A spam call or text is unwanted marketing. A fraudulent one is a criminal attempt to take money, a security code, or control of an account, often by pretending to be your bank, a delivery firm, HMRC or the police. In February 2026, 37% of UK phone users said they had received a suspicious call in the previous three months, and 40% of mobile users said they had received a suspicious text or similar message (Ofcom). Hang up or ignore the link, then check the organisation on a number or website you look up yourself. For a bank, that check is 159.
| Fact | UK calls and texts |
|---|---|
| Suspicious calls, previous 3 months | 37% of phone users (39% of landline users, 32% of mobile users), February 2026 (Ofcom) |
| Suspicious mobile messages, previous 3 months | 40% of mobile users, February 2026 (Ofcom) |
| Payment fraud stolen in 2025 | £1.28 billion (UK Finance, Annual Fraud Report 2026) |
| Share that started on telecoms | 17% of authorised push payment cases, and 28% of those losses (UK Finance) |
| Report a suspicious text or call number | Forward it, or text the number, to 7726 (free on participating networks) |
| Reach your bank about a suspicious approach | Dial 159. It will never call you |
| Report the crime | Report Fraud or 0300 123 2040 in England, Wales and Northern Ireland. Police Scotland on 101 |
| Marketing complaints | ICO, 0303 123 1113. Silent calls: Ofcom, 0300 123 3333 |
The examples below are for recognition. A real organisation that needs a decision from you can wait while you call back on a published number.
What spam and fraudulent calls and texts are
Spam is an unwanted marketing call or text, such as a live sales pitch, a recorded advert, or a promotion you did not agree to receive. Fraud is a dishonest attempt to take money, a security code, or control of an account or phone, often by pretending to be a bank, a delivery firm, HMRC or the police. Ofcom treats the two as different jobs: the Information Commissioner's Office leads on unwanted marketing, and scam calls and texts are a fraud problem for the police and the banks (Ofcom, role and approach).
A marketing call that follows the rules tells you who is calling, shows a number, and stops if you say so. An automated marketing call needs your specific consent. A marketing text also needs consent, aside from a narrow rule for some existing customers. Those duties sit in the Privacy and Electronic Communications Regulations 2003 (PECR), which the ICO enforces (ICO, telephone marketing). A fraudulent call or text ignores those rules because the aim is theft, not a sale you could opt out of.
They are built to look ordinary:
| What you see | What is actually going on |
|---|---|
| A UK mobile or landline on caller ID | The display can be copied. This is caller-ID spoofing. Networks block some of it, and a displayed number is still only a label |
| A sender name such as a bank or "Royal Mail" | On business text routes the sender chooses that name. It is not proof the message came from that organisation |
| A short link, a QR code, or a phone number in the message | The destination is chosen by the sender. A genuine tracking page, tax account or bank payment is one you open yourself |
| Personal details recited back to you | Name, address, date of birth and recent orders circulate in old breaches and in material people post online. Knowing them is preparation, not proof |
| Pressure to act before you hang up | The script depends on you staying inside the conversation the caller started |
Fraud of this kind is a crime, most often fraud by false representation under the Fraud Act 2006. Installing malicious software, or using it to get into an account, can also be an offence under the Computer Misuse Act 1990. Those cases go to Report Fraud or Police Scotland, which is a different queue from an ICO complaint about a sales call.
What the common types look like
The messages that reach UK phones cluster into a few patterns: sales calls, silent calls, spoofed caller ID, and impersonation of banks, delivery firms, HMRC and the police. Ofcom's 2026 survey uses the same examples people actually receive, including a parcel fee, a fake tax refund, a bank "safe account" transfer, and a courier sent to collect cash (Ofcom questionnaire, 2026). Each type asks for something specific, and that ask is the part worth noticing.
