Ofcom's New SMS Scam Rules: What Businesses Need to Know

Written By Kenneth Rees

On 15 July 2026, Ofcom published its final decision on new rules to combat mobile messaging scams in the UK.

The regulations, introduced through General Condition C9, establish stronger requirements for mobile network operators and business messaging aggregators to prevent fraudulent messages from reaching consumers.

For businesses that rely on SMS to communicate with customers, the changes are significant. Greater scrutiny of sender identities, stronger customer verification and ongoing monitoring of messaging activity will become increasingly important throughout the UK messaging supply chain.

The rules will be introduced in stages during 2027. Although the primary legal obligations fall on regulated communications providers, businesses using application-to-person (A2P) messaging should understand how the requirements may affect their messaging arrangements, brand protection and customer communications.

This article explains what Ofcom has introduced, who is affected, and how businesses can prepare for the new requirements.

Contents

Why Has Ofcom Introduced New SMS Scam Regulations?

SMS remains an important communication channel for businesses. Banks use it to send security alerts, healthcare providers issue appointment reminders, and retailers communicate delivery updates. Customers are accustomed to receiving legitimate messages from organisations they recognise.

Criminals exploit that familiarity.

By impersonating trusted brands, fraudsters can send messages that appear to come from banks, delivery companies, parking providers or government organisations. These messages often direct recipients to fraudulent websites designed to collect personal information, login credentials or payments.

The practice, commonly known as smishing, has become a persistent problem for both consumers and businesses.

Ofcom's July 2026 statement provides a clear indication of the scale of the problem.

40%

of UK mobile users

Reported receiving a suspicious mobile message in the preceding three months, according to Ofcom's February 2026 research.

600m+

suspected scam messages

Estimated to be blocked annually by mobile operators using network-level detection.

Source: Ofcom, Combatting mobile messaging scams, July 2026

Despite existing filtering and fraud prevention measures, Ofcom identified gaps in the protections applied by different operators and aggregators. In particular, criminals have been able to exploit weaknesses in business onboarding procedures, sender identification and the monitoring of messaging traffic.

The new rules are intended to address those weaknesses before fraudulent messages reach consumers.

For legitimate businesses, there is a second concern. When customers cannot distinguish genuine messages from impersonations, trust in SMS communications deteriorates. A fraudulent message using a company's name can damage customer confidence even when the company itself has not experienced a security breach.

What Is General Condition C9?

General Condition C9 is a new set of regulatory requirements designed to reduce scam mobile messages across UK communications networks.

It forms part of Ofcom's General Conditions of Entitlement, which establish obligations for communications providers operating within the UK telecommunications market.

The new condition introduces measures covering both person-to-person (P2P) and application-to-person (A2P) messaging.

P2P messaging generally involves messages exchanged between individuals, while A2P messaging covers messages sent by businesses and organisations through messaging platforms, aggregators or other communications providers.

The distinction matters because criminals can exploit both channels, but the methods used to prevent fraud are different.

When do the new rules take effect?

15 July 2026

Published

Ofcom publishes its final statement and decisions.

18 January 2027

Upcoming

New P2P messaging requirements take effect.

15 July 2027

Upcoming

New A2P messaging requirements take effect.

Implementation dates confirmed in Ofcom's July 2026 statement, Combatting mobile messaging scams .

Combatting mobile messaging scams

For organisations using business SMS, 15 July 2027 is the particularly relevant deadline, as the A2P rules address the controls applied to commercial messaging services.

However, businesses should not assume that they can wait until the implementation date before taking action. Communications providers may need to review their customer records, onboarding arrangements and sender ID policies in advance.

What Are the New Ofcom SMS Scam Rules?

Ofcom's new framework addresses several areas where criminals have previously been able to exploit weaknesses in the mobile messaging supply chain.

1. Stronger Know Your Customer (KYC) checks

Mobile operators and messaging aggregators will be required to conduct effective due diligence when onboarding customers using A2P messaging services.

