Ofcom Fines Tismi £437,500 for Leaving 366,000 Numbers Open to Scammers

Ofcom, the UK communications regulator, fined telecoms provider Tismi BV £437,500 (about US$582,000) on 21 October for failing to stop its phone numbers being misused, according to the regulator’s case page for the investigation. Ofcom found that for at least 15 November 2022 to 1 January 2025, Tismi passed blocks of UK numbers on to other businesses without proper checks, leaving about 366,000 of them exposed. Tismi admitted liability and settled, which cut the penalty by 30%. The case is closed, but Tismi must keep sending Ofcom evidence that its new checks are working.

That last condition is where the story continues. Ofcom has not yet published the decision itself; its page says a non-confidential version will come later. What it has published is a summary that, read line by line, says a good deal about how scam numbers reach your phone and how much it costs a provider when they do.

What Ofcom found Tismi did wrong

Ofcom hands out UK numbers in large blocks. Providers like Tismi can then “sub-allocate” ranges to their own business customers, who may pass them on again. Each hand-off is a point where a fraudster can get hold of a working British number. Ofcom’s Good Practice Guide on sub-allocated numbers sets out the checks it expects at each step.

Ofcom found Tismi breached three of the General Conditions that every UK communications provider must follow, under section 96C of the Communications Act 2003:

• B1.6: making sure allocated numbers are used effectively and efficiently.
• B1.8: taking all reasonably practicable steps to make sure its customers follow the numbering rules.
• B1.9(c): transferring or sub-allocating numbers only where they would be used effectively and efficiently.

In practice, the regulator says Tismi sub-allocated numbers without adequate due diligence, had no process to reassess the risk of misuse after numbers went out, and kept no formal, documented system for handling and recording misuse reports. The result, in Ofcom’s words, was “exposing approximately 366,000 sub-allocated numbers to potential misuse”. It also cites “evidence of potential harm, including nuisance and scam calls using numbers sub-allocated by Tismi”.

Ofcom gives Tismi some credit. It notes the company responded promptly when outside agencies queried numbers, and that it brought in new processes within a few months of the investigation opening.

Two details are easy to miss. The October 2024 announcement also examined conditions B1.4 and B1.9(b), which cover whether numbers are used for the purpose their range is designated for. Neither appears in the final findings. And the case page gives two opening dates: the case summary says 16 October 2024, while the update beneath it says Ofcom opened the investigation “today” on 18 October 2024.

The £437,500 maths: about £1.20 a number

Ofcom’s own figures make the arithmetic simple. It set a penalty of £625,000 (about US$831,000) and applied a 30% settlement discount worth £187,500, leaving £437,500. “The penalty would have been significantly higher had Tismi not co-operated with our investigation,” the case page says.

Spread across the 366,000 exposed numbers, the final fine works out at about £1.20 (US$1.60) a number, or roughly £560 for each day of the 778-day breach window.

That figure is our calculation, not Ofcom’s, and the regulator does not set fines per number. It is still a useful yardstick, because a scam operation needs only a handful of working numbers at a time. In July, Ofcom fined Virgin Media £28m (about US$37m) for repeatedly preventing customers from cancelling contracts, as ITV reported. That is 64 times the Tismi penalty, for a company of a very different size. The money from fines goes to HM Treasury, ISPreview noted.

The timeline matters too. Eight months after opening the case, on 20 June 2025, Ofcom used its powers under section 49 of the Communications Act and General Condition B4.4 to direct Tismi to block all calls and messages to and from specific mobile numbers. The regulator says it had information linking those numbers to “serious fraud or misuse”. Tismi complied. The fine arrived 16 months after that.

Ofcom’s scam-number cases keep coming

Tismi is one case in Ofcom’s enforcement programme into phone and text scams, which targets the providers whose numbers keep turning up in complaints. “There’s no excuse for communications providers failing to put in the proper checks and balances,” George Lusty, Ofcom’s director of enforcement, said in a statement quoted by ISPreview.

On the same day, ISPreview reported that Ofcom had opened a separate investigation into another provider, Xtra Phones UK, over possible misuse of phone numbers. Ofcom has made no finding in that case.

For readers, the useful point is where these cases bite. Fraudsters can spoof any number on a caller display. Sub-allocation cases are about something different: real, working UK numbers that criminals obtain through a chain of resellers, which makes their calls and texts look more legitimate. Our guide to beating AI voice-clone emergency scams covers what to do when a familiar-looking call turns out to be fake.

How Canada’s CRTC tackles the same problem

Canada’s regulator leans harder on caller-ID authentication. In Decision 2021-123, the Canadian Radio-television and Telecommunications Commission (CRTC) directed providers to implement STIR/SHAKEN, a system in which the originating network digitally signs a call’s caller ID and the receiving network verifies it, on internet-based voice calls.

On 16 December 2025, in Decision 2025-343, the CRTC scrapped the twice-yearly progress reports it had required, saying providers “employ STIR/SHAKEN successfully to authenticate the vast majority of their IP-based voice calls” (paragraph 6). It gave no percentage.

Our read: the two regulators are working on different ends of the same pipe. Authentication tells your phone whether a call really comes from the number it shows. It does nothing when a scammer is calling from a genuine number obtained through a careless reseller, which is the gap Ofcom says Tismi left open.

What to do about scam calls and texts in the UK

• Forward scam texts to 7726, the free reporting number supported by UK mobile networks. Reports help networks block numbers.
• Don’t call back unknown numbers that rang off after one ring, and never use a number given in a suspicious message. Look it up yourself.
• Check Ofcom’s scams enforcement programme page, which lists the providers it has investigated.

More on Ofcom’s enforcement work is in our report on its Instagram Instants investigation and across our privacy and security coverage.

Tismi’s remaining obligation is paperwork: evidence of its due diligence, its monitoring, and how it responds when one of its numbers is reported. For 366,000 numbers, that file should not be short.