Is Fax Still Secure? The Complete Answer (2026)

By Alexey Spasskiy · Published May 3, 2026 · Updated June 8, 2026 · 11 min read

Fax has carried a reputation for security since the 1980s. The logic seemed airtight: a document traveled over a dedicated phone line, vanished the moment the call ended, and arrived on paper — no email server, no cloud storage, no hackable inbox.

That reputation is partly deserved and partly a myth. Is fax still secure in 2026? The answer depends entirely on whether you are using a traditional fax machine or a modern online fax service — and whether the right safeguards are in place.

This guide delivers the complete, honest picture: what made fax secure historically, where it fails today, how cloud fax changes the equation, and exactly what you need to do to keep sensitive documents protected.

Why Fax Built Its Secure Reputation

To understand fax security today, you need to understand why fax was considered secure in the first place.

When a traditional fax machine sends a document, it converts the page into an analog audio signal—a series of tones representing light and dark pixels. That signal travels over the Public Switched Telephone Network (PSTN), a dedicated, circuit-switched infrastructure entirely separate from the internet.

Three properties made this genuinely safer than early email:

1. Dedicated circuit: Unlike email, which bounces through multiple relay servers, a fax call creates a temporary, direct connection between two machines. No intermediate copies. No relay logs.
2. Transient data: Once the call ended, the signal ceased to exist on the network. There were no server-side backup copies, no persistent digital records—just two physical pages at each endpoint.
3. Hard to intercept: Intercepting an analog phone line required physical access to the wiring with specialized equipment. In practice, this was far more difficult than compromising an email relay server.

These properties gave fax a genuine security advantage over the era's email, which traveled mostly in plaintext. Healthcare, legal, and finance built critical workflows around fax for exactly these reasons—and many still rely on it today.

The problem: the world has changed. Fax machines are now connected to corporate networks. Most transmissions travel over VoIP infrastructure rather than dedicated PSTN lines. And attack vectors have emerged that the original security logic never contemplated.

The Real Vulnerabilities of Traditional Fax Machines

No Encryption in Transit

Traditional fax machines do not encrypt data. The signal travels as raw analog audio—or, when routed over VoIP as T.38 packets—without cryptographic protection of any kind. Anyone who can access the transmission path can intercept and reconstruct the document.

On legacy PSTN lines, this required physical line access, which kept the risk low in practice. On modern VoIP infrastructure, fax packets travel over internet-connected networks where the interception risk profile is fundamentally different. The old security argument no longer holds.

Physical Document Exposure

The most common and most overlooked fax security failure is entirely physical: a sensitive document sitting unattended in an output tray.

In hospitals, law offices, and financial firms, fax machines often sit in shared reception areas or common printer stations. A document containing patient records, contract terms, or financial data can be read by anyone who walks past—sometimes for hours before the intended recipient collects it.

This is not a theoretical concern. The American Dental Association's HIPAA guidelines explicitly identify unsecured fax machines in open areas as one of the most frequent physical safeguard violations in healthcare settings. You can have perfect transmission security and still have a breach the moment paper hits the tray.

Faxploit: The Network Backdoor

In 2018, Check Point Research demonstrated a critical vulnerability named Faxploit that shattered a core assumption of fax security: that phone lines were a safe, isolated channel.

The attack required exactly one thing—the target's fax number.

Here is how it worked:

1. The attacker embeds exploit code inside a specially crafted image file
2. They dial the target organization's fax number and transmit the malicious image
3. The fax machine's firmware decodes the image and loads it into memory
4. The exploit executes, gaining control of the machine
5. From the machine—which sits on the corporate network—the attacker moves laterally, deploying ransomware or exfiltrating data

Why this is significant: corporate networks that were completely air-gapped from the internet remained vulnerable because fax bypassed every perimeter defense. Check Point demonstrated the attack on HP OfficeJet Pro all-in-one printers at DEF CON 26 and noted the same vulnerable protocols are used across most other printer-fax devices.

Organizations that patch firmware promptly mitigate this specific risk. Organizations running outdated firmware on network-connected fax devices remain exposed.

VoIP and T.38: The Hidden Transmission Risk

Most fax calls today do not travel exclusively over PSTN. They route at least partially over VoIP infrastructure using the T.38 protocol, which converts analog fax signals into IP packets that travel over the internet.

T.38 can be encrypted, but most implementations default to unencrypted UDP transmission for compatibility and speed. The result: fax packets traveling over internet-connected infrastructure without encryption—the same exposure profile as any other unencrypted IP traffic.

The traditional argument that "fax is secure because it uses phone lines" does not apply to the majority of modern fax transmissions. For a deeper look at how this protocol affects security, see our T.38 fax protocol guide.

