Protect yourself from mobile number fraud in the UK

Mobile number fraud is when a criminal takes over your UK mobile number, imitates a trusted number, or tricks you into sharing a code sent to your phone, then uses that access against bank, email, shopping and government accounts. Add an account PIN with your network, move important logins off text-message codes, and check unexpected calls and texts on a number from the organisation's own website or app. If the phone loses service and you did not order a new SIM, inform your network provider and then your bank for further guidance.

A swap or port you asked for is a normal network process. Those steps are in SIM swap and Number porting. This guide is about fraudulent attacks.

What mobile number fraud is

Mobile number fraud is the set of scams and takeovers that use a UK mobile number as proof of who you are. A criminal either takes control of the number, imitates a trusted number on a call or text, or persuades you to hand over a security code sent to your phone.

The number is stored in the network's records and linked to the SIM or eSIM in the phone. Ofcom notes that people use mobile numbers to create accounts, verify contact details and sign up to services such as WhatsApp, as well as to make calls (Ofcom). A text to that number is widely treated as evidence that the account holder is the person at the keyboard. Fraud starts when that evidence is stolen or faked.

There are three patterns:

Industry filings and reports from the public are different counts. They are set out in SIM-swap fraud in numbers. Neither series is a census of every victim, and neither counts a replacement the customer asked for.

A replacement you ordered, because a SIM was lost, broken or the wrong size, is a SIM swap. A move to another network with a PAC you requested is number porting. Fraud is the same machinery used without your consent, or a message that only pretends a trusted organisation sent it.

Common types of mobile number fraud

The attacks that do the most damage either move your number onto a SIM the criminal controls, or trick you into revealing a code while the number stays on your phone. A SIM swap the criminal asks for is only one of the routes. The filing totals are in SIM-swap fraud in numbers.

SIM-swap fraud. The criminal persuades the network, or uses a compromised mobile account, to issue a replacement SIM or eSIM. How an eSIM download differs from a plastic card is in eSIM. The old SIM stops. Texts and calls follow the new one. Which? found that a taken-over email was enough in documented cases, because some networks will send the account's one-time code to email. References to an eSIM in police reports rose from 18 in 2022 to 763 in 2024. Which? says that rise does not mean eSIM users are uniquely vulnerable. An eSIM can be activated remotely, so the account check is what matters (Which?; Merseyside Police, 2025).

Port-out fraud. A PAC (Porting Authorisation Code) authorises another provider to take the number. It lasts 30 days, and Ofcom requires the switch to complete within one working day once the gaining provider uses it (Ofcom). Texting PAC to 65075 from your own phone is the legitimate way to ask for one. An unlocked stolen phone can send that text. So can a criminal who talks a call centre into issuing a code. An unexpected PAC text is a reason to call the network on a number from its website. The legitimate process is in Number porting.

Account takeover and contracts in your name. Filings about unauthorised mobile upgrades rose 96% in 2024. People aged 61 and over made up 29% of account-takeover filings, and filings about that age group rose 90% year on year (Cifas, 2025). The share of takeovers that involve a mobile account, and the rise in identity fraud on mobile products, are in SIM-swap fraud in numbers.

Smishing and phishing. Smishing is phishing by text. The message may claim a parcel is waiting, a refund is due, a toll is unpaid, or a bank login needs reconfirming. The link collects a password or card details, or it installs a malicious app. Phishing email often comes first. In the SIM-swap cases Which? reviewed, the email account was the door into the mobile account. Forty per cent of UK mobile users said they had received at least one suspicious mobile message in the previous three months, in Ofcom's 2026 research, and users reported an estimated 100 million suspicious messages through 7726 in the year to April 2025 (Ofcom, 2026).

Spoofed calls and vishing. Vishing is the same pressure on a phone call. Caller ID can be copied, so the screen may show a bank, HMRC, Ofcom or your own number. Ofcom will never call out of the blue and ask for bank or personal details (Ofcom). In February 2025, 42% of phone users said they had received a suspicious call in the previous three months. People were more willing to answer a UK mobile they did not recognise (26% likely or very likely) than an international number (9%) (Ofcom, 2025).

