UK scam calls one year on: Ofcom traceback, SIM farm arrests and O2 blocking

• Ofcom has started a trial to trace scam calls back through the provider chain. Under the trial, announced on 3 November 2026, UK providers can get a formal request with a deadline of 1 to 2 working days, and Ofcom says a late or incomplete answer can lead to an investigation and “a significant financial penalty”.
• SIM farms became a criminal offence on 29 October 2026. On 3 November, VodafoneThree said intelligence it shared with the National Crime Agency helped lead to eight arrests.
• O2 now blocks suspected scam calls on its network for all customers, using Hiya’s technology, and expects to block more than 3 million scam calls a week.

These changes make one gap clearer. Spoofing controls catch fake caller IDs, but a SIM farm call comes from a real SIM with a real UK number. Once the caller ID is genuine, what’s left to judge is the number’s reputation: how it has behaved and what people have reported about it.

Ofcom’s call traceback trial

Ofcom published the details on 3 November 2026 in Call traceback: trialling faster processes to identify the sources of scam calls. It is a proof of concept, and Ofcom expects it to last “several months”, with a first review of progress early in 2027.

How a traceback request travels

Ofcom starts from intelligence about a suspected scam call. It will normally send the first request to the terminating provider, asking which provider it received the call from. In parallel, it may ask the range holder or sub-allocatee of the number shown as the caller ID whether the call came from their customer.

If it didn’t, Ofcom keeps asking each upstream provider until it reaches one of three points:

1. The originating provider.
2. The provider that brought the call into the UK.
3. A provider that fails to respond.

Ofcom says it will go step by step through the chain, even where its intelligence already points at the provider that originated the call.

The deadline and the penalty

For the trial, Ofcom is starting with formal information requests under section 135 of the Communications Act 2003. In Ofcom’s words, the requests “will have a short deadline of 1-2 working days”, because providers may not keep call data for long. Requests are issued in final form, not as drafts.

If a provider doesn’t give a clear, complete and accurate answer by the deadline, Ofcom says it “may open an investigation into a provider’s failure to comply”, which “may result in a significant financial penalty”.

What Ofcom sends and what it asks for

Ofcom says this format may change as the trial develops.

Watch for fake requests

Scammers have already sent fake traceback emails in the US. The Industry Traceback Group still carries a live notice that fraudulent emails are impersonating it, and that official ITG requests come only from the tracebacks.org domain. Ofcom’s page gives UK providers a simple check: genuine requests, formal or informal, “will always arrive from an @ofcom.org.uk address”.

How to get ready

Ofcom’s own advice to providers comes down to four steps:

• Treat any request as urgent and note the deadline.
• Preserve the requested call data straight away so it isn’t lost.
• Name a person or a dedicated mailbox to receive requests, and tell Ofcom who it is.
• Check how long your systems keep call records, and how quickly you can preserve the data for a specific call.

If you already answer US traceback requests from the Industry Traceback Group, much of this will look familiar. The difference is that in the UK the regulator sends the request itself, under its statutory powers.

What the charter promised a year ago

On 5 November 2025 the Home Office announced the second telecoms fraud charter with the UK mobile networks (GOV.UK, Spoofed numbers blocked in crackdown on scammers). The announcement said the biggest networks “committed to upgrade their network within the next year to eliminate the ability for foreign call centres to spoof UK numbers”. Fraud Minister Lord Hanson said “call spoofing will be eliminated within a year”.

In its six month update to Parliament on 20 May 2026, the Home Office said “Commitments made under the charter are on track” (Hansard, Telecoms Fraud Charter). As of 9 November 2026 we couldn’t find an official statement saying the spoofing upgrade is complete. Ofcom links its traceback trial directly to the commitments providers made under the charter.

Ofcom has also set a separate rule for calls from abroad that show a UK mobile number. From 15 July 2027 those calls will show as withheld unless they can be verified (Ofcom statement, Tackling scam calls from abroad, 15 July 2026).

SIM farms are now a crime

Sections 151 to 153 of the Crime and Policing Act 2026 came into force on 29 October 2026 (SI 2026/960, regulation 5). Possessing a SIM farm is now an offence unless you can show a good reason or lawful authority, and supplying one is an offence unless the supplier meets the Act’s checks.

The Act defines a SIM farm as “a device which is capable of using five or more SIM cards simultaneously or interchangeably” for making calls or sending texts, or another article named in regulations.

Eight arrests from shared network intelligence

On 3 November 2026, VodafoneThree said that intelligence it shared with the National Crime Agency and City of London Police, through “a new proof of concept”, helped locate and disrupt criminal SIM farm operations. According to the release, law enforcement “has so far arrested eight people, seized SIM farm equipment and cash, and recovered more than one million compromised card details”.

The release describes SIM farms as collections of SIM cards, “sometimes scaling to hundreds or thousands”, used “to route massive volumes of automated calls and text messages”. The NCA’s Nick Sharp called them “a key enabler of large-scale fraud”.

