Ofcom has fined Tismi £437,500 after finding the provider handed out hundreds of thousands of UK phone numbers without adequately checking who was getting them or watching how they were used. The decision is a clear signal that know-your-customer duties in telecoms are now enforced, and every organisation that buys bulk messaging or voice numbers sits somewhere in that chain.
What happened
On 21 October 2026 Ofcom closed its investigation into Tismi BV, a messaging and numbering provider that the regulator’s case page identifies as part of Link Mobility, by confirming a penalty of £437,500. The starting figure was £625,000. Tismi admitted liability and went through Ofcom’s settlement process, which earned it a 30% reduction, and the regulator says the sum would have been considerably larger without that cooperation and the remedial work the company has since carried out. The money goes to HM Treasury.
Ofcom found breaches of three of its General Conditions of Entitlement, B1.6, B1.8 and B1.9(c), covering a period from at least 15 November 2022 to 1 January 2025. During that window, according to the confirmation decision, roughly 366,000 numbers that Tismi had passed on to other businesses were left exposed to potential misuse, and the regulator classed the contravention as serious.
The case has been running for two years. Ofcom opened it in October 2024 as part of an enforcement programme on phone and text scams, after earlier information requests to providers with high or rising complaint volumes. In June 2025, part-way through the inquiry, Ofcom used its powers under section 49 of the Communications Act 2003 to order Tismi to cut off voice and SMS traffic for particular mobile numbers tied to serious fraud. Tismi complied within the deadline. On the same day as the fine, Ofcom announced a fresh investigation into a second provider, Xtra Phones UK, over similar concerns; no findings have been made against that company.
George Lusty, Ofcom’s Director of Enforcement, said there was “no excuse” for providers that fail to put proper checks in place.
The detail
Ofcom allocates UK numbers to communications providers, usually in large blocks. Those providers can then sub-allocate ranges to resellers, application-to-person (A2P) messaging customers, contact centres and other businesses. Each hop is a chance for a fraudster to pick up legitimate-looking UK numbers.
Ofcom’s rules expect the provider holding the allocation to do three things, and its findings against Tismi map neatly onto each of them:
- Check customers before handing over numbers. Tismi sub-allocated ranges without adequate due diligence on who was receiving them.
- Keep watching after allocation. It had no process to reassess the risk a customer posed once numbers were in use, and no systems to spot and deal with non-compliant behaviour.
- Act on reports of abuse. It lacked a formal, documented way of handling and recording misuse reports.
Ofcom also said Tismi fell short of its Good Practice Guide on sub-allocated numbers. As part of the outcome, the company must now supply evidence that its new due diligence, monitoring and misuse-handling policies are actually working. A non-confidential version of the confirmation decision is due to be published later, so the full reasoning, including how Ofcom calculated the penalty, is not yet public.
Why it matters for UK organisations
This is not a telecoms-only story. Smishing and vishing remain among the most dependable ways into UK organisations and into their customers’ bank accounts, and almost all of it relies on access to working numbers and sender routes. When a provider treats numbering as a commodity and asks no questions, it effectively subsidises the fraud economy that security teams spend their days defending against.
For financial services firms in particular, scam texts and calls are a common first step towards payment fraud losses. A regulator penalising the supply side of the scam chain helps everyone downstream, but it also shows the direction of travel: Ofcom expects proper customer vetting and monitoring, and it is prepared to enforce that expectation.
There is a governance point too. Many UK organisations buy SMS and voice capacity from aggregators for one-time passcodes, delivery notifications and marketing. If an upstream provider is ordered to block ranges, your legitimate traffic could be caught up too.
Expert view
In my experience, the weakest link in most social engineering assessments is not the email gateway but the phone. When we run vishing and smishing exercises, a believable UK number does a lot of the work, and staff are far more trusting of a text that appears to come from a domestic mobile than one from an obviously foreign source. Anything that makes it harder for criminals to obtain clean UK numbers in bulk raises the cost of that whole class of attack.
What strikes me about the findings is how ordinary the failures are. Inadequate due diligence at onboarding, no ongoing monitoring, no documented route for complaints: these are the same gaps we see in identity and access management across sectors, simply applied to a different asset.
I would also be cautious about reading the size of the fine as the main message. £437,500 is modest against the scale of fraud that 366,000 exposed numbers could enable. The more significant outcome is the precedent: a closed case, with specific General Conditions cited, that other providers’ compliance teams can benchmark against. The parallel investigation into Xtra Phones UK suggests this will not be a one-off.
What to do now
- Map your number supply chain. List every provider you use for SMS, voice and OTP delivery, and ask each one who holds the underlying Ofcom allocation and how many resellers sit in between.
- Add numbering questions to supplier due diligence. Ask providers to describe their know-your-customer checks, ongoing misuse monitoring and complaint handling, and whether they follow Ofcom’s Good Practice Guide on sub-allocated numbers. Request evidence, not assurances.
- Lock down your messaging platform accounts. Treat A2P and contact centre portals like any other administrative system: unique accounts, multi-factor authentication and least privilege, in line with the user access control and secure configuration controls in Cyber Essentials. A hijacked sender account is just as useful to a fraudster as a rogue number range.
- Monitor for impersonation and brief staff. Remind staff that a UK caller ID is not proof of identity. Track customer and staff reports of texts or calls claiming to be from you, and report abuse to your provider and through the mobile networks’ spam reporting routes, so complaint data reaches the people who can block it.
- If you are a provider or reseller, self-assess now. Compare your onboarding, monitoring and complaint processes against the three failings Ofcom found at Tismi, document the results and fix the gaps before the regulator asks.
Bottom line
Ofcom has turned its scam enforcement programme into a concrete penalty, with clearly cited rules and a second investigation already under way. For providers, the message is to treat numbers as a controlled asset with proper vetting and monitoring. For everyone else, it is a prompt to look harder at the messaging and voice suppliers behind your own customer communications, because the same infrastructure that delivers your passcodes can deliver someone else’s scam.
Sources
- Ofcom: Telecoms provider fined £437,500 for failing to prevent misuse of its phone numbers by scammers
- Ofcom: Investigation into Tismi’s compliance with its obligations under the General Conditions of Entitlement
- ISPreview: Ofcom fines Tismi £437,500 for failure to prevent misuse of UK phone numbers
- Telecompaper: Ofcom fines telecoms provider over GBP 400,000 for number misuse
- Light Reading: Eurobites: CMA looks to open up Apple’s NFC walled garden
- Wired-Gov: Ofcom launches investigation into whether Tismi failed to prevent misuse of its phone numbers by scammers
