Ofcom plans crackdown on fake number fraud

• New plans to stop scammers from using fake phone numbers and accessing real ones
• Extended ‘spoofed calls’ protections to cover all phone companies

UK phone companies will make it harder for scammers to use their networks, under a range of measures proposed by Ofcom today.

Almost 45 million people were targeted by scam calls and texts last summer. Criminals are becoming increasingly sophisticated, and nearly a million of these consumers followed the scammers’ instructions, risking financial loss and emotional distress.

Ofcom works with phone companies to help them block calls that imitate – or ‘spoof’ – the phone numbers of legitimate organisations, such as banks and Government departments. But fraudsters quickly adapt to changing circumstances and technology. During the pandemic, for example, criminals have been texting fraudulent vaccination links and impersonating delivery companies.

So we have been supporting phone companies and working with other organisations on new ways to combat phone and text scams.

Fighting fraud from fake UK phone numbers

Ofcom is proposing strengthened rules and guidance to combat number spoofing. All telephone networks involved in the transmission of a call will be expected to block numbers that are clearly spoofed. This rule would apply to all phone companies, ensuring the protection applies to millions of people.

Spoofed numbers can be identified in a number of ways. Examples include calls originating from abroad that do not have a valid caller ID, using a number that does not meet the UK’s 10- or 11-digit format, and calls appearing to be from numbers that are already on Ofcom’s Do Not Originate list.

The guidance on blocking calls from abroad that falsely use a UK number is based on an initiative developed by industry, which some providers have already implemented voluntarily. One of these – TalkTalk – previously stated it had seen a 65% reduction in complaints about scam calls since it introduced this measure.

Stopping scammers using real phone numbers

We are also proposing new guidance to help companies prevent scammers from accessing valid phone numbers.

Ofcom allocates millions of telephone numbers, usually in large blocks, to telecoms companies. These companies can then transfer the numbers to other businesses or individuals. All phone companies are expected to take reasonable steps to stop their numbers being misused, but these efforts can vary.

Our new guide sets out clear expectations for phone companies to make sure they run ‘know your customer’ checks on business customers. These could involve checking the Companies House register, fraud risk databases and the FCA’s Financial Services Register to uncover information that may indicate a high risk of misuse by the customer seeking to use phone numbers.

Phone companies should also act to prevent any further potential misuse – this may include suspending the number and reporting evidence of fraudulent activity to law enforcement.

Using technology to fight fraud in the future

Scammers’ tactics are constantly evolving and becoming more sophisticated, so there is no single solution that will stamp out scam calls. But Ofcom is examining how technology can help prevent scam calls at source in the future.

For calls originating in the UK, this would involve the network from which the call is being made “authenticating” the caller’s ID information before connecting them.

This should be achievable once the UK’s transition to digital landlines is complete in a few years’ time, and we are exploring how phone companies might put the technology in place to allow this to happen.

The threat posed by scammers has grown significantly in recent years, and the sophisticated tactics used by these criminals can have devastating consequences for victims.

We’re taking action so phone companies have stronger systems in place to disrupt scams. While there is no silver bullet that will end the scourge of scam calls completely, we’re working with industry on how we can use technology to make it as difficult as possible to reach people.

Huw Saunders, Ofcom’s Director of Network Infrastructure and Resilience

Notes to editors

1. 45 million people targeted by scam calls and texts this summer
2. Ofcom has previously developed initiatives to help tackle scam calls, such as the ‘Do Not Originate’ list. These are numbers that organisations such as banks and Government departments never use for outbound calls. Scammers may change their caller ID – known as ‘spoofing’ – to impersonate one of these organisations. Our list is used by phone companies to block calls imitating one of these numbers.
3. NICC Standards is a technical forum for UK Communications Providers, and guidance on blocking international calls with UK numbers was set out in ND1447
4. There are two numbers associated with Calling Line Identification (CLI) data, the Presentation Number and the Network Number. The Network Number identifies the fixed ingress into the public network or a subscriber that has non-fixed access to the public network. Calls from abroad should not use UK CLI as a Network Number, except in a limited number of legitimate use cases:
   • UK mobile users roaming overseas making calls back to UK numbers;
   • calls to a mobile user who is roaming in the UK;
   • where the traffic has originated on a UK network; or
   • where the traffic has originated from UK customers that are hosted on overseas nodes or cloud services.

   
   Callers from abroad can also continue to use a UK CLI as a Presentation Number provided that the Network Number identifies the source of the call, for example by using a number from the country where the call has originated.

5.  If you’ve received a scam call, you can report it to Action Fraud, which is the reporting centre for fraud and cybercrime in England, Wales and Northern Ireland. Reports of fraud and any other financial crime in Scotland should be made to Police Scotland via 101.