Ofcom Scam Text Rules: Networks Must Block Fraud Messages

What Ofcom has announced

Ofcom has finalised a package of rules and strengthened guidance designed to block, limit and disrupt the international criminal operations behind scam texts and calls targeting people and businesses in the UK. The regulator's justification rests on the scale of the problem: fraud now accounts for an estimated 45 percent of all reported crime incidents in England and Wales, and £1.28 billion was lost to criminals in 2025. Ofcom's own research found that 40 percent of UK mobile users reported receiving at least one suspicious message within a three month period, which translates to tens of millions of scam attempts reaching handsets. While parts of the mobile industry already operate anti spam measures voluntarily, protection has been uneven, and the regulator concluded that inconsistency between networks creates gaps that organised fraud operations actively seek out and exploit. The new measures therefore establish a consistent minimum standard that every mobile provider must meet, rather than leaving the depth of protection to each operator's commercial discretion. Ofcom expects the package to significantly reduce the likelihood that people in the UK receive fraudulent messages and calls.

How the scams work

Ofcom identifies two principal routes criminals use to reach UK phones. The first is bulk scam text messaging, where fraudsters send messages impersonating banks, delivery companies, government bodies and other trusted organisations, typically containing a link to a counterfeit website designed to harvest login details, card numbers or personal information. These messages are often routed through legitimate wholesale messaging channels, aggregators and compromised business accounts, which is why network level controls on how messages enter the system matter as much as filtering at the handset. The second route is caller ID spoofing, and particularly international spoofing, where a call originating overseas is presented to the recipient as coming from a UK number, sometimes mimicking the genuine number of a bank's fraud team. Spoofed presentation is central to the most damaging fraud types, including bank impersonation scams where victims are talked into moving money to what they believe is a safe account. The new rules target both routes: fraudulent messages are to be blocked before delivery, and operators must prevent international callers from presenting UK caller IDs they have no right to use.

What changes for consumers

The intended consumer experience is straightforward: fewer scam texts arriving, and fewer calls that appear to come from trusted UK numbers but originate with overseas fraud operations. Because the rules apply across the whole mobile sector, the level of protection will no longer depend on which network a customer happens to use, which particularly benefits customers of smaller operators and virtual networks that may have had thinner defences than the largest providers. The measures work silently at network level, so consumers do not need to change settings, install anything or take any action to benefit. Ofcom has been careful to note that no filtering system will catch every message, and standard vigilance advice continues to apply: genuine organisations do not ask customers to disclose full passwords or move money to a safe account, suspicious texts can be reported for free by forwarding them to 7726, and suspected scam calls should be ended and the organisation contacted back on a number from its official website or the back of a bank card. The rules aim to shrink the volume of attempts that reach people, which in turn reduces the number of moments in which a single lapse of attention can become a life changing loss.

Why regulation replaced voluntary action

The UK mobile industry has operated voluntary anti fraud initiatives for years, including shared intelligence on scam campaigns and do not originate lists that protect the numbers of major banks and government bodies from being spoofed. Those efforts produced real results but left structural weaknesses: participation and depth varied by operator, new entrants were not always covered, and criminals migrated to whichever routes offered least resistance. Ofcom's decision to convert best practice into enforceable requirements reflects a broader pattern in UK fraud policy, which has progressively shifted responsibility towards the institutions that control the channels fraud travels through, from payment providers to telecoms networks and, under the Online Safety Act, online platforms where scam advertising and fake investment content circulate. For mobile operators, the compliance task now includes demonstrating that blocking and spoofing prevention measures meet the required standard, and the regulator retains enforcement powers where providers fall short. The economics are also significant for the networks themselves, since scam traffic consumes capacity, drives customer complaints and erodes trust in calls and messages as channels, a trust that legitimate businesses depend on for everything from delivery notifications to fraud alerts.

What happens next

Attention now moves to implementation and measurement. The effectiveness of the package will show up in the metrics Ofcom already tracks: the proportion of consumers reporting suspicious messages, the volume of reports to the 7726 service, and fraud loss data collected by the finance industry and the National Fraud Intelligence Bureau. Criminal operations adapt quickly, and the realistic expectation is displacement as well as reduction, with fraudsters shifting weight towards channels the rules do not cover, such as messaging apps, email and social media platforms, where separate regimes under the Online Safety Act apply. Consumers should therefore expect the mix of scam attempts to change shape rather than vanish. For the telecoms sector, the rules land alongside wider network security obligations and continuing work on number management, and further tightening remains possible if the data shows criminals finding new routes through the phone system. The direction of policy is clear: the burden of stopping scam traffic sits with the networks that carry it, and the standard is now set by regulation rather than by the most diligent operator's voluntary practice.

Frequently asked questions

What do Ofcom's new rules require mobile networks to do?

Operators must block fraudulent text messages and prevent international callers from spoofing UK caller IDs, meeting a consistent standard across the whole mobile sector.

How much is lost to fraud in the UK?

Ofcom cites £1.28 billion lost to criminals in 2025, with fraud accounting for around 45 percent of all reported crime incidents in England and Wales.

Do consumers need to do anything to be protected?

No. The measures operate at network level. Consumers can additionally report suspicious texts free of charge by forwarding them to 7726.

Will the rules stop all scam texts and calls?

No filtering system catches everything, and criminals may shift to other channels such as messaging apps and email. The rules aim to significantly reduce the volume reaching UK phones.

What is caller ID spoofing?

It is the practice of falsifying the number displayed to a call recipient, often making an overseas fraud call appear to come from a genuine UK organisation such as a bank.