Limited Audit Trail

Traditional fax machines produce a confirmation page: a printout showing the recipient number, the date, and whether the call connected. That is the entirety of the audit trail.

What they do not provide:

• Proof that the intended recipient—not someone at a wrong number—received the document
• Tamper-proof timestamps
• Records of who accessed the received document after delivery
• Evidence of what happened to the document at the destination

For healthcare, legal, and financial industries where document chain of custody has compliance and legal consequences, this is a significant gap.

Online Fax vs. Traditional Fax: The Security Architecture Difference

Modern cloud fax services address every vulnerability above. The comparison is stark:

The shift from traditional to cloud fax is not a convenience upgrade—it is a fundamental change in security architecture.

When you send a fax via mFax.to, the document travels inside a TLS 1.3 encrypted tunnel from your device to the recipient's endpoint. No intermediate server stores a persistent copy. Every transmission generates a cryptographic delivery receipt: a tamper-proof record confirming exactly when the document was accepted by the receiving machine.

For a deeper comparison of traditional vs. cloud infrastructure, see our guide to cloud-based fax.

Is Fax More Secure Than Email?

For sensitive documents, modern cloud fax beats standard email on almost every security dimension. Here is the exact mechanism.

How Standard Email Handles Your Document

1. You compose the message and click send
2. Your email client passes it to your mail server via SMTP
3. Your server passes it to an intermediate relay
4. The relay hands it to the recipient's mail server
5. The message sits on that server indefinitely—in their inbox, your sent folder, and multiple server backups

At steps 3 and 4, the message may or may not be encrypted. Standard SMTP does not mandate encryption. Messages persist in sent folders, inbox archives, and server backups for months or years. A single compromised account exposes its entire history.

How Cloud Fax Handles Your Document

1. You upload the document to the fax service
2. It transmits via TLS 1.3 directly to the recipient's fax number
3. The delivery is confirmed with a cryptographic receipt
4. No relay server stores a persistent copy of the content

The practical comparison is unencrypted email (the reality for most users) vs. encrypted cloud fax (the baseline for any reputable service). In that matchup, fax wins clearly. Even against encrypted email, cloud fax adds the compliance infrastructure—BAAs, audit logs, access controls—that regulated industries require.

Is Fax Still Secure for HIPAA Compliance?

Healthcare is the industry most dependent on fax—and the one where security failures carry the steepest consequences. The HIPAA compliance question comes up constantly.

The official HIPAA position: HIPAA does not explicitly prohibit faxing, nor does it mandate any specific technology. What it requires is that Protected Health Information (PHI) be handled with appropriate administrative, physical, and technical safeguards—regardless of how it is transmitted.

Whether fax is HIPAA-compliant depends entirely on implementation.

Traditional Fax and HIPAA

A traditional fax machine can technically comply with HIPAA, but the bar is high:

• The machine must be in a physically restricted area accessible only to authorized staff
• Access to received documents must be controlled and logged
• Transmission records must be maintained for 6 years
• Documents must be retrieved promptly—not left in the output tray
• A cover sheet with a confidentiality notice is required for PHI

In practice, most traditional fax setups fall short. Shared machines in open office areas, minimal logging, and no access controls are the norm.

Online Fax and HIPAA

A properly configured cloud fax service provides the easier path to HIPAA compliance:

• BAA: The provider can sign a Business Associate Agreement, formally accepting liability as a HIPAA-covered business associate
• Technical safeguards: TLS in transit, AES-256 at rest—both required by the HIPAA Security Rule
• Audit logs: Tamper-proof records of every transmission, accessible for compliance review
• Access controls: MFA, role-based access, unique user IDs, and session logging

mFax Business includes HIPAA-ready infrastructure, BAA support, and full audit logging out of the box.

For the complete HIPAA faxing checklist, see our detailed guides on is faxing HIPAA compliant and HIPAA fax requirements.

Fax Security by Industry

The security requirements vary by industry, but the pattern is consistent: fax can be compliant, but only with deliberate implementation.

Is Fax Secure Enough for Personal Use?

Outside of regulated industries, the calculation is simpler.

If you need to send a document once—a tax form, a medical records request, a rental application, a legal filing—online fax is the right tool. The document is encrypted, the delivery is confirmed, and you do not need a machine.

At effectively zero hardware cost and a few dollars per send (or a low monthly subscription), the security upgrade over traditional fax costs almost nothing. For most personal faxing tasks, the mFax app handles it in under two minutes from any phone.

Try mFax.to — over 5 million users send sensitive documents this way.