Know Your Customer checks help providers establish who is using their services and assess whether the customer presents a potential fraud risk.

This is particularly relevant where businesses access SMS services through intermediaries rather than contracting directly with a mobile network operator.

A messaging provider may need to establish the identity of the organisation, understand its intended use of messaging services and examine information relevant to the sender identities it wants to use.

For legitimate businesses, this could mean supplying clearer evidence of their identity and authority to send messages under particular brand names.

2. Greater protection against SMS sender ID spoofing

An SMS sender ID is the name or number displayed as the sender of a text message.

Businesses frequently use alphanumeric sender IDs, such as a company name, to make their messages recognisable. Unfortunately, criminals can also attempt to use those names to impersonate legitimate organisations.

Ofcom's new rules require relevant providers to take measures to prevent the use of fake alphanumeric sender IDs.

These measures include corroborating sender IDs against information obtained through customer verification and maintaining policies that restrict the use of protected and generic sender IDs.

This is an important development for brand protection.

A company may operate a legitimate SMS service while criminals elsewhere in the messaging supply chain attempt to send messages using an identical or misleadingly similar identity.

Stronger sender verification is intended to make that impersonation more difficult.

However, the rules should not be interpreted as a guarantee that every fraudulent message will be blocked or that every sender ID will be authenticated through a single national registration system.

3. Ongoing Know Your Traffic monitoring

Customer verification at the point of registration is only one part of the process.

Ofcom is also introducing requirements for ongoing Know Your Traffic (KYT) checks.

These controls are designed to help providers identify suspicious activity after a customer has been granted access to messaging services.

For example, an account that normally sends appointment reminders might suddenly begin transmitting unusually high volumes of messages containing unfamiliar payment links.

Such activity could warrant further investigation, depending on the circumstances and the provider's monitoring arrangements.

The new rules require relevant providers to review account activity and promptly investigate fraud reports.

This approach recognises that an account considered legitimate during onboarding may subsequently be compromised or misused.

4. Stronger incident management and message blocking

Where scam activity is identified, providers must have processes for responding.

For A2P messaging, these include measures to block fraudulent senders and address compliance failures involving other providers.

Ofcom is also requiring relevant operators to identify and block scam messages in transit using information about fraudulent URLs and telephone numbers obtained through reports from customers and third parties.

These measures are intended to prevent known fraudulent activity from continuing across communications networks.

Importantly, Ofcom has also recognised the risk of legitimate messages being blocked incorrectly.

Providers will be required to identify, monitor and address instances of erroneous blocking, alongside maintaining appropriate policies, records and procedures for challenging blocking decisions.

This distinction matters to businesses that depend on SMS for time-sensitive communications, including authentication codes, payment notifications and operational alerts.

The objective is to reduce fraudulent traffic while limiting unnecessary disruption to legitimate messaging.

What Do Ofcom's New Rules Mean for Mobile Networks and CPaaS Providers?

Although the regulations are intended to protect consumers, their operational impact will be felt across the business messaging supply chain.

Mobile network operators, aggregators and Communications Platform as a Service (CPaaS) providers may need to reconsider how they verify businesses, approve sender identities and investigate suspicious traffic.

Mobile network operators

For mobile networks, the new requirements place greater emphasis on preventing fraudulent traffic from entering or passing through their infrastructure.

Operators should assess whether their existing systems provide sufficient visibility into the identity of messaging customers, the sender IDs they use and the activity associated with those accounts.

This may involve reviewing:

  • Business onboarding and identity verification procedures.

  • Policies for protected and generic sender IDs.

  • Monitoring arrangements for suspicious messaging activity.

  • Fraud reporting and incident escalation processes.

  • Audit records and procedures for addressing incorrect blocking decisions.

Where networks depend on aggregators to originate commercial messaging traffic, the quality of upstream verification becomes particularly important.

An operator receiving traffic from an established commercial partner still needs confidence that appropriate checks are taking place throughout the relevant messaging arrangements.

