UK mobile operators have been handed a much longer list of anti-fraud responsibilities, after Ofcom finalised a package of rules on 15 July 2026 designed to stop scam texts and spoofed calls before they ever reach your phone.
Ofcom’s argument is straightforward: fraud is the UK’s most commonly experienced crime, and the mobile network is the delivery mechanism. It accounts for roughly 45% of all reported crime incidents in England and Wales, with £1.28 billion lost to criminals in 2025 alone.
Four in ten UK mobile users say they’ve had at least one suspicious message in the past three months. Operators already block an estimated 600 million-plus scam messages a year, but that still isn’t enough.
What Mobile Providers Have To Do Now
The rules split scam messaging into two categories, because criminals use two different routes in.
The first is person-to-person scams. Under new General Conditions, mobile providers must gather intelligence on scam messages, malicious links and suspect numbers from their own customers and from anti-fraud organisations, then act on it by blocking numbers known to be used by scammers, and stopping scam messages while they’re still travelling across the network by detecting malicious weblinks and phone numbers in transit.
The second is business messaging – those fake delivery notifications and bank alerts. Operators need to carry out proper customer checks before onboarding a business sender as well as ongoing checks to monitor account activity and actually investigate fraud reports, not just log them.
Going forward, they will also need to verify Alphanumeric Sender IDs, the brand names that appear at the top of a legitimate business text, against what they know about that customer. Providers must maintain policies covering protected brand IDs and generic ones like “Customer Service”, apply incident management processes when scam activity is found and hold companies to account where the right checks weren’t carried out.
Spoofed Calls From Abroad
Ofcom has also strengthened its guidance on international calls that imitate UK mobile numbers. Criminals based overseas spoof UK numbers for an obvious reason – people are far more likely to answer a call that looks local than one from an unfamiliar international code.
Telecoms companies are now expected to withhold the caller ID on calls that appear to come from a UK mobile roaming abroad, unless they can verify the number is genuine.
When Will These Take Effect?
Operators have some time to prepare for these implementations. The person-to-person rules take effect on 18 January 2027, with the business messaging rules following on 15 July 2027.
These Changes Are Part Of A Much Wider Squeeze
None of this is happening in isolation. Ofcom’s ban on leasing Global Titles took effect for existing leases in April 2026, closing a signalling route used to spoof UK mobile numbers from abroad. The Crime and Policing Act 2026 has made possessing or supplying SIM farms an offence, targeting the hardware behind industrial-scale smishing.
Just days before the messaging rules arrived, Ofcom also published a draft fraudulent advertising code under the Online Safety Act, setting out close to 40 measures the biggest platforms should adopt against paid-for scam ads.
Proposals include banning accounts that post fraudulent adverts, verifying that new advertisers work for the businesses they claim to, and rigorously testing AI ad-generation tools to reduce misuse.
Oliver Griffiths, Ofcom’s Online Safety Group Director, warned that platforms “should not drag their heels.” That consultation closes on 2 October, and once approved by Parliament, non-compliance carries fines of up to £18 million or 10% of global revenue.