Messaging-app takeover. WhatsApp registers an account to a mobile number and sends a six-digit code by text or call. WhatsApp says a code you did not request means someone entered your number, and that you should never share it (WhatsApp). Criminals often pretend a friend sent you their code by mistake. The friend's account was taken the same way. Two-step verification in the app adds a PIN they still need. Everyday setup of a genuine account is covered in WhatsApp verification. The code in that setup is still a secret.

Wangiri, premium missed calls, and bulk texts. A one-ring call from an unfamiliar international number is often there to make you call back onto a premium rate. Ofcom also warns against calling back unfamiliar numbers beginning 070, 076, 084, 087, 090, 091 or 118, which can be expensive (Ofcom). Separately, criminals send person-to-person scam texts at scale from SIM farms. Ofcom's new messaging rules, in force for person-to-person texts from 18 January 2027, require providers to cap pay-as-you-go volumes and to block numbers and links tied to scam reports (Ofcom, 2026).

Messages for a previous user. Networks disconnect inactive pay-as-you-go numbers and can reuse the digits. Ofcom says the inactivity period ranges from as little as 70 days to six months or more, depending on the provider (Ofcom). A code that arrives for an account you do not hold belongs to someone else. Delete it. If you are about to give a number up, remove it from every account first.

Why a hijacked mobile number is dangerous

A hijacked mobile number is dangerous because banks, email, messaging apps and government services treat texts to that number as proof that the real customer is present. UK Finance members reported £1.28 billion stolen through payment fraud in 2025, and criminals used compromised one-time passcodes to register digital wallets and make transactions (UK Finance, 2026).

The loss figure covers payment fraud reported by UK Finance members, up 4% on 2024, across 4.06 million cases. Unauthorised fraud, where someone else moved the money, was £703.4 million. Authorised push payment fraud, where the customer was persuaded to send it, was £576.4 million, up 19%. Telecommunications started 17% of those authorised cases and 28% of the losses. Cases that begin with a call or text tend to be the higher-value ones. Online sources started 66% of cases and 32% of losses.

Ofcom's description of mobile numbers includes account creation and verification, which is why a memorable or published number is a real identity, not only a way to receive calls (Ofcom). A number on a van, a website or a business card is easy to find. Put the network's extra account security on before you publicise it.

Email is often the master key. Which? documented SIM swaps that began with an email account that had no second factor. The criminal reset the mobile-account password via a code sent to that inbox, then ordered the swap (Which?).

Government and tax contacts are part of the same pattern. HMRC does send some genuine texts. It says those texts never ask for personal or financial information, and it tells customers not to open links or reply to a text that offers a refund in exchange for those details. Customers reported more than 170,000 scam referrals to HMRC in the 12 months to 31 July 2025, and more than 47,000 of them were fake tax-refund claims (GOV.UK; HMRC text guidance).

The harm is wider than the missing money. The Crime Survey for England and Wales estimated 4.2 million fraud incidents in the year ending March 2025, up 31% on the year before. Seven in ten fraud victims (71%) reported an emotional impact. Annoyance, anger, shock, and loss of confidence were the most common (ONS, 2025). The Crown Prosecution Service, citing later survey estimates, describes fraud as the most commonly experienced crime in England and Wales, with over 4 million offences in the year ending September 2025, about 45% of crime, and about 1 in 14 adults a victim (CPS).

A stolen handset is a common way in. The Home Office snatch estimate and the Metropolitan Police theft count are in SIM-swap fraud in numbers. An unlocked phone can display codes and can text a PAC request. Barring a stolen line is covered with the legitimate replacement steps in SIM swap.

Warning signs

The clearest warning is a phone that suddenly cannot call, text or use data, while other people on the same network still can, and you have not ordered a replacement SIM. Merseyside Police lists that loss of service, unexpected messages about account changes, and failed logins or unauthorised transactions as the signs of a SIM swap (Merseyside Police, 2025).

