If telephone calls or data are transmitted in an unencrypted form via a PBX system, there is a general risk of attackers eavesdropping on or reading the information. For example, they could tap directly into the telephone cables or eavesdrop on a PBX system when it connects callers.

In many PBX systems, callers can leave a message for a recipient who is not available for a call. Some answering machines, especially those in VoIP systems, send this information in the form of an audio file attached to an e-mail. The contents of such e-mails could be directly intercepted and heard by an attacker.

In addition, it is possible for third parties to listen in on calls by activating disabled features, some of which are not allowed in Germany. Silent monitoring is one example of this. Activation of such features does require more detailed knowledge of the target system, but this is not a serious obstacle due to the large amount of information freely available on the Internet.