Ofcom's New Scam Call Blocking Regulations: Implications for the UK Telecoms Market

July 2024

Telecoms & Connectivity

Elisha Sudlow-Poole

Senior Research Analyst

Globally, there are a lack of comprehensive robocall mitigation frameworks from regulators. Leading regulatory bodies, for example, the FCC (Federation Communications Commission) in the US, have deployed initiatives such as STIR/SHAKEN (Secure Telephone Identity Revisited/Signature-based Handling of Asserted Information Using toKENs) and RMD (Robocall Mitigation Database) that aim to authenticate and verify caller ID information. The STIR/SHAKEN framework has been in operation for approximately five years in the US, whilst the RMD is yet to be fully deployed in the country. Despite this, there has been no reduction in subscribers’ fraudulent losses to robocalling to date in the US.

This highlights that even the most sophisticated robocalling mitigation solutions are not yet successfully protecting phone users, with over 50% of the total monetary losses to fraudulent robocalls being attributed to the US this year.

But the problem of fraudulent calls is not unique to the US, and the problem extends beyond fraudulent robocalls, which only consider automated telephone calls which deliver pre-recorded messages to a large number of recipients. Other examples include both AI and human-driven nuisance and scam calls relating to tax, bank, utility, lottery, and health-related calls, to name a few.

This week, the UK telecoms regulator, Ofcom, announced that it has given phone providers (including both fixed and mobile) six months to implement more stringent measures to protect users against these nuisance and scam calls, including its CLI (Call Line Identification) and Call for Input. Whilst most major mobile network and broadband providers in the UK have already shown proactivity in implementing such measures, these are not always effective, with over 129 million fraudulent robocalls being received by UK subscribers alone in 2024.

Figure 1: Total Number of Fraudulent Robocalls Received by Subscribers in the UK (m), 2020-2024.

Source: Juniper Research

In response, nuisance and scam call prevention measures are being deployed by phone providers in the UK. For example, in July 2024, EE launched its Scam Guard subscription, which charges an additional £1 a month to its subscribers to help protect them against online threats. The solution offers spam and scam call labelling, dark web monitoring, and free access to EE’s Cyber Security Duo for three months:

·        Spam and Scam Call Labelling: Leverages an adaptive AI system to analyse aspects of a call in real-time to detect and notify subscribers of a potentially suspicious call.

·        Dark Web Monitoring: Alerts the subscriber when their personal information, including bank card details and email login details, appear on the dark web.

·        Cyber Security Duo: Offers real-time protection for up to two devices against viruses, malware and online threats. It also provides tools for strong password creation.

The aim of this Scam Guard solution is not only to protect EE subscribers against suspicious calls, but also to educate subscribers to better understand the technology they are using and what steps can be taken to better safeguard themselves.

However, in the UK telecoms market, the onus has not just been on the operators or broadband providers themselves to provide these scam and spam call mitigation solutions. Over the last six months, the UK government has been proactive in launching new national campaigns against online fraud. In February 2024, the UK government announced its ‘Stop! Think Fraud’ campaign, which leveraged advisory videos alongside a website with information on how to be protected from fraud. This campaign was part of a wider strategy launched by the UK government in May 2023 to stop scams and provide the public with an understanding on how to protect themselves against online and mobile scams. This was done by producing advice pages detailing scams to watch out for, including robocall fraud such as Wangiri fraud, number spoofing scams and coronavirus scam calls and texts.

Ofcom to Introduce Stricter Scam Call Blocking Initiatives

So, it seems that this latest announcement from Ofcom is the next step in its commitment to reduce fraudulent calls in the UK. But following this announcement, what is going to change?

Firstly, when considering an incoming call, there are generally two numbers associated with this call. These include the network number (where the call is being made from) and the presentation number (identifies who is making the call). In the majority of cases, these two numbers are the same, however, in some cases, for example when an outsourced call centre makes a call on behalf of a business, these numbers may be different.

With this, Ofcom is updating its CLI (Call Line Identification) guidance to extend call blocking to international calls, which display a UK number as a presentation number. This removes a potential loophole that historically allowed scammers to spoof a UK number from abroad. Whilst a number of telecoms providers such as BT have already implemented this voluntarily, Ofcom has given the UK industry until 29^th January 2025 to implement this solution.

Secondly, Ofcom has requested feedback on some proposed changes to its Calls for Input guidelines. The proposed change will require operators to block calls from abroad with +447 numbers. However, this has significant implications for legitimate UK roamers. Whilst proposed technical solutions to this includes providing an international gateway provider that proactively undertakes checks and identifying mobile calls coming from abroad, it is anticipated that Ofcom will consult further in Spring 2025.

Branded Calling to Add Additional Strategy for Scam Call Mitigation

In the meantime, Juniper Research anticipates that brand verification will be a key strategy to prevent fraud over the next few years. Whilst the imminent launch of RCS (Rich Communication Services) on iOS will provide brand verification capabilities to reduce instances of messaging fraud, branded calling will also be implemented for consumers to have a trusted way of communicating with a brand via phone calls.

To instil trust in who is calling, strategies such as caller ID authentication have previously been used. Caller ID authentication ensures that the caller is who they say they are. Branded calling is a new form of caller ID whereby a business can choose to verify their identity by adding a logo and reason for the call to the display screen; helping individuals determine legitimate robocalls and improving success rates for businesses. Rather than attempting to block calls at the outset, branded calling provides a mechanism whereby consumers can identify legitimate calls themselves; hence instilling trust in the call and improving brand recognition.

Branded calling is an extension of CNAM (Caller ID Name), which added a display name to the caller ID for businesses when calling customers. However, CNAM was based off a decentralised infrastructure and had limited capabilities. The strategy was also spoofed by fraudsters. Therefore, branded calling was required to develop trust in legitimate robocalls; increasing the likelihood of them being answered by individuals.

Figure 2: Branded Calling versus CNAM

Source: Juniper Research

Whilst this is an initiative already being trialled in countries including the US, Juniper Research recognises that it must also be a key area of focus for mobile and broadband providers in the UK to reduce the frequency of successful fraudulent calls and scams against mobile subscribers.

Given the increased frequency and complexity of robocalls, UK stakeholders must develop a strategy focused on robocall mitigation techniques. Therefore, a collaborative approach between fraudulent mitigation vendors, mobile operators and regulators must be adopted to improve the success rate of fraud mitigation solutions. Ofcom’s involvement in demanding stakeholders to be more proactive with these measures is the first step in achieving a reduction in the number of fraudulent calls.