Summary

• Ofcom found Tismi lacked appropriate safeguards against numbering misuse from at least November 2022 to January 2025.
• Approximately 366,000 sub-allocated numbers were exposed to potential misuse; the figure is not a confirmed victim count.
• Tismi must evidence improved checks, monitoring and incident handling after a £437,500 penalty that includes a 30% admission discount.

Ofcom has fined telecommunications provider Tismi £437,500 after finding that inadequate checks on customers and allocated telephone numbers exposed approximately 366,000 sub-allocated numbers to potential misuse, including scams, for more than two years.

The regulator said Tismi lacked appropriate and proportionate safeguards from at least November 2022 to January 2025. It identified failures in due diligence before numbers were passed to customers, monitoring after allocation and formal procedures for investigating reports of misuse.

The figure of approximately 366,000 describes numbers exposed to potential misuse. It is not a count of numbers confirmed to have carried fraudulent calls or messages, nor is it a figure for people who lost money to scams. Ofcom’s enforcement finding concerns inadequate preventive controls and the risk those weaknesses created.

The decision, announced on 21 October, sits within Ofcom’s programme to improve how communications providers protect legitimate numbering resources. Regulators allocate blocks of numbers to providers, which can subsequently make those numbers available to other businesses and individuals for lawful communications services.

That model supports a wide range of telephone and messaging products, but it can also make abuse harder to identify when the company holding an allocation is removed from the eventual use of a number. Providers remain responsible for taking appropriate steps to prevent misuse even where customers or other businesses operate the associated services.

Controls were missing at several stages

Before a business receives numbers, a provider should undertake proportionate checks to establish who the customer is and whether the proposed use is legitimate. Ofcom found that Tismi sub-allocated numbers without suitable due diligence designed to prevent misuse and support the effective use of numbering resources.

Customer checks cannot prevent every subsequent problem. An account might be compromised, activity may change after onboarding, or a previously acceptable customer could begin using services in a way that causes concern. Continued monitoring and an effective response to warnings are therefore necessary parts of the control process.

Ofcom found Tismi did not have appropriate processes to identify possible misuse after allocation and did not maintain an effective system for addressing non-compliant behaviour. The company also lacked a formal documented method for handling reports that its numbers were being abused.

A documented incident process can establish who receives a warning, what evidence is reviewed, how urgently a complaint must be escalated and when service restrictions are needed. Such records also help demonstrate that an investigation has been completed rather than leaving the outcome dependent on informal staff decisions.

These requirements are operational rather than merely administrative. A provider can supply numbers to thousands of customers through automated systems, making it difficult to rely exclusively on manual checks after a complaint. Risk monitoring and clear escalation procedures allow potential problems to be identified and addressed in a more consistent manner.

The regulator has not published a detailed breakdown of how many of the affected numbers were actively exploited or how much financial harm resulted. Its conclusion is that the missing safeguards exposed a significant volume of numbering resources, and potentially consumers, to avoidable risk.

A previous block did not resolve the wider failure

Ofcom opened an investigation into Tismi in October 2024. During that process, it directed the provider in June 2025 to block calls and messages involving specified mobile numbers after concerns about scam activity. Tismi implemented the direction.

Blocking a set of numbers addresses an immediate risk, but it does not necessarily fix the processes that allowed unsafe allocation or use to develop. The latest decision instead evaluates whether the provider maintained appropriate controls across its customer relationships and numbering estate.

Ofcom is requiring Tismi to provide evidence that its procedures have improved. The company must supply details of customer due diligence, ongoing monitoring and its handling of misuse reports in accordance with the policies and processes it has introduced.

The financial penalty includes a 30% reduction because Tismi admitted liability. The final £437,500 will be passed to HM Treasury rather than retained by Ofcom. The regulator has not yet published a non-confidential version of the full confirmation decision, citing the need to protect other ongoing investigations.

That publication restriction means the current public statement establishes the principal findings without disclosing every underlying item of evidence. It would be inappropriate to infer additional victims, offences or specific transactions from the total number of potentially exposed numbers.

Fraud prevention begins before a complaint

Telephone numbers remain necessary for routine business services, including customer support, appointment reminders, logistics updates and account notifications. Their familiarity may also make fraudulent communications appear credible, particularly when recipients cannot readily establish which organisation controls the number displayed.

Proper customer identification reduces the opportunity for criminals to obtain legitimate numbering resources without scrutiny. Monitoring then provides another opportunity to spot unusual activity or respond to reports from networks, customers and enforcement bodies before problems continue.

Those arrangements are not a complete defence against telephone fraud. Caller identity can be manipulated, accounts can be compromised and criminals can move between communication channels. Number allocation controls address one part of that wider system rather than eliminating scams on their own.

On the same day as the Tismi decision, Ofcom opened a separate investigation into Xtra Phones UK over concerns relating to numbers held by that company. The opening of an investigation does not establish a breach, and the two matters should not be treated as one enforcement case.

For providers, the Tismi penalty makes the operational expectations clear: assess business customers, examine risks throughout the life of an allocation and retain procedures that can respond when possible misuse comes to light. The next test is whether Tismi’s documented changes satisfy Ofcom, not whether the original fine can be taken as evidence of a particular number of completed scams.