Inside the New Ofcom Regulations Targeting Cyber Fraud

UK mobile network operators face new requirements to block fraudulent text messages and scam calls under rules finalised by Ofcom.

The measures target gaps in consumer protection and establish security standards across the mobile sector.

Person-to-person messaging threats

Mobile operators must now gather information on scam messages, weblinks and phone numbers from customers and anti-fraud organisations.

They must also detect malicious weblinks and phone numbers, then use this intelligence to block scam messages traversing their networks.

Business messaging security controls

Ofcom has mandated that mobile operators and aggregators perform upfront and continuous Know Your Customer checks on new business messenger senders.

The checks aim to prevent criminals from sending fraudulent texts to consumers.

Providers must carry out Know Your Traffic monitoring of account volumes to flag unusual activity.

They must stop the use of fake sender names, known as Alphanumeric Sender IDs, by verifying sender IDs against business information they hold.

When scam activity surfaces, providers must trigger incident management processes to block message senders. They must also address compliance failures by other providers.

Operators must respond to scam reports from users and third parties. They must identify and block malicious sender IDs, weblinks and phone numbers.

International number spoofing controls

Ofcom has issued updated guidance to prevent international calling networks from spoofing UK mobile numbers.

Foreign criminal networks often disguise their origins by displaying familiar UK mobile numbers, making recipients more likely to answer.

Under the guidance, telecom companies should withhold caller identity of calls appearing to originate from a UK number roaming abroad. The exception applies unless they can verify validity.

The measure could reduce the attack surface for voice phishing campaigns targeting UK mobile users. Caller ID verification systems would need to authenticate the origin of international calls before passing through network boundaries.

Industry compliance requirements

"Mobile messaging scams can have devastating consequences for victims, with criminal gangs using ever more sophisticated techniques to dupe their victims", says Amy Jordan, Strategy Delivery Director at Ofcom.

"Our new protections for consumers and businesses announced today will help ensure we remain one step ahead by disrupting and blocking this criminal activity at source."

Ofcom notes that while it recognises parts of the mobile industry already have anti-mobile scam measures in place, as a whole intercepting more than 600 million scam messages a year, it decided to create a consistent standard across all providers.

According to Ofcom, inconsistent application creates gaps which can be exploited.

Ofcom expects the combination of these protections, the Government's ban on SIM farms and operator commitments under the Fraud Sector Charter will lead to a reduction in scam messages. 

Fraud threat landscape

The regulatory response comes as fraud has grown to account for an estimated 45% of all reported crime incidents in England and Wales. Victims lost £1.28bn (US$1.72bn) to fraudsters in 2025 alone.

According to Ofcom, four in 10 UK mobile users reported receiving at least one suspicious message on their handset over a three-month period this year.

"As the National Lead Force for Fraud, we welcome the introduction of new protective measures to help keep mobile phone users safe from fraud via spoofing calls and fraudulent messages", says Chief Superintendent Amanda Wolf, Head of Report Fraud Operations, City of London Police.

"By requiring mobile network providers to adopt a new, robust approach to identify and disrupt fraudulent text messages, this will help protect the public from criminals who are exploiting UK mobile numbers."