| Type | What it looks like | What they want |
|---|---|---|
| Live sales call | A person selling insurance, broadband, energy, claims or home improvements | A card payment or an appointment. Illegal if you are on the Telephone Preference Service and have not agreed to that caller's calls |
| Recorded marketing call | A played message when you answer | The same, and it needs specific consent even if you are not on the TPS |
| Silent or abandoned call | Nobody speaks, or the line drops, often from a dialler | Usually a badly run call centre. Ofcom can fine persistent misuse up to £2 million |
| Spoofed caller ID | The screen shows your bank, HMRC, or a mobile that looks local | You to trust the call and stay on the line |
| One-ring or international missed call | One ring from an unfamiliar overseas number | You to call back onto an expensive international line |
| Bank or police impersonation | "Your account is under attack. Move the money to a safe account" | A Faster Payment or CHAPS transfer you authorise yourself |
| Courier fraud | "The police need the cash or the cards, and a courier is on the way" | Physical cash, cards or PINs, handed over in person |
| HMRC, TV Licensing or other government impersonation | A refund you were not expecting, or a threat of arrest | Card details, a login, or a payment on a link |
| Parcel, customs or "duty unpaid" text | Royal Mail, Evri, DPD or a similar name, plus a small fee | Card details on a fake page. Sometimes an app that is malware |
| Account-code text | A WhatsApp, email or bank code you did not request | The code, so they can register your number or log in. See WhatsApp verification |
| Remote-access call | "Install this app so we can secure the account" | Control of the phone or computer |
| Investment, pension or insurance cold call | Guaranteed returns, or a transfer out of a pension | A large transfer. Pension cold calling is banned except in narrow cases |
| Cloned voice | A relative, or a recording that sounds like you, in distress or "confirming" a payment | Money, or a direct debit set up in your name |
| QR code in a text or on a poster | "Scan to pay the charge or redeliver" | The same as a link: a page or a download you did not choose |
Two variants are worth separating because the labels get mixed up.
Smishing is phishing by text. The parcel and customs messages are the common UK form. The National Cyber Security Centre warns that a "missed parcel" text can lead to a fake app which steals banking details and passwords, then texts the same lure to people in your contacts (NCSC). Some phone malware also locks the device and demands a payment, which is the ransomware pattern. The NCSC's parcel warning is about theft of banking details and onward spread. Either way, the response is the same: leave the link, and if an app was installed, treat the phone as unsafe for banking.
Number spoofing is a lie about who is calling. Ofcom's February 2026 research found that 24% of phone users were likely to pick up an unrecognised UK mobile number, against 8% for an international number and 17% for a withheld number. A copied 07 display is a deliberate choice because people answer it. From January 2025, providers have had to block calls from abroad that imitate UK landline numbers, with a limited set of legitimate exceptions. Calls from abroad that imitate UK mobiles are due to show as withheld from 15 July 2027 unless the network can verify them (Ofcom, tackling scam calls from abroad).
What the warning signs are
A warning sign is a request that a real bank, courier or tax office does not make on an inbound call or text. The strongest signs are urgency, a link, a demand to move money, and a request for a one-time passcode or remote access to your phone. National Trading Standards reported in February 2026 that UK adults were receiving an average of seven scam calls or texts a month, so these signs are worth using every week, and 21% of adults said they received them most days (Censuswide, 2,001 UK adults, 1–7 October 2025, published by NTS).
| Sign | Why it matters |
|---|---|
| Urgency, arrest, disconnection, or "pay in the next hour" | The aim is to stop you calling back on a number you chose |
| A link, QR code, or phone number inside the message | You cannot see the real destination from the label |
| A brand name as the text sender | The name is chosen by the sender on many business-text routes |
| Caller ID that matches a bank, HMRC, or a nearby mobile | Spoofing exists so the screen will match |
| They know your name, address, date of birth, or a recent order | Those facts are widely held. Reciting them shows preparation |
| A one-time code, full password, PIN, or the long card number | A code completes a login or payment that somebody else started |
| "Move the money to a safe account", gift cards, or crypto | UK Finance classes bank and police impersonation as a major authorised-payment scam. Losses were £55.5 million in 2025 |
| Software to install, or a screen they need to see | Remote access lets them act while you are still on the phone |
| A courier at the door for cash or cards | Ofcom lists this as a standard fraudulent-call script |
| A fee for a parcel, tax refund, or fine you were not expecting | The small amount is there to make the card payment feel harmless |
| A voice that sounds like a relative, asking you to keep it secret | Voice cloning is in use in the UK. A family code word settles it |
| A missed call from an overseas number you do not know | Calling back can start an expensive international call |
A genuine bank, card firm or HMRC team will wait while you hang up and use a number from your card, your bank's app, or GOV.UK. They will not ask you to move money to a safe account, read out a one-time code, or hand cards and cash to a courier.
Caller ID and sender names fail as proof for a structural reason. Ofcom's review of reports to 7726 found that, in a sample of 4,000 reports, 137 scam texts used an alphanumeric sender name, and about 65% of those names were a fabricated or obscure business name (Ofcom, combatting mobile messaging scams, 15 July 2026). The other pattern is a straight copy of a real brand. Familiarity is the disguise.