Why SIM farms get past spoofing checks

Spoofing rules ask one question: is this caller really allowed to show this number? A SIM farm call passes that test, because the number belongs to a real SIM on a UK network. The caller ID is genuine. It is the behaviour behind it that gives the scam away, such as short calls in high volume, a burst of new numbers, and complaints from the people who were called.

O2 now blocks suspected scam calls on its network

On 30 October 2026, Virgin Media O2 announced that it now blocks suspected scam calls for all O2 customers, free of charge. The system uses Hiya’s technology, and O2 expects to block more than 3 million scam calls a week “before a customer’s phone even rings”.

O2 shared two figures from its trial. 60% of blocked calls were followed by repeat attempts within a minute, and on average a fraud labelled number attempted three times as many calls after it had been blocked as before. O2 describes itself as “the first UK operator to block all calls suspected as scam”.

If you make legitimate calls to UK mobiles, this changes things for you. A number that used to get a warning label can now be blocked before it rings.

Robocall complaints hit a five year high

The complaint numbers match the same picture. On 9 October 2026 the Information Commissioner’s Office said public complaints about automated nuisance calls rose from 1,374 in July to 2,178 in August, then to 3,684 in September, the highest monthly total since 2021.

Which? reported on 5 November 2026, citing wider ICO data, that nuisance call complaints about mobiles rose more than 170%, from 1,923 in May 2026 to 5,202 in October, while landline complaints stayed broadly stable (1,707 to 1,644). The growth is on mobiles, which is where UK networks, MVNOs and call blocking sit.

That rise sits next to the SIM farm ban and O2’s network blocking. Spoofing rules make fake UK numbers harder to use, yet complaints about nuisance calls to mobiles are still climbing.

Real SIMs leave number reputation as the last check

Put the three stories together and the direction is clear:

• Spoofing is getting harder. The charter upgrade and Ofcom’s withheld CLI rule target fake UK caller IDs on calls from abroad.
• Scammers move to real numbers. SIM farms exist to supply genuine numbers in bulk, and the new offence and the VodafoneThree case show that police and networks now treat that supply as a target.
• Networks act on reputation. O2 now blocks calls it judges to be scams rather than only labelling them.

When the caller ID is real, the useful question is no longer “is this number spoofed?”. It becomes “how has this number behaved, and what have people reported about it?”. That question matters to both sides:

• Providers and MVNOs want to stop scam calls before they reach a subscriber, and to carry less of the traffic that leads to a traceback request.
• Businesses calling UK mobiles need to know if one of their own numbers has picked up a scam label before a network starts blocking it.

Where CallerAPI fits

To be clear about what CallerAPI doesn’t do: it doesn’t run tracebacks, and it doesn’t answer Ofcom requests for you. Those requests ask for your own call records, and only you can provide them.

What CallerAPI does is the reputation check:

• Robocall scoring API: check a caller’s number before you connect or pass on the call. It covers numbers in 195 countries, including the UK, and returns a spam flag and a score from 0 to 100, so you can block, label or let the call ring by your own rules.
• Spam phone number database: a feed of numbers reported for spam and scam calls in a 15 day rolling window, for carriers and MVNOs that want to block or label at the network edge.
• DID reputation monitoring: add your outbound numbers and get told by email or webhook when one is flagged, so you can pause or replace it early.

To see what a single number looks like right now, run it through the free caller ID test. No signup needed.

FAQ

What is Ofcom’s call traceback trial?

It’s a proof of concept Ofcom announced on 3 November 2026. Ofcom sends formal information requests to each provider in a call’s path, one step at a time, until it reaches the originating provider, the provider that brought the call into the UK, or a provider that doesn’t respond.

How long do providers have to answer an Ofcom traceback request?

Ofcom says requests “will have a short deadline of 1-2 working days”. A late or incomplete answer may lead to an investigation and a significant financial penalty.

How can I tell a real Ofcom traceback request from a fake one?

Ofcom says every genuine traceback request, formal or informal, will come from an @ofcom.org.uk address.

Is it illegal to own a SIM farm in the UK?

Since 29 October 2026, possessing a SIM farm is an offence under the Crime and Policing Act 2026 unless you can show a good reason or lawful authority, and supplying one is an offence unless the supplier meets the Act’s checks. The Act defines a SIM farm as a device that can use five or more SIM cards simultaneously or interchangeably for calls or texts. If you run multi SIM equipment for a legitimate purpose, get legal advice.

Does O2 block spam calls as well as scam calls?

O2’s announcement covers calls suspected as scam. The same Virgin Media O2 release says suspected spam calls “will continue to be flagged” rather than blocked.

Can CallerAPI answer Ofcom traceback requests for me?

No. A traceback request asks for your own call records and routing. CallerAPI helps earlier on, by scoring numbers so fewer scam calls get through your network.