Check the provider's outage page before you assume the worst. A network fault hits many people at once. A swap hits your line.

Pressure is part of the script. Callers invent a warrant, a frozen account, a parcel fee or a limited-time refund so you act before you check. HMRC says it will not ask for personal or financial information by text, and it will not use a text to get you to claim a refund by handing details over (GOV.UK).

A message can look right and still be wrong. Alphanumeric sender names such as a bank's trading name are attractive to criminals for that reason. Ofcom's business-messaging rules, in force from 15 July 2027, will require providers to check that a sender name matches the business they have identified, and to keep a policy on protected and generic names (Ofcom, 2026). Until those checks are universal, the safe habit is to leave the message and open the service yourself.

How to protect yourself

The protections that matter are the ones that stop a text code, a PAC or a mobile-account login from being enough to empty an account. In the Crime Survey year ending March 2025, the share of people using two-factor authentication rose from 39% to 48%, and the share getting confirmation of the payee name on a bank transfer rose from 41% to 45% (ONS, 2025). Confirmation of Payee tells you whether the name you typed matches the account. A result that is not a clear match is a reason to stop.

Do the account PIN on the day the number goes live, including a number you have just bought and ported. The provider that bills the line, or the virtual host if you use one, is who can set it. Virtual number hosting explains the host relationship. Create Numbers does not operate the SIM after delivery.

Tell anyone who might be targeted, particularly older relatives. Cifas found that people aged 61 and over accounted for 29% of account-takeover filings in 2024. The useful sentence to share is short: we will never ask you to read out a code or move money because we rang you.

The Telephone Preference Service can cut some marketing calls. It does not stop criminals. Register if you want fewer sales calls, and still treat unexpected calls about money as something to hang up on.

What to do if your number has been hijacked

If the number has been moved or a code has been misused, call the mobile network and the bank from another phone before you do anything else. Speed matters: UK Finance members recorded £1.28 billion stolen through payment fraud in 2025, and a payment still in flight is the one a bank has the best chance of stopping (UK Finance, 2026).

Use a friend's phone, a work phone or a landline. Your own phone may have no service, and it may not be a safe place to open banking if you followed a link.

Report Fraud replaced Action Fraud on 4 December 2025. The phone number 0300 123 2040 stayed the same. The service covers England, Wales and Northern Ireland. People in Scotland report to Police Scotland on 101 (GOV.UK, 2025). Report Fraud does not investigate every report itself. It records the crime and passes cases on. Keep your own copies of texts and screenshots. The service asks you to hold that evidence in case police need it.

Forward the scam text to 7726 as well. That tells the mobile networks. It is free, and it is not a substitute for the crime report. Ofcom's guide to scam calls and texts sets out both routes (Ofcom).

If you sent the money yourself, ask the bank to treat it as authorised push payment fraud. From 7 October 2024, payment firms must reimburse consumers for APP scams on UK Faster Payments and CHAPS, up to £85,000 a claim, usually within five business days. A firm can pause to gather information, and it must still reach an outcome within 35 business days. You generally have 13 months from the last payment in the claim. Firms may apply an excess of up to £100. They must not apply that excess, or the gross-negligence exception, to a vulnerable consumer. The Payment Systems Regulator expected the £85,000 cap to fully cover 99.8% of in-scope Faster Payments APP scams by volume and 90% by value. International payments and payments for unlawful purposes are outside the scheme. This is the general rule, not a decision on your case, and it is not legal advice (PSR).

If someone else moved the money, tell the bank the payment was unauthorised. Say the SIM was no longer yours, so you could not have approved the code. Refund rules for unauthorised payments are different from the APP scheme. Ask the bank which set it is applying, and ask for the answer in writing. If you are unhappy, complain to the firm and then to the Financial Ombudsman Service. The PSR has noted the ombudsman's award limit at £430,000. Check the ombudsman for the limit that applies when you complain, because it can change.

In 2025, UK Finance members returned £354.3 million to APP victims, up 30% on the year (UK Finance, 2026). Returning the money still depends on a claim the firm accepts. Report it early, and keep the references.