Why a call or text can do serious harm
The harm is money, access to other accounts, and the time and distress that follow, even when nobody pays. UK Finance recorded £1.28 billion stolen through payment fraud in 2025, and telecommunications started 17% of authorised push payment cases and 28% of those losses (UK Finance, 2026). A short call can also harvest personal details that are sold on and reused.
Authorised push payment fraud is the case where you send the money yourself, because you were persuaded the recipient was genuine. There were 248,070 such cases in 2025, with losses of £576.4 million, up 19% on 2024. Impersonation of police or bank staff was £55.5 million across 6,016 cases, down 18% in value, and other impersonation was £36.9 million across 18,435 cases (UK Finance, Annual Fraud Report 2026). Impersonation losses are lower than in 2024. The remaining totals show that the script still pays.
| Harm | How a call or text causes it |
|---|---|
| Money gone | You approve a bank transfer, a card payment, a direct debit, or you hand over cash. In 2025, £460.9 million of authorised push payment losses moved by Faster Payment |
| Account takeover | A one-time text code, a WhatsApp registration, or a SIM swap you did not ask for lets someone else into mail, payments and saved logins |
| Malware | A fake parcel app can take banking details and message your contacts. Lock-screen malware demands a fee to give the phone back |
| Later fraud | Date of birth, health details, a voice clip or a photo of a licence make the next call more convincing. National Trading Standards has traced cloned voices to fake direct-debit consent |
| Distress and lost trust | Ofcom notes emotional harm, inconvenience, and people who stop trusting calls and messages at all |
| Time and disruption | NTS's October 2025 survey put the average at seven scam calls or texts a month. Silent calls are unsettling enough that Ofcom has a specific enforcement regime |
| A business paying the wrong person | A text about duty, or a call about a changed account number, can push a member of staff to pay a real invoice to a criminal |
The National Crime Agency estimates that fraud accounts for 45% of reported crime incidents in England and Wales (National Strategic Assessment 2026, cited by Ofcom). UK Finance's position is that reimbursement, where it happens, does not stop the money reaching serious and organised crime. In the first year of the new reimbursement rules, 88% of in-scope authorised push payment losses were returned to victims, and the Dedicated Card and Payment Crime Unit, funded by the banking industry, prevented more than £273 million of fraud in 2025. Both figures describe a live criminal business, not a nuisance that banks have absorbed.
There is a practical consequence for anyone who uses a mobile number as a login. The same number that receives a parcel scam can also receive the code that resets email, WhatsApp or a bank. Once that code is handed over, the loss is no longer limited to the small fee on the original text. Taking over the number itself is covered in Mobile number fraud.
How to protect yourself
The protection that works is to break the conversation and check the organisation on a channel you open yourself. Hang up, leave the link, and call back on a number printed on the bank card, on GOV.UK, or on the company's own website, or dial 159 for your bank. Stop Scams UK says 159 cannot be spoofed, that it connects customers of more than 99% of UK retail current accounts, and that 159 will never call you (Stop Scams UK).
Calling 159 costs whatever your provider charges for a national-rate call. Use it when a call, text or email is about your money or your identity. For a parcel, open the carrier's own tracking page. For tax, sign in through GOV.UK. For an investment approach, check the FCA Warning List before any transfer. The shared rule is that you start the second contact.
| Sensitive action | What to do instead |
|---|---|
| Move money, even to an account in your name | Hang up. Call 159 or the number on the card. A safe account is a standard impersonation script |
| Read out a one-time code, PIN or password | Use the code only in an app or site you opened. The code is the payment or the login |
| Install an app, a "security tool", or remote-access software | Refuse. If it is already installed, stop using that phone for banking and call the bank from another phone |
| Confirm medical details, date of birth, or a mother's maiden name to an inbound caller | Treat the request as data collection. A real organisation can verify you after you call its published number |
| Hand cash or cards to someone at the door | Keep them. If the person will not leave, call 999 |
| Pay a parcel, customs or fine fee from a link | Track or pay on the site you already use, or the one printed on the item |
| Trust a voice that sounds like family | Ring them on the number you already have for them. Agree a code word in advance (Police Scotland) |
| Change where salary, invoices or a direct debit are paid | Verify the new details on a phone number from the organisation's website, using a call you place |
UK Finance's Take Five campaign compresses the same habit into three words: stop, challenge, protect. Stop the transfer. Challenge the story by contacting the organisation yourself. Protect the code, the PIN and the password by keeping them out of the call.