How to Make Any Fax Secure: Best Practices

Whether you are using traditional or cloud fax, these practices significantly reduce risk:

• ✓Switch to a cloud fax service with TLS 1.3 encryption. This is the single highest-impact change. It eliminates the unencrypted-transmission vulnerability and adds audit trails and access controls in one step.
• ✓Verify recipient fax numbers before sending. Misdirected fax is the most common real-world fax breach. Confirm the number from an authoritative, independent source—not from memory or an old email.
• ✓Always use a cover sheet with a confidentiality notice. Include a notice that the contents are privileged and intended only for the named recipient. Never put PHI, SSNs, or sensitive data on the cover sheet itself—it sits on top and is visible to anyone.
• ✓Enable multi-factor authentication on your fax account. MFA prevents unauthorized access even when credentials are compromised. It is a requirement for HIPAA-compliant implementations.
• ✓Restrict physical access to fax machines. If you use traditional equipment, place it in an access-controlled area. A machine at an open reception desk does not meet HIPAA physical safeguard standards—or basic information security standards.
• ✓Patch fax machine and printer firmware immediately. The Faxploit vulnerability and similar protocol-level flaws are mitigated through firmware updates. Check your manufacturer's support page and enable automatic updates.
• ✓Sign a BAA with your online fax provider. Required for HIPAA compliance. Any provider that refuses to sign a BAA cannot legally be used for PHI transmission. See our guide to Business Associate Agreements for fax services.
• ✓Maintain and archive transmission logs. Keep records of what was sent, to whom, and when. Cloud fax services generate these automatically with tamper-proof timestamps. Traditional fax provides only confirmation pages—maintain a manual log.
• ✓Apply role-based access controls. Not every employee needs access to the organization's fax history. Limit access based on role, and audit access logs periodically.
• ✓Review your fax security configuration annually. The threat landscape evolves. Firmware, protocols, and compliance requirements change. A yearly review catches gaps before they become incidents.

Common Fax Security Myths, Debunked

"Fax is unhackable because it uses phone lines." Faxploit demonstrated in 2018 that fax machines connected to corporate networks can be compromised using only a fax number. Networks completely isolated from the internet remained vulnerable because fax bypassed every perimeter defense.

"Fax is automatically HIPAA compliant." HIPAA requires specific administrative, physical, and technical safeguards regardless of transmission method. Traditional fax machines in open office areas routinely fail the physical safeguard requirement.

"Email is more secure than fax." Standard unencrypted email passes through multiple relay servers without mandatory encryption and stores copies for months or years. Modern cloud fax with TLS 1.3 is more secure for sensitive documents. This comparison favors fax—the opposite of the common assumption.

"Online fax is less secure than traditional fax because it uses the internet." Traditional fax over VoIP/T.38 also uses the internet—just without encryption. The difference is that reputable cloud fax services encrypt the data. A traditional fax machine sending unencrypted T.38 packets over VoIP is more exposed than a cloud fax service using TLS 1.3.

"If you dial the right number, the fax is secure." Misdirected fax—dialing one digit wrong—is one of the most frequent real-world fax security incidents. No amount of encryption protects a document sent to the wrong recipient. Always verify numbers independently.

The Complete Answer: Is Fax Still Secure?

The answer is genuinely nuanced, and both "yes" and "no" are incomplete on their own.

Traditional fax machines: partially secure by historical accident (hard to intercept on dedicated PSTN lines), but with significant vulnerabilities in 2026. No encryption in transit. Physical document exposure. Faxploit attack surface on network-connected devices. Limited audit trails. Not the right choice for sensitive documents without substantial additional safeguards.

Online cloud fax with TLS encryption: more secure than traditional fax and more secure than standard email. Encryption in transit and at rest. Tamper-proof audit logs. No physical document exposure. HIPAA-ready infrastructure with BAA support available. The correct choice for any sensitive document transmission today.

The key insight: fax security is not about the technology being old or new—it is about whether encryption, access controls, and audit trails are in place. The same contract sent over an unpatched HP OfficeJet and sent via a cloud fax service with TLS 1.3 have radically different security profiles.

For a deeper look at how online fax security specifically works—including how to evaluate a provider's encryption standards—see our complete guide to is online fax secure.

Send Your Fax Securely Today

For personal documents—tax forms, medical records, legal filings—mFax.to lets you send encrypted faxes from your phone in under two minutes. No machine. No trip to the store.

For businesses and healthcare providers operating under compliance requirements, mFax Business delivers TLS 1.3 encryption, AES-256 storage, HIPAA-ready infrastructure, BAA support, and a full tamper-proof audit trail—starting at about $9/mo (billed annually). Unlike rigid fixed-tier providers, you build your own plan, dialing in the exact seats and pages you need and paying only for what you use. Over 5 million users trust mFax.to for sensitive document transmission.