Ofcom and UK Phone Providers to Further Tackle Spoofed Calls UPDATE

The UK telecoms regulator, Ofcom, has today moved to strengthen their existing rules against the use of “fake phone numbers” and “spoofed calls“, which involves a proposal for phone providers (fixed line and mobile) to introduce stricter measures against “Presentation Numbers” that are used to identify who is making a call.

Most of the major broadband, phone providers and mobile network operators have already implemented technical measures to tackle Nuisance Calls and Scam Calls. But these aren’t always 100% effective and there are still plenty of operators that could do more.

In 2022 Ofcom moved to clampdown on this by requiring all telephone networks involved in transmitting calls – either to mobiles or landlines – to identify and block spoofed calls, albeit only “where technically feasible” to do so (here). The move was intended to improve the accuracy of Calling Line Identification (CLI) data, and the regulator also made it harder for scammers to access valid phone numbers by introducing additional checks.

However, scammers, such as those who make a call from abroad, can still spoof their number to make it look like the call is from a UK-based organisation, when in fact they are calling from another country (this is something that we suspect many of our readers will have experienced). The change today is designed to make that harder.

Ofcom’s Rule Extension

In this consultation, we are proposing to update our Calling Line Identification (CLI) Guidance to confirm that providers are expected to identify and block calls from abroad that use a UK geographic or non-geographic telephone number as a Presentation Number, except in a limited number of legitimate use cases.

This update should remove a loophole through which scammers can spoof a UK number from abroad (making it look like the call is coming from a UK-based organisation) and connect these calls to UK users.

Just to be clear. There are generally two numbers associated with an incoming call: the Network Number, which identifies where the call is being made from; and the Presentation Number, which identifies who is making the call. In most cases the Network and Presentation Number are the same, but there are some scenarios where a caller may wish to display a different number to the line the call is being made from (e.g. an outsourced call centre that makes calls on behalf of different businesses, or businesses which may wish to display a single number for outbound calls).

Ofcom has been working on ways of tackling the aforementioned problem, such as via CLI Authentication, for a while (here). But today’s update attempts to address this via a rule change, rather than via a specific technical solution like CLIa (that’ll probably come later, once everything has gone digital / IP-based).

The tricky part in all this stems from the inherent problem of implementing such changes without also over-blocking legitimate voice calls, which is easier said than done – particularly at a time when the UK is in the middle of a transition from analogue to IP-based (digital) phone services. As for those “legitimate use cases“..

The Exceptions

4.19 As the CLI represents the origin of a call, calls from abroad should not use UK CLI as a Network Number or as a Presentation Number, except in a limited number of use cases:

• UK mobile users roaming overseas making calls back to UK numbers, i.e. calls with a CLI from the +447 range;

• Calls to a mobile user who is roaming in the UK;

• Where the traffic has originated on a UK network;

• Where the traffic has originated from UK customers that are hosted on overseas nodes or cloud services.

Except in these use cases, calls from abroad using UK CLI should be blocked.

Aside from the risk that this may disrupt some legitimate calls, Ofcom also acknowledges that some scammers could move to spoofing UK mobile numbers instead. “We are doing further work to explore how to identify UK mobile users who are roaming abroad and, if we are able to identify a potential solution to validate legitimate roaming calls, we will consider consulting on these options in due course,” said the regulator’s consultation.

Ofcom intends to consult on all this until 28th March 2024, which means we may have to wait until later this year before they formally introduce the latest change.

UPDATE 3:37pm

By chance we noticed that Ofcom has also quietly opened an enforcement programme today related to tackling “phone and text scams“, which aims to “make sure that providers are following our rules and support best practice in relation to the use of phone numbers.” This wasn’t mentioned in their earlier consultation announcement.