After the number is back, change the passwords that were protected by text, remove SMS codes where you can, and confirm the network has an account PIN in place. Check digital wallets for cards you did not add. If a handset or contract was opened in your name, ask that provider to close it and check your credit file. Getting the same number back is usually the right first move when banks and government accounts are still registered to it. Changing the digits comes after those services have been updated. Which? has found that people who change number often leave old codes pointing at the number they gave up.

A number hosted virtually is recovered through the host, using the same urgency. If the number is on a normal UK network, the replacement once you are back in control is a SIM swap you requested, or a port if you are leaving that provider.

What UK regulators and the industry are doing

Ofcom, the Payment Systems Regulator and the police have spent several years making spoofed calls, bulk scam texts and authorised push-payment scams harder to run. The measures already in force include a block on many overseas calls that imitate UK landlines, from 29 January 2025, and mandatory reimbursement for many authorised push-payment scams from 7 October 2024 (Ofcom, 2025; PSR).

These controls raise the cost of mass fraud. They do not replace an account PIN or a refusal to read out a code. A targeted swap that passes a provider's identity check can still succeed.

The July 2026 mobile-caller rule is aimed at gangs abroad who present a UK mobile number because people are more likely to answer it. Ofcom expects the displayed number to be withheld unless the provider can verify the call. Withheld numbers will still include genuine calls, so the habit of checking on a published number remains the right one (Ofcom, 2026).

Banks have parallel tools. Stop Scams UK's 159 short code reaches participating banks, including the large high-street and app-based names, over BT, EE, O2, giffgaff, Vodafone, Three, Sky, Virgin Media, TalkTalk and others. The call cost depends on your tariff (Stop Scams UK). Confirmation of Payee checks the account name on a transfer. UK Finance members also reported stopping £1.68 billion of unauthorised fraud in 2025 before a loss, about 70p in every £1 attempted (UK Finance, 2026).

None of that catches a code you read out, or a PAC sent from a phone a thief has unlocked. The regulatory work and the personal steps do different jobs. Use both.

SIM-swap fraud in numbers

The published SIM-swap counts measure fraud, not how many people ordered a new SIM because the old one cracked. Cifas counts cases its member organisations file to the National Fraud Database, Action Fraud counted reports from the public until Report Fraud replaced it on 4 December 2025, and the FBI counts complaints in the United States. Adding a Cifas filing to a police report can count the same crime twice.

• Ordinary replacements are not in these figures. Every large network will replace a lost card. The steps are in SIM swap. Networks publish the how, not a national volume of ordinary replacements.
• eSIM awareness is a different count. How many people have heard of an eSIM, and how many say they would use one, is in eSIM.

Frequently Asked Questions

Should I turn off text-message codes from my bank?

Keep the bank's app approval or an authenticator, and switch off text-message codes where the bank allows it. Those texts arrive on whichever SIM currently holds the number, and mobile accounts made up 48% of the account takeovers Cifas members filed in 2024 (Cifas, 2025). If the bank has no alternative, keep the text codes, because they are still better than a password on its own, and ask what the bank does after a recent SIM change.

I received a PAC by text and I did not ask for one. What should I do?

Call your network on a number from its website or app and say the port was not requested. A PAC authorises another provider to take the number, lasts 30 days, and Ofcom requires the move to finish within one working day once a gaining provider uses it (Ofcom). Ignore anyone who then rings to confirm the code, ask the network to cancel the PAC, and ask it to add extra checks before it issues another.

The caller ID showed my bank. Should I stay on the line?

Hang up and reach the bank through its app, the number on your card, or 159 if your bank is on the Stop Scams UK list. Ofcom's February 2025 research found 26% of people were likely to answer an unrecognised UK mobile, against 9% for an unrecognised international number, which is why spoofed UK numbers work (Ofcom, 2025). A matching caller ID is a display, and it can be copied.

Do I report a suspicious text to 7726, Report Fraud, or both?

