Ofcom Consultation on combatting mobile messaging scams - Which? response

Summary

Which? welcomes the opportunity to respond to Ofcom’s consultation on combatting mobile messaging scams. Mobile messaging scams are pervasive: mobile users reported an estimated 100 million suspicious messages to mobile operators through the 7726 service in the year to April 2025. Mobile messaging scams are also very harmful, accounting for approximately £65 million per year in consumer fraud losses. 

While Which? welcomes Ofcom’s intervention in this space, we believe that the regulator must go further in a number of areas in order to properly tackle mobile messaging scams. In particular:

• Volume limits: Ofcom should provide guidance on an acceptable SMS volume limit and on an acceptable reset period for SMS volume limits.
• Information sharing: Ofcom should mandate that operators not only have processes in place to receive scam reports, but also that they proactively seek scam intelligence from third parties. Ofcom should also mandate that operators have to share scam intelligence received from their users with other operators.
• Know Your Customer checks: Ofcom should update its guidance to require enhanced due diligence checks for customers who are based in high risk countries. Providers should also conduct enhanced checks on customers whose IP address does not correspond to the stated location of their business.
• Sender IDs: Ofcom should introduce a mandatory Sender ID registry to combat fake Sender IDs, as this will be more effective than Ofcom’s current solution.
• Know Your Traffic checks: Ofcom should update its guidance to state that, when providers do not receive a response from business senders to a request for clarification on a suspicious communication, they should infer that the communication was fraudulent and prevent that sender from sending further messages.
• Cross-cutting measures: Ofcom should oblige providers to make consumers aware of their right to alternative dispute resolution if they wish to contest a provider’s decision, such as blocking messages.
• A drafting amendment to proposed Condition C9.3 to strengthen the duty to prevent scam messages being sent and/or received. It is not sufficient that processes should only be ‘designed’ to achieve the desired effect, so this word should be removed.