admin accounts and weak reset paths. |
| Recommendation — Restrict and review telecom admin access for forwarding changes. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Fraud often leverages intercepted codes and weak lifecycle control of authenticators and resets. |
| AC-6 — Least Privilege | Forwarding changes should only be possible for narrowly authorised operators. | |
| Recommendation — Protect and rotate authentication secrets used in callback and reset workflows. Limit who can modify call routing and forwarding settings. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity and Access Management | The term hinges on abuse of access paths that alter trusted communications routing. |
| Recommendation — Apply strong access controls to telephony and voicemail administration paths. | ||
| MITRE ATT&CK | T1098 — Account Manipulation | Changing forwarding settings is a classic account-setting modification used to persist or divert communications. |
| Recommendation — Hunt for account-setting changes that redirect calls or messages. | ||
Practitioner Guidance
Why practitioners should care: Treat call forwarding as a security-sensitive setting, not an admin convenience. Any workflow that uses voice as a trust check should be reviewed for the possibility that the call path itself has been redirected.
What to watch for: Unexpected forwarding changes, voicemail resets, new admin sessions, and repeated callback failures are all signals that the control plane may already be under abuse. Where voice is used for high-risk approvals, prefer a second, independent channel for verification and escalation.
Practitioner takeaway: If a phone call can move money, reset access or confirm identity, then forwarding changes deserve the same scrutiny as other privilege-changing events.
Related resources from NHI Mgmt Group
- Why do traditional call center checks fail against modern fraud?
- Why do SIM swaps and call forwarding increase account takeover risk?
- How should fraud teams use active call signals during high-risk mobile actions?
- How can security teams balance frictionless authentication with fraud prevention across web, mobile, and call center channels?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 5, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org