Personal details that make the next call easier
Information posted for an ordinary reason becomes the script for the next approach. Date of birth, a full address, a mother's maiden name, the name of a school or a pet, and photos of boarding passes, driving licences or hospital letters all answer the questions a criminal, or a careless security check, will ask. Medical details are particularly useful. In February 2026 National Trading Standards described an operation that began with a "lifestyle survey" collecting health and financial information, then used artificial voices cloned from victims to fake consent for direct debits. Victims often noticed only when payments had already left the account.
Voice and video do similar work. Police Scotland's advice on voice-cloning scams is to keep social accounts private, avoid posting clips of your own voice, and call the person back on their usual number if a message says they have lost their phone and need money. A family code word, agreed in advance, gives you something a cloned recording will not know.
This is social engineering: the caller uses true facts so the rest of the story feels true. Ofcom's February 2026 research found that 24% of phone users were likely to pick up an unrecognised UK mobile, against 8% for an international number, which is why a spoofed 07 display and a few true facts are used together. The call sounds local, and it already knows your date of birth.
A few limits on what you publish will do more than any single app:
- Keep date of birth, documents and medical information off public profiles, marketplace chats and quizzes.
- Refuse inbound "surveys" that ask about health, income or who you bank with.
- Tell family that a real emergency can survive a callback and a code word.
- Assume a photo of a letter, a badge or a passport will be reused. Share it only inside a service you opened.
Calls and texts you can cut off in bulk
Register home and personal mobile numbers with the Telephone Preference Service (0345 070 0707). It is free, it is the legal opt-out list for live marketing calls, and it can take up to 28 days to take effect. Business numbers belong on the Corporate TPS. After that, a firm that keeps calling for a sale is a matter for the ICO. The TPS does not stop criminals. In one loft-insulation operation that National Trading Standards disrupted in 2025, 90% of the people called were already registered.
Forward suspicious texts to 7726, or text the suspicious calling number to 7726. The National Cyber Security Centre says most providers are in the scheme, the forward is free, and the report lets the network investigate and block the sender. Ofcom estimates that about 100 million suspicious messages were reported this way in the year to April 2025. You can also screenshot a text or a QR code to [email protected].
Use the handset's silence-unknown-callers setting if you can miss unexpected calls, and let unknown numbers go to voicemail. Return any real message on a number you look up. Report silent and abandoned calls to Ofcom on 0300 123 3333, with the number, the time and how often they come.
The number you publish and the number that receives codes
A number printed on a van, a website, a marketplace listing or a social profile is a number any stranger can call and text. If that same number also receives bank alerts, WhatsApp codes and password resets, you have put the front door and the keys on the same line. Use a separate number for the public one, and keep one-time codes on a number you do not print.
A Create Numbers mobile is a normal UK 07 number from Ofcom's mobile ranges, as set out in UK mobile numbers. It can be spoofed, and it will receive spam, in the same way as any other mobile. It does not include a scam filter. The gain is separation: customers and listings use the published number, and banking texts stay on the private one. You choose the ending and receive a PAC, which is covered in Create a mobile number. If a code arrives that you did not request, it is the login someone else is trying to finish. That applies to WhatsApp as well, which is covered in WhatsApp verification.
What to do if you have already been caught
Act the same day: stop contact, tell the bank or card firm using a number you look up, and report the crime. If you sent a UK bank transfer on or after 7 October 2024, the Payment Systems Regulator's reimbursement rules cover most authorised push payment fraud up to £85,000 a claim, and firms should pay within five business days unless they need more information (PSR). Card payments, cash and international transfers sit outside that scheme and need a claim to the firm that took the payment.
Do these in order.
- Stop. Hang up, close the page, and send no further payment. If someone is at the door, do not hand over cards or cash. Call 999 if you feel unsafe.
- Tell the bank or card firm on a number you look up. Use 159, the number on the card, or the in-app chat. Say what you authorised and when. If you transferred money in the last 24 hours, Citizens Advice also says to call the police on 101, because speed matters to any recovery (Citizens Advice).
- If you installed an app or remote-access tool, stop using that phone for banking. The NCSC advice is: if you only opened a link and typed nothing, watch your accounts; if you entered a password, change it wherever you reused it; if you entered card or bank details, contact the bank from a different phone and cancel the card; if you installed software, run a full antivirus scan and follow the NCSC's steps for an infected device (NCSC, phishing).
