When Voicemail Starts Answering for the Hackers
Collect-Call Hijacks, Weekend Windows, and the PIN Checklist
Article 22 closed on a hard question: What’s your voicemail PIN? This page answers what happens when the answer is still the factory default—and what to do before the bill arrives.
How the collect-call version works
The notes pick up mid-scheme: compromised mailboxes route value to the hackers’ accounts. In one pattern, attackers hijack voicemail accounts and change outgoing messages so the system will accept automated international collect calls. Those calls land on the mailbox owner’s phone bill.
In another version, a hacker simply breaks into a voicemail system—same door, different room once inside: listen, reset, intercept codes, or rewrite the greeting so the box becomes a billing engine.
The genius of the collect-call twist is invisibility. Nothing “looks wrong” on the handset until the carrier flags unusual activity (common for business victims) or a residential bill spikes (common for households). The crime runs in the background while the greeting still sounds almost like you.
You should know
From the handwritten “You should know” block:
- Timing: Hackers may try to break into voicemail systems during holiday periods or weekends, when changes to outgoing messages are less likely to be noticed.
- Geography: Attackers are often based internationally, with calls originating in and routing through many countries.
- Discovery lag: Business victims may learn only when the phone company reports unusual activity; residential victims may learn only from an unusually high bill.
That lag is the strategic point. Spoofing and smishing demand an answer now. Voicemail hijack can wait until you are not looking—then monetize silence.
To minimize risk (from the notes)
These are the principal’s own rules, lightly polished for reuse:
- Always change default passwords—at work and on the mobile phone.
- Choose a complex voicemail password of at least six digits.
- Change the voicemail password frequently.
- Don’t use obvious passwords: address fragments, birth dates, phone numbers, 00000, or successive numbers (12345 and kin).
Pair with article 22’s warnings: default PINs invite interception of two-factor codes; compromised business boxes have been used to text callers payment links. Hardening the PIN is not a complete security program—but refusing the default closes the cheapest door.
How this fits the series
| Article | Focus |
|---|---|
| 20 | Cellular fraud, SIM / subscriber attacks |
| 21 | Porting the number away |
| 22 | Spoofing, smishing, SSA poses; voicemail as overlooked inbox |
| 23 (this) | Voicemail as billing weapon + when and how to lock it |
Steal the number or steal the mailbox. Either path can empty the OTP kingdom—or, here, fill the bill with international collect traffic you never authorized.
Closing
A hijacked greeting is a forgery of your voice at the gate. International collect calls are the meter running in someone else’s favor. Weekends and holidays are when nobody checks the gate.
Change the PIN before the long weekend. Make it long enough to be boring. Check the outgoing message after every break. If the bill looks like a travelogue of countries you did not call, treat it as a security incident—not a mystery fee.
Draft for principal / counsel review. Source: handwritten continuation on voicemail hijack / collect calls / risk minimization. Not legal advice.