One of the methods used by scammers is to impersonate someone from your own domain name, e.g. you get an email from firstname.lastname@example.org telling you open email attachments or click links. One of the best ways to stop this is using DKIM, DMARC and SPF.
The 3CX Voicemail is handy, and if you wait long enough the system will prompt you with option, but if you are impatient (like me!) then this guide might help!