- If you read out a one-time code, change the password from a device you trust and sign other sessions out. For WhatsApp, use the app's own registration and turn on its two-step PIN. A sudden loss of mobile signal can mean the number itself has been moved: treat that as urgent and follow SIM swap.
- Report the crime. In England, Wales and Northern Ireland use Report Fraud, which replaced Action Fraud on 4 December 2025, online or on 0300 123 2040. In Scotland call Police Scotland on 101. Keep the text, the number and any confirmation of payment.
- Forward the text to 7726 so the network can block the sender. Report the website to the NCSC at [email protected].
- Watch for the next contact. Criminals often call back pretending to be the bank, the police, or a recovery firm. Use 159 again. If identity documents or extensive personal data were handed over, ask the bank about extra checks, and consider Cifas Protective Registration.
| What you paid or shared | Who can help | What the rules actually cover |
|---|---|---|
| UK bank transfer (Faster Payments or CHAPS) from 7 October 2024 | Your bank, then the Financial Ombudsman if you are unhappy | Mandatory reimbursement for most authorised push payment fraud, cap £85,000 per claim. Outcome in 5 business days, or up to 35 if the firm pauses to gather facts. Claim within 13 months. An optional excess of up to £100 cannot be applied to vulnerable customers. Gross negligence is a high bar and does not apply to vulnerable customers (PSR, PS25/5) |
| Debit or credit card, including a small "customs fee" | The card issuer | A dispute or chargeback. This is not the PSR transfer scheme |
| Cash or cards given to a courier | Police on 101 or 999, and your bank | The PSR scheme does not cover cash. The bank still needs to know, because the cards must be stopped |
| International transfer or crypto | The firm you sent it from, and Report Fraud | Outside the PSR's Faster Payments and CHAPS rules. Speed still matters |
| Passwords, codes, or a fake app | Bank from another phone, then NCSC steps | Cancel cards, change reused passwords, and assume the phone may message your contacts |
| Sales calls and no loss | ICO | PECR complaint. This is the nuisance route, not the fraud route |
| Silent calls and no loss | Ofcom, 0300 123 3333 | Persistent misuse, including fines up to £2 million |
Reimbursement is a safety net for eligible bank transfers. It is not a reason to pay. The cap, the possible excess, the exceptions, and the time without the money all sit with you while the claim is assessed. Card payments and cash follow different rules, and distress is not refunded by either scheme.
A fake customs or postage text is the case people most often shrug off, because the sum is small. The page behind the link is collecting the card, not a delivery fee, and the NCSC's missed-parcel guidance is about malware that can empty more than the amount on the screen. Contact the card issuer, cancel the card if you entered the details, and keep the text for 7726 and Report Fraud.
How the tactics have changed
Criminals have moved from clumsy recorded messages to spoofed UK numbers, fake sender names, malware in parcel texts, and artificial voices. In February 2026, 24% of UK phone users said they were likely to pick up an unrecognised UK mobile number, against 8% for an international number, which is why spoofing a 07 number is useful to the caller (Ofcom). Some of the newer tools also skip the network filters that block ordinary spam.
Spoofing moved when landlines were blocked. Ofcom's caller-ID guidance that took effect in January 2025 requires providers to block calls from abroad which imitate UK landline numbers, aside from limited legitimate cases. Ofcom has since said it is very likely that a significant volume of calls now imitate UK mobiles instead, using the routes that carry calls from people who are genuinely roaming. The July 2027 change, marking unverified overseas "UK mobile" calls as withheld, is aimed at that gap. Until a call can be checked, the number on the screen is a claim.
Business sender names are widely abused. Texts that show a name rather than a mobile number travel on application-to-person routes used by real companies. Ofcom found the controls uneven: in the 7726 sample above, about 65% of the scam texts with a sender name used a fabricated or obscure name. From 15 July 2027, mobile operators and the aggregators who carry these messages must do know-your-customer checks and must check sender names against the business they have actually onboarded.
Bulk texts still come from SIM farms. A SIM farm holds many SIMs and sends huge volumes of person-to-person messages, or uses those SIMs to open online accounts. The Crime and Policing Act 2026, which received Royal Assent in April 2026, makes possession or supply of a SIM farm without a legitimate reason a criminal offence (Ofcom, July 2026, citing the Home Office). Ofcom's own rules on pay-as-you-go volume limits, and on blocking numbers and links that have been reported, take effect on 18 January 2027.
