Ofcom fines Tismi £437,500 for failure to prevent misuse of UK phone numbers

The UK telecoms regulator, Ofcom, has today fined telecoms provider Tismi (Tismi BV) £437,500 for failing to prevent misuse of its phone numbers by scammers. The move comes after their June 2025 decision, which directed the company to “block all calls and messages” sent to or from specific mobile numbers allocated to it by the regulator after they were “linked to serious fraud or misuse“ (this was implemented).

The original investigation, which was launched in October 2024 (here), occurred because Ofcom had cause to deem it necessary to assess whether the company had failed in its duty to ensure that phone numbers allocated to it are not being misused, including to perpetrate scams.

The probe reflected the fact that Ofcom had previously launched an enforcement programme during February 2024 to ensure that UK telephone and text companies were using phone numbers efficiently and effectively. This formed a complementary part of their effort to strengthen existing rules against the use of “fake phone numbers” and “spoofed calls“, which included a measure for phone providers (fixed line and mobile) to introduce stricter controls against “Presentation Numbers” that are used to identify who is making a call (here).

Ofcom allocates telephone numbers, usually in large blocks, to telecoms firms, which can then transfer those numbers to individuals or other businesses as their customers. But the regulator’s investigation raised concerns that some of the numbers they’d previously allocated to Tismi “are/were being misused, including to facilitate scams“.

The latest development today is Ofcom have found that Tismi “did not have any appropriate or proportionate measures in place to prevent misuse of numbers allocated to them“, at least between November 2022 and January 2025. The company is said to have exposed approximately 366,000 sub-allocated numbers to potential misuse, and therefore a significant number of consumers to harm, for over two years. In doing so, Tismi also failed to meet the expectations set out in Ofcom’s our Good Practice Guide.

In particular, Ofcom said Tismi:

➤ Sub-allocated numbers to its customers without carrying out appropriate due diligence checks to ensure the effective and efficient use of those numbers and prevent them from being misused.

➤ Failed to implement appropriate measures to ensure the ongoing compliance of its sub-allocatees with General Condition B1. Specifically, Tismi did not have a process to reassess the risk of number misuse after numbers have been sub-allocated (including monitoring for potential misuse) nor an effective documented process to identify and address non-compliant behaviour.

➤ Failed to ensure it had appropriate formal and documented processes in place to ensure the adequate handling of and/or consistent recording of reports of misuse. While we acknowledge Tismi provided evidence of promptly responding to queries and/or complaints from external agencies, the lack of any written or formal process meant Tismi was limited in its ability to adequately monitor and respond to the risk of misuse posed by specific customers or number sub-allocations.

Evidence of potential harm, including nuisance and scam calls using numbers sub-allocated by Tismi, was identified throughout the investigation. The penalty Ofcom has imposed is, however, said to include a 30% discount as a result of Tismi’s admission of liability and its completion of Ofcom’s settlement process.

George Lusty, Ofcom’s Director of Enforcement, said:

“There’s no excuse for communications providers failing to put in the proper checks and balances to prevent numbers being misused. Today we’re sending a clear message to industry that any company that puts customers at the mercy of scammers will face the consequences.”

The fine will as usual be passed on to onto HM Treasury once received. Ofcom said they were also requiring Tismi to complete further actions to evidence its compliance. This includes providing details of its due diligence process and on-going monitoring, and its response to reports of incidents of misuse in accordance with its new policies and processes.