CPaaS providers and messaging aggregators

For CPaaS providers, the regulatory implications depend on the services they provide and whether they fall within the scope of the relevant General Conditions.

Ofcom distinguishes between messaging service providers that offer software interfaces and aggregators that provide regulated communications services. A business offering both types of service may have direct regulatory obligations in its capacity as an aggregator.

For providers within scope, effective onboarding and ongoing verification will be essential.

The challenge is maintaining suitable checks without creating unnecessary delays for legitimate customers.

A CPaaS provider handling thousands of enterprise messaging accounts may need a repeatable process for confirming business identities, reviewing sender IDs, documenting decisions and investigating suspicious activity.

Manual verification alone can become difficult to manage at scale, particularly where different customers present different risk profiles.

This creates a practical case for automated business verification supported by human review when necessary.

Why Brand Verification Matters Under General Condition C9

One of the most significant aspects of Ofcom's new approach is its emphasis on establishing who is responsible for sending messages.

Traditional SMS fraud prevention has relied heavily on detecting suspicious content and traffic patterns.

These controls remain valuable, but they generally operate after an organisation has gained access to messaging services.

Business and brand verification provide an additional opportunity to identify risks earlier.

Consider a hypothetical example.

A company applies to a messaging provider for permission to send SMS messages using the sender ID of a well-known financial institution.

The applicant provides business registration details and a website. At first glance, the application appears legitimate.

However, further investigation reveals that the company was recently incorporated, its website does not match the organisation it claims to represent, and there is no convincing evidence that it is authorised to use the requested sender identity.

Without effective verification, the application could be approved and fraudulent messages could enter the messaging network.

With appropriate checks, the provider can identify the inconsistencies and request additional evidence before permitting the sender ID.

This is where Know Your Business (KYB), Know Your Customer (KYC) and Open Source Intelligence (OSINT) can work together.

The difference between KYB, KYC and sender verification

Verification method What it establishes
KYB Whether a business exists and whether its registration and corporate details are credible.
KYC The identity of the customer or relevant individuals associated with an account.
Sender ID verification Whether an organisation is authorised to use a particular sender identity.
OSINT analysis Additional publicly available information that may help identify inconsistencies or fraud risks.

These checks serve different purposes.

A business can be legally registered without being authorised to use another organisation's name. Equally, a legitimate company can become a fraud risk if its messaging account is compromised.

Effective verification therefore requires more than checking a company number against a public register.

For a more detailed explanation, read Brand Assure's article on the differences between KYB, KYC and telecom sender verification.

How Brand Assure Can Support Stronger Messaging Verification

Brand Assure provides business and brand identity verification technology designed for mobile network operators and CPaaS providers.

Its platform combines multiple verification methods to help organisations assess whether businesses and messaging identities are legitimate.

The technology is relevant to several of the challenges highlighted by Ofcom's new framework, particularly customer due diligence, sender identity validation and maintaining evidence of verification decisions.

Multi-source business verification

Brand Assure combines KYB, KYC and OSINT checks to assess business identities using information from multiple sources.

This allows providers to examine more than a customer's submitted registration details.

Configurable risk thresholds help determine whether an application can be approved, rejected or referred for further investigation.

Automated workflows and audit trails

Verification processes can generate significant administrative work, especially for providers handling large numbers of enterprise customers.

Brand Assure supports automated checks, configurable approval workflows and records of verification decisions.

These capabilities can help providers maintain consistent processes and retain evidence of how an identity assessment was reached.

Continuous monitoring and risk assessment

Business verification should not necessarily end once an account has been approved.

Brand Assure provides monitoring capabilities, audit trails and anomaly alerts that can help organisations identify changes requiring further investigation.

These features can complement broader fraud prevention arrangements, including the traffic monitoring and incident management processes required under the new rules.

However, using a verification platform does not automatically establish compliance with General Condition C9. Regulated providers remain responsible for assessing their obligations and ensuring that appropriate operational and technical controls are in place.