SMS blasters bypass the network entirely. An SMS blaster is a fake mobile mast, often in a vehicle. Nearby phones attach to it, and the text never passes the real network's filters. City of London Police recorded the first known UK seizure in May 2024, at the Trafford Centre: the device was sending Royal Mail-style texts, and the phones in the van held 7,859 compromised card details. The operator was sentenced on 28 August 2026 to three years and eight months (City of London Police). A related case produced a four-year sentence in June 2026 for supplying equipment used to send fake HMRC texts. Because these messages skip the network, 7726 reports and personal caution still matter after the filters improve.
Parcel texts are carrying malware, not only fake pages. The NCSC's missed-parcel guidance describes apps that steal banking details and then message your contacts. "Duty unpaid" and "address incomplete" are the same approach with a different sentence. Around delivery peaks the volume rises because more people are genuinely expecting a parcel.
Artificial voices are now an operational tool. National Trading Standards, on 5 February 2026, reported clones built from survey calls and used to authorise direct debits, and a separate loft-insulation fraud that used avatar software with British accents to hide an overseas call centre. That operation was linked to 300 million scam calls since February 2025. NTS blocked nearly 21 million scam calls and shut down 2,000 numbers in a six-month period. The practical effect for you is that a convincing voice, a local accent, and a few true facts about your home or health no longer identify the caller.
QR codes have joined links. The NCSC accepts screenshots of suspicious QR codes at [email protected], because the code is only a disguised address. A code on a parking notice, a parcel card or inside a text is safe only when you already know the destination.
Criminals also stack the channels. A text says the bank will call. The call shows a spoofed number. The person on the line knows your postcode. Each piece is weak on its own, and together they are the social-engineering pattern in the previous section. The counter is still to place your own call on a published number.
Why criminals keep doing it
They do it because a cheap message can produce a large payment, and the person who sends the text is often not the person who receives the money. Telecommunications started 17% of authorised push payment cases in 2025 and 28% of the losses, so phone and text scams are a smaller share of cases than online scams and a larger share of the money when they succeed (UK Finance, 2026). The same call can collect data that is sold and reused.
The economics favour the sender:
| Advantage to the criminal | What it means in practice |
|---|---|
| Scale | SIM farms, SMS blasters and internet calling make millions of attempts cheap. NTS linked one insulation campaign to 300 million calls |
| You authorise the payment | An authorised push payment looks, to the banking system, like a payment you chose. That is harder to stop in flight than a stolen card used without you |
| High value on the phone | Bank and police impersonation is a smaller set of cases than purchase scams, and the losses per case are much higher. Police and bank impersonation alone was £55.5 million in 2025 |
| Data has a second sale | A date of birth, a health detail or a cloned voice is used by the next gang. NTS described exactly that handover |
| Distance | Many of the calls Ofcom is now blocking are placed from abroad, which slows identification and prosecution |
| The money moves on | UK Finance is explicit that reimbursement does not recover the funds from organised crime. The Dedicated Card and Payment Crime Unit's £273 million of prevented fraud in 2025 is the scale of the business being interrupted |
Fraud is also where the volume of crime now sits. The National Crime Agency's estimate, cited by Ofcom, is that fraud is 45% of reported crime incidents in England and Wales. A nuisance sales call and a fraud are different offences, and the people making the fraud calls are paid because a minority of recipients do authorise a transfer. Your refusal is the point at which that sum stays in your account.
There is a second motive that is easy to miss. Some calls exist to confirm that a number is answered, or to collect the personal details that make a later impersonation work. A lifestyle survey that asks about medication, income and who you bank with is the first stage National Trading Standards described, not a harmless poll. Ending that call is worth as much as refusing a payment.
What regulators and networks have done
Rules against unwanted and dishonest calls have been tightened in stages since the Telephone Preference Service became a statutory register in 1999, and the latest measures target spoofed numbers and bulk texts. From January 2025, phone companies have had to block calls from abroad that imitate UK landline numbers, and from 15 July 2027 calls from abroad that imitate UK mobiles should arrive with the number withheld unless the network can verify them (Ofcom). Marketing penalties have risen in parallel: on 5 February 2026 the ICO gained the power to fine PECR breaches by up to £17.5 million or 4% of global turnover (ICO).