Forward the text to 7726 so your mobile network can trace and block the sender. That report is free and does not record a crime, so if you lost money, shared a code, or the number was taken over, also report it at reportfraud.police.uk or on 0300 123 2040 (in Scotland, call 101). Mobile users sent an estimated 100 million suspicious messages to 7726 in the year to April 2025 (Ofcom, 2026).

I live in Scotland. Does Report Fraud apply to me?

Report the crime to Police Scotland on 101. Report Fraud, which replaced Action Fraud on 4 December 2025, takes reports from England, Wales and Northern Ireland, while a text to 7726 and an email to [email protected] still help the networks and the National Cyber Security Centre wherever you live (GOV.UK, 2025). Call 999 if a theft or a threat is happening now.

The bank says I authorised the payment because I read out a code. What can I ask for?

Ask the bank to say which kind of payment it has recorded. A payment you were talked into sending is authorised push payment fraud, and UK Faster Payments and CHAPS claims from 7 October 2024 can be reimbursed up to £85,000, usually within five business days (PSR). A payment made by someone else is unauthorised and follows different refund rules, so ask for the decision in writing and use the Financial Ombudsman Service if you disagree.

My signal died while I was abroad. Is that a SIM swap?

Compare your phone with someone else on the same network, and check the provider's outage page over Wi-Fi. A SIM swap usually cuts calls, texts and data on your line alone, which is the pattern Merseyside Police tells people to watch for (Merseyside Police, 2025). Call the network from another phone, or through its app on Wi-Fi, before you share a code with anyone offering to restore the signal.

A contact says I asked them for a WhatsApp code, but my app still works. What happened?

Treat it as an attempt to register WhatsApp on your number, even though your own app still works. WhatsApp says a code you did not request means someone entered your number, and that you should never share the six digits (WhatsApp). Turn on two-step verification, and call the contact on a number already saved in your phone.

I took over a number and I am receiving someone else's bank codes. What do I do?

Delete the messages and do not enter the codes or follow the links. They were sent for a previous user of the digits, so tell your network if they keep arriving, and never type the codes in. Before you give up a number of your own, remove it from banks, email, WhatsApp and HMRC, because inactive pay-as-you-go numbers can be disconnected and the digits reused (Ofcom).

Should a business keep banking codes on the same number as public WhatsApp?

Use a separate line for bank, payroll and HMRC codes, and keep the published WhatsApp or sales number away from those logins. Telecommunications started 17% of authorised push payment cases in 2025 and 28% of the losses, because the cases that begin with a call or text tend to be the higher-value ones (UK Finance, 2026). Put an account PIN on the admin line, and store spare recovery codes off the handset.

Will changing my number undo the damage?

Get the hijacked number back onto a SIM you control before you change the digits, if banks and government accounts are still registered to it. A new number only helps once every service has been updated, and Which? has found that people who change number often leave security codes pointing at the old one (Which?). Ask the network for an extra account PIN, then follow the genuine swap or port steps if you later decide to move.

My provider says it cannot add a SIM-swap PIN. What is the next best control?

Lock the email account with an authenticator or a passkey, and give the mobile account a unique password. Which? found that a taken-over email was enough to request a SIM swap, because some networks will send the account's one-time code to email as well as to the phone (Which?). Turn on any login alert the provider offers, and open the account yourself after any text about a change.

Can I trust a text because the sender name says HMRC or my bank?

Open HMRC or the bank from the app or a bookmark you already use. HMRC does send some genuine texts, and it says those messages never ask for personal or financial information (GOV.UK). Forward a suspect HMRC text to 60599: customers reported more than 170,000 scam referrals in the 12 months to 31 July 2025, including more than 47,000 fake refund claims (GOV.UK).

How quickly do I need to call the bank?

Call the moment you suspect the number has moved or money has left, using another phone if yours has no signal. In 2025, criminals stole £1.28 billion through payment fraud reported by UK Finance members, while the industry stopped a further £1.68 billion of unauthorised fraud before a loss (UK Finance, 2026). Ask for a case reference, note the time, and tell the bank the SIM may be in someone else's hands.