For more information, explore Brand Assure's solutions for mobile networks and CPaaS providers.

How Should Messaging Providers Prepare for July 2027?

The A2P requirements take effect on 15 July 2027, giving affected organisations time to review their current processes and address gaps.

The most useful starting point is to establish how business identities and sender IDs are currently verified, and whether those processes are consistent across different customers and messaging routes.

A practical readiness assessment should cover five areas.

A2P messaging readiness checklist

0 of 5

Use this checklist to review your preparations for the July 2027 A2P messaging requirements.

Organisations should also consider how verification decisions are communicated between commercial, compliance and technical teams.

For example, a sender ID may be approved by an onboarding team but subsequently flagged by fraud monitoring systems. Without a clear process for sharing information, suspicious activity could remain unresolved longer than necessary.

Likewise, an incorrectly blocked message may require input from network operations, customer support and compliance staff before the issue can be resolved.

A well-documented verification process can help reduce these operational gaps.

The full regulatory requirements and accompanying guidance are available in Ofcom's official statement on combatting mobile messaging scams.

Frequently Asked Questions

  • General Condition C9 introduces requirements intended to prevent fraudulent mobile messages from being sent or received through UK communications networks. It covers areas including customer due diligence, sender ID verification, traffic monitoring, scam message blocking and incident management. The requirements apply to relevant mobile operators and business messaging aggregators, with different implementation dates for P2P and A2P messaging.

  • The new requirements for person-to-person messaging take effect on 18 January 2027. The requirements for application-to-person messaging, which covers business messaging services, take effect on 15 July 2027. Ofcom published its final regulatory statement on 15 July 2026. Providers should review the relevant conditions and guidance before their applicable implementation date.

  • The rules require relevant communications providers to take measures to prevent fake alphanumeric sender IDs, including checking sender identities against customer verification information and maintaining policies for protected and generic sender IDs. They do not establish a single universal sender ID registration requirement for every business. However, businesses may face additional verification requests from their messaging providers as those providers implement the new controls.

  • Know Your Business (KYB) focuses on establishing the identity and legitimacy of a company, including information about its registration and corporate structure. Know Your Customer (KYC) concerns the identity of the customer and relevant individuals. In business messaging, these checks can be combined with sender ID verification to assess whether an organisation is authorised to send messages using a particular brand identity.

  • Providers should begin by identifying their applicable regulatory obligations and reviewing their current customer onboarding, sender verification and fraud prevention processes. Particular attention should be given to business identity checks, ongoing traffic monitoring, incident response and record keeping. Automated verification tools can support these activities, but compliance requires appropriate policies, operational procedures and technical controls across the relevant messaging services.

Key Takeaways

Ofcom's July 2026 decision establishes a more consistent regulatory framework for preventing mobile messaging scams in the UK.

The changes introduce stronger requirements for verifying messaging customers, preventing sender ID impersonation, monitoring suspicious traffic and responding to fraud.

For mobile networks and messaging aggregators, the implications extend beyond technical filtering. Business identity verification and the ability to demonstrate how verification decisions were made are increasingly important parts of managing messaging fraud.

With the A2P requirements taking effect in July 2027, affected providers have an opportunity to review existing arrangements and identify where improvements are needed.

Prepare for Ofcom's New Messaging Requirements with Brand Assure

For mobile networks and CPaaS providers, preparing for the new rules begins with understanding whether existing verification processes are sufficient.

Brand Assure helps organisations strengthen business identity checks, validate sender information and manage verification decisions through configurable workflows.

If you're reviewing your current approach to brand verification or preparing for the new A2P messaging requirements, our team can discuss how Brand Assure's capabilities could fit within your existing processes.

Book a Discovery Call

Discuss your verification requirements with the Brand Assure team.

Kenneth Rees https://pixelhaze.studio
Next

KYB vs KYC vs Telecom Sender Verification: Key Differences