The work is split, which is why the right place to report a problem depends on what the call was doing.
| Body | What it is responsible for |
|---|---|
| ICO | Live and automated marketing calls, and marketing texts, under PECR. The TPS and Corporate TPS are the opt-out lists it enforces |
| Ofcom | Numbers, caller ID, silent and abandoned calls, and the duties on phone companies to block spoofing and scam messages. Persistent misuse can draw a penalty of up to £2 million |
| Payment Systems Regulator | Mandatory reimbursement for eligible authorised push payment fraud on Faster Payments and CHAPS |
| FCA | Authorisation of financial firms, and the Warning List of clone and unauthorised firms |
| Report Fraud and Police Scotland | The crime report for fraud and cyber crime. Report Fraud replaced Action Fraud on 4 December 2025 for England, Wales and Northern Ireland |
| Stop Scams UK and the banks | 159, and the industry controls that sit alongside regulation. UK Finance runs Take Five |
| NCSC | Advice on phishing, malware and reporting malicious links and QR codes |
| National Trading Standards | Enforcement against mass call operations, including number blocking and voice-cloning cases |
| When | What changed |
|---|---|
| 1999 | The Telephone Preference Service became a statutory opt-out for live marketing calls to individuals |
| 2003 | PECR set the rules for marketing calls and texts. The Communications Act 2003 gave Ofcom persistent-misuse powers, including a penalty of up to £2 million for silent and abandoned calls |
| 2018 | Cold calls about claims management needed consent, and directors could be held liable for serious marketing breaches (ICO account of the PECR amendments) |
| 2019 | Cold calls about pensions were banned except for narrow cases involving trustees, managers or FCA-authorised firms (PECR regulation 21B) |
| 2021 | Stop Scams UK launched 159. Ofcom supports the short code. More than a million calls have been made to it |
| Ongoing | Ofcom's Do Not Originate list records inbound-only numbers, such as some bank and public-body lines, so providers can block outbound calls that pretend to come from them. Blocking depends on the route, and it is not a guarantee |
| 7 October 2024 | PSR reimbursement became mandatory for in-scope authorised push payment fraud. The cap is £85,000 per claim |
| January 2025 | Ofcom's updated caller-ID guidance: block calls from abroad that spoof UK landline numbers, with limited legitimate exceptions |
| 4 December 2025 | Report Fraud replaced Action Fraud |
| 5 February 2026 | PECR maximum fine rose from £500,000 to £17.5 million or 4% of global turnover, under the Data (Use and Access) Act, which the ICO confirmed that day |
| April 2026 | The Crime and Policing Act 2026 received Royal Assent. Possession or supply of SIM farms without a legitimate reason is a criminal offence |
| 15 July 2026 | Ofcom published the mobile-messaging rules and the overseas UK-mobile spoofing measure |
| 18 January 2027 | Person-to-person rules take effect: volume limits on pay-as-you-go SIMs, and blocking of numbers and links identified from scam reports |
| 15 July 2027 | Business-text rules take effect, including checks on sender names. Unverified calls from abroad that imitate a UK mobile should display as withheld |
Networks already stop a large volume before it reaches a handset. Ofcom says major providers block around 1% of all calls entering their networks as suspected scam or nuisance calls, and industry scam-detection tools were blocking on the order of 50 million text messages a month in early 2025, which Ofcom describes as 600 million or more a year. That still leaves the calls and texts in the February 2026 survey: 37% of phone users with a suspicious call, and 40% of mobile users with a suspicious message, in a three-month window. The filters reduce the flood. They do not identify every criminal who has a genuine UK SIM, an SMS blaster, or a convincing voice.
Ofcom has set this programme in the context of the Home Office Fraud Strategy 2026 to 2029. The part you can use immediately is unchanged by the next commencement date: hang up, and call back on a number the other party does not get to choose.
Ready to create your number?
Submit a free request and we'll email matching options within a few working days.
Frequently Asked Questions
Should I register with the TPS if the calls are scams rather than sales?
Register for live sales calls, and use other steps for fraud. The Telephone Preference Service is the legal opt-out for unsolicited live marketing, and it can take up to 28 days to take effect (Ofcom). It does not bind criminals. National Trading Standards found that 90% of people targeted by one 2025 insulation scam were already on the register. Add 7726 reports, 159, and a habit of calling back on a published number.
Should I call 159 about a delivery or a tax text?
Use 159 when the message concerns your bank. Stop Scams UK launched it in 2021 so you can reach your own bank, and it covers more than 99% of UK retail current accounts. For a parcel or tax text, open the carrier's tracking page or your Government Gateway from an address you type yourself. 159 does not connect you to Royal Mail or HMRC, and 159 will never call you.
