Scam text rules: what Ofcom's new measures mean if your business sends SMS

If your business sends text messages, whether appointment reminders, delivery updates, booking confirmations or the occasional offer, new Ofcom rules on scam texts are worth five minutes of your time. Most of the duties fall on mobile networks and the companies that carry business messages for them, not on you directly. But those companies will be asking more questions of the businesses that use their services, and that is where you may notice a change.

What Ofcom has decided

Ofcom published its final rules on mobile messaging scams in July 2026, after consulting from late 2025 into January 2026. They apply to SMS and MMS, not to apps such as WhatsApp or iMessage. According to the ISPreview report on the original proposals, the package covers two areas.

• Person-to-person texts: volume limits on pay-as-you-go SIMs, blocking numbers used by scammers, and blocking scam messages in transit by spotting malicious sender names, web links and phone numbers.
• Business messaging: upfront and ongoing checks on the businesses that send texts, including "Know Your Customer" checks on new senders and "Know Your Traffic" checks on account activity and fraud reports.

Operators and the "aggregators" that pass businesses' messages onto the networks must also have a right to challenge blocked numbers or messages, keep records, train staff and make sure legitimate messages keep flowing. LexisNexis's summary of the final rules adds that providers must verify alphanumeric sender IDs, apply incident management processes and make sure the anti-scam controls apply throughout the business messaging supply chain.

Why this is happening

The figures Ofcom used in its consultation, as reported by ISPreview, give a sense of the scale. About half of UK mobile users said they received a suspicious text or iMessage between November 2024 and February 2025. Mobile operators block an estimated 600 million or more messages a year, and around 100 million suspicious messages were reported through the free 7726 service in the year to April 2025.

For a genuine small business, the harm is indirect but real. When customers are bombarded by fake parcel and bank texts, they learn to distrust every message, including yours.

What "sender ID" means for you

Many business texts show a name rather than a number, such as a shop name at the top of the message. This is called an alphanumeric sender ID. Scammers exploit it by borrowing the name of a bank or delivery firm. Under the new rules, providers must check sender IDs against what they know about the business sending them. The bOnline write-up of the proposals gives a simple example: a hair salon should not be sending parcel delivery messages. Providers must also keep policies on protected and generic names such as "Customer Service".

In practice, expect a text provider to ask for your company details, to want the sender name to match your trading name, and possibly to refuse or query names that look generic or like someone else's brand.

The registry that did not happen

Ofcom also considered a mandatory central register of sender names. As ISPreview reported in July 2026, it decided against it, citing significant upfront and ongoing costs that could fall on small businesses unlikely to be spoofed. It preferred lighter measures: checks on business senders, operator policies on protected or generic IDs, and rules on special characters. Ofcom has left the door open to revisiting the idea.

A voluntary Sender ID Protection Registry already exists. It began in 2019, is now run by the Mobile Ecosystem Forum and charges brands a fee. It is mainly relevant to organisations that are likely to be impersonated, such as banks, rather than a typical local business.

Opinion on the decision is mixed. BT/EE, techUK and the Mobile Ecosystem Forum were among those who thought a mandatory registry would be costly, cumbersome or slow to deploy, while Which? and several messaging firms supported one. The sensible reading for a small business is that the rules are settled for now, but the debate is not over.

Your marketing texts still follow separate rules

These Ofcom rules are about stopping fraud. They do not replace the rules on marketing. The ICO's guidance on electronic marketing says you generally need specific consent before sending marketing texts or emails. There is a "soft opt-in" for existing customers who bought, or negotiated to buy, a similar product or service from you, but only if you offered a simple way to opt out when you collected their details and in every message you send. The soft opt-in does not cover bought-in lists or new contacts. You must not disguise or conceal your identity, and you must act promptly on opt-outs. The ICO notes that sole traders and some partnerships count as individuals, so those rules protect them too. You can read the detail in the ICO's guidance.

What to do this week

• List every system that sends texts. Booking software, your website, a card payment provider, a CRM and a bulk text service may all send messages in your name.
• Check the sender name. Make sure it matches your trading name and is not a generic word. Ask each provider whether they are changing their onboarding checks.
• Keep your details consistent. The name, address and company registration on your text account should match your website and your Companies House record, so verification does not stall.
• Tell customers what to expect. A line on your booking confirmation such as "we will only text you about your appointment, and never ask for payment details by text" helps customers spot fakes.
• Review your marketing consent. Confirm you can show when and how people agreed, and that every message has a working opt-out.
• Know how to report fakes. If someone impersonates your business, customers can forward the message to 7726 for free.

Where automation fits

If reminders and confirmations are sent by hand or from a patchwork of tools, this is a good moment to tidy up. A single, well-configured system with one verified sender name is easier to keep compliant than several. Our process automation work often starts with exactly this kind of audit of which messages go out, from where and why.

The bottom line

Most small businesses will not need to do anything dramatic. The new rules put the burden on networks and aggregators, and the likely effect for you is a few more questions when you set up or renew a text service. Keep your details accurate, use a sender name that is clearly yours, and keep your marketing consent in order. Ofcom's full statement is the place to check implementation dates for each part of the rules, and your text provider should be able to tell you what it means for your account.