On July 23, 2026, the United Kingdom found itself at a crossroads in the fight against online fraud and harmful digital content. Two major regulatory developments unfolded within days of each other, both spearheaded by Ofcom—the UK’s communications regulator—highlighting both the progress and the persistent gaps in internet safety and consumer protection.
First, Ofcom finalized a suite of new rules compelling UK mobile network operators to block fraudulent text messages and scam calls. The measures, designed to shore up consumer protection and establish robust security standards, come at a time when digital fraud has ballooned to account for an estimated 45% of all reported crime incidents in England and Wales. According to Ofcom data, UK victims lost a staggering £1.28 billion (approximately $1.72 billion USD) to fraudsters in 2025 alone. Four in ten mobile users reported receiving at least one suspicious message on their phones over a three-month period this year—a sobering statistic that underscores the scale of the problem.
Under the new rules, mobile operators are required to gather detailed intelligence on scam messages, malicious weblinks, and phone numbers from both customers and anti-fraud organizations. This information isn’t just collected for its own sake—it’s used to detect and block scam messages before they ever reach consumers. Operators must now perform upfront and continuous “Know Your Customer” checks on new business messenger senders, a move aimed at preventing criminal groups from sending fraudulent texts en masse. They’re also mandated to monitor account volumes for unusual activity and to verify sender IDs to shut down the use of fake sender names, known in the trade as Alphanumeric Sender IDs.
When scam activity is detected, operators are required to trigger incident management processes to block offending message senders and address compliance failures by other providers. There’s also a new emphasis on responding swiftly to scam reports from users and third parties, with the goal of identifying and blocking malicious sender IDs, weblinks, and phone numbers as soon as they’re flagged.
International number spoofing—a favorite trick among foreign criminal gangs—hasn’t escaped Ofcom’s attention. Updated guidance now instructs telecom companies to withhold caller identity on calls that appear to originate from a UK mobile number roaming abroad, unless the call’s validity can be verified. Caller ID verification systems are expected to authenticate the origin of international calls before they’re allowed to cross into UK networks, making it harder for scammers to disguise their true location and intentions.
“Mobile messaging scams can have devastating consequences for victims, with criminal gangs using ever more sophisticated techniques to dupe their victims,” said Amy Jordan, Strategy Delivery Director at Ofcom. “Our new protections for consumers and businesses announced today will help ensure we remain one step ahead by disrupting and blocking this criminal activity at source.”
Ofcom’s decision to standardize anti-scam measures across all providers comes despite the industry’s existing efforts—more than 600 million scam messages are intercepted each year, according to the regulator. Still, inconsistent application of safeguards has left exploitable gaps. Ofcom expects that these new protections, combined with the government’s ban on SIM farms and operator commitments under the Fraud Sector Charter, will lead to a meaningful reduction in scam messages.
Chief Superintendent Amanda Wolf, Head of Report Fraud Operations at City of London Police, welcomed the new measures: “By requiring mobile network providers to adopt a new, robust approach to identify and disrupt fraudulent text messages, this will help protect the public from criminals who are exploiting UK mobile numbers.”
Yet, even as Ofcom pushes forward on one front, it has hit a brick wall on another. Just days earlier, on July 20, the regulator announced it had exhausted all legal options under the Online Safety Act 2023 in its effort to block a notorious US-hosted pro-suicide forum. This forum, which Ofcom has declined to name due to the nature of its content, has been linked to over 130 UK deaths according to Ofcom—and at least 164 deaths according to the Molly Rose Foundation, the country’s leading online suicide prevention charity.
The investigation into the forum began on April 9, 2025, marking the first formal probe of an individual service provider under the Online Safety Act. Ofcom’s findings were grim: illegal content, including detailed instructions on suicide methods, was consistently present and often pinned or reposted by the forum’s own operators. Despite a partial geoblock implemented by the forum in July 2025, fresh evidence emerged in November that UK users could still access the site, prompting Ofcom to move toward enforcement. In May 2026, the regulator imposed a £950,000 fine (about $1.27 million USD) on the forum’s provider for failing to protect UK users. The fine, due by June 12, 2026, remains unpaid.
But here’s the rub: after Ofcom’s compliance direction, the forum closed a specific login route for UK users who weren’t using VPNs. This partial, technically imperfect geoblock was enough to bring the platform into compliance with the law’s threshold for access restriction. Under the Online Safety Act, Ofcom can only seek a court-ordered ISP block if the platform is in ongoing non-compliance. The moment the forum achieved this minimal technical compliance, Ofcom’s most powerful enforcement tool was effectively neutralized—even though motivated UK users could still access the site via VPN.
This case has exposed a structural vulnerability in threshold-based internet safety laws, especially when they’re applied to foreign-hosted platforms. As Ofcom explained, “We’ve used the powers we’ve been granted to the fullest extent possible, which has resulted in blocking this site for the vast majority of users in the UK.” Yet, the regulator acknowledged that this outcome would not bring closure for bereaved families. Andy Burrows, chief executive of the Molly Rose Foundation, was unsparing in his criticism, accusing Ofcom of lacking “moral courage” and questioning the leadership of CEO Melanie Dawes. Sarah Ruane of Samaritans called it “a missed opportunity to hammer home” the message that breaches would be heavily punished.
Three specific gaps in the Online Safety Act have now been formally identified and referred to Parliament. First, the business disruption trigger requires ongoing non-compliance, allowing platforms that achieve minimal compliance to evade stronger enforcement. Second, there’s no mechanism for a conditional or pre-emptive order that could automatically take effect if a platform reverses its compliance measures. Third, the OSA’s jurisdictional scope creates a hard ceiling: it cannot require foreign platforms to change their global operations, limiting the UK’s ability to act against overseas providers.
Despite the enforcement impasse, Ofcom has taken steps within its current powers. Search engines have removed links to the forum, and Ofcom has clarified that internet service providers can voluntarily filter suicide material without a court order. Debt recovery proceedings against the forum’s US-based provider are underway, but enforcement remains uncertain given the provider’s lack of UK presence and ongoing jurisdictional disputes.
These parallel stories—one of regulatory advance, the other of legal limitation—underscore the evolving challenges of digital governance. As Parliament considers amendments to the Online Safety Act, the UK’s experience offers a cautionary tale about the complexity of enforcing national laws in a borderless digital world. For now, the fight against online harm continues—one incremental step, and one exposed gap, at a time.