Our company's new phone service provider doesn't verify TLS certificates -- what does this mean?

Recently switched phone service providers to some dinky low-end company from New York cuz its cheaper. When configuring SIP user accounts in our softphones, they tell us to disable 'Verify TLS Certificate'. Also, they want us using TCP instead of UDP, which seemed odd to me. Shouldn't VOIP avoid TCP?

Mainly, I'm concerned about the security of our calls now, which contains customer payment info.

Is this normal practice for softphone configuration? Should I be concerned about call information being monitored by third parties?