Should I trust a text because the sender name is my bank?
Treat the name as a label the sender chose. Ofcom's review of 7726 reports found that about 65% of a sample of 137 scam texts with an alphanumeric sender name used a fabricated or obscure business name (Ofcom, 2026). Open your bank's app, or dial 159, and leave the link unused. A familiar name is one of the things the message is trying to copy.
Should I move money if the caller already knows my date of birth and address?
Keep the money where it is and call your bank on 159 or the number on your card. Date of birth, address and recent orders circulate in old breaches and in material people post online, and National Trading Standards has described surveys that collect health and financial details for later fraud (February 2026). A caller who recites those facts has shown you they prepared. That is a reason to leave the call.
Should I read out a one-time passcode to cancel a payment they say is fraudulent?
Keep the code to yourself and type it only into an app or site you opened. The code authorises the login or payment the other person has started. UK Finance's category for police and bank impersonation, including the safe-account script, still accounted for £55.5 million of losses in 2025. Hang up and call 159 if the story was about your bank.
Should I install an app so the caller can secure my account?
Leave the software uninstalled and end the call. Remote-access tools and fake "delivery" apps give another person a route to your accounts and your contacts. The National Cyber Security Centre's missed-parcel guidance warns that this kind of app can steal banking details and then text people you know. If it is already on the phone, stop using that phone for banking and call the bank from a different phone.
I paid a customs fee by card. Do the bank-transfer refund rules apply?
Ask the card firm to dispute the payment. The Payment Systems Regulator's mandatory reimbursement rules cover UK Faster Payments and CHAPS, not card payments, and they cap an eligible claim at £85,000 (PSR). Those rules apply to transfers made on or after 7 October 2024. Report the crime to Report Fraud, or to Police Scotland on 101, and keep the text so you can show the link you used.
Should I delete the text before I report it?
Keep it until you have forwarded it. The National Cyber Security Centre says most networks let you forward a suspicious text free to 7726, and the provider can then investigate the sender. Note the sending number first if the forward does not include it. Once 7726 has the message, you can delete the thread. If you lost money, keep a screenshot for the bank and for the crime report.
Should I answer calls from UK mobile numbers I do not recognise?
Let unknown numbers go to voicemail unless you are expecting a call. Ofcom's February 2026 research found that 24% of phone users were likely to pick up an unrecognised UK mobile, compared with 8% for an international number, which is why a spoofed 07 display works. Listen to any voicemail, then return the call on a number you look up. From 15 July 2027, many overseas calls that imitate a UK mobile should appear as withheld instead.
Should I print my personal mobile on the van and the website?
Put a separate number on anything the public can see, and keep banking texts and one-time codes on a number you do not publish. Anyone who can read the van can call and text that line, which is a common start for impersonation. A Create Numbers mobile is a normal UK 07 number, so it can still be spoofed and it will still receive spam. The gain is separation. Set that up when you create a mobile number.
Should I send a voice note or a photo of my driving licence to a caller?
Refuse, and share documents only inside a service you opened yourself. Police Scotland warns that a public clip of your voice can be copied into a clone, and National Trading Standards has reported clones used to fake consent for direct debits (February 2026). A photo of a licence or a boarding pass carries your date of birth and other identity details. Ask the organisation what it needs by using the contact route on its own website.
The caller says they are the police and a courier is outside. Should I hand over the cash?
Keep the cash and the cards, and close the door. Ofcom's own examples of fraudulent calls include someone claiming to be the police or Action Fraud who tells you to withdraw cash and give it to a courier (Ofcom survey, 2026). Police and banks do not collect cards or cash this way. Call 999 if you feel unsafe or the person will not leave, then call your bank on 159.
I lost no money. Should I still report the call or text?
Report it. Forward a text, or send the calling number, to 7726 so your network can block it, and send marketing calls to the ICO and silent calls to Ofcom. Ofcom estimates that about 100 million suspicious messages were reported through 7726 in the year to April 2025. A report to Report Fraud still helps, because the service exists to build a national picture of fraud. In Scotland the crime-report route is 101.
Will caller ID be safe to trust once the 2027 rules start?
Use caller ID as a hint, and call back on a published number whenever money or a code is involved. From 15 July 2027, Ofcom expects calls from abroad that imitate a UK mobile to show as withheld unless a network can verify them. Major providers already block about 1% of calls entering their networks as suspected scams. A criminal can still call from a genuine UK SIM.