UK number spoofing 2026

Criminals using VoIP services can configure their outgoing calls to display any number — your bank's real fraud line, HMRC, your local police, even your own mobile number. The UK Ofcom Do Not Originate (DNO) list blocks some spoofing but coverage is partial and offshore routes still defeat it. This page explains how spoofing works, what protects you, and how to report.

Last reviewed: 15 May 2026 · Fact-checked by the SignalTools Research Team

Why caller-ID is unreliable

Caller-ID (the number displayed on your phone when you receive a call) is determined by the calling system at the originating end. Historically, the UK telephony network trusted the originating CLI without verification. VoIP services let users configure any outgoing CLI they want.

This means criminals can display:

  • Your bank's real fraud-line number
  • HMRC's published number
  • Your local police station
  • A familiar UK +44 prefix when the call is offshore
  • Your own mobile number (yes, really)

The displayed number is not proof of identity. Treat it as informational only.

The Ofcom Do Not Originate (DNO) list

Ofcom's DNO list is a register of numbers that should never originate UK consumer calls — primarily inbound-only numbers belonging to:

  • HMRC (their inbound-only customer service numbers)
  • Major banks' fraud-line numbers
  • NHS lines
  • DVLA
  • Department for Work and Pensions
  • Key emergency / government department numbers

UK telecoms operators are required to block incoming calls displaying these CLIs. Ofcom expanded the list significantly 2022-2024.

What DNO blocking doesn't cover

  • Calls originating outside UK carrier control (offshore VoIP routes)
  • Numbers not on the list (smaller institutions, new banks, etc.)
  • Banks' outbound numbers that ARE legitimately used by call centres
  • Spoofing of personal mobile numbers (not regulated to the same extent)

Net effect: DNO has reduced major-institution spoofing but offshore criminals still defeat it regularly.

5 protective layers

1. Callback verification (the primary defence)

For ANY urgent phone call asking for money, codes, or remote access: hang up, wait 5 minutes, call the institution back on a number YOU verify (back of bank card, gov.uk for HMRC, 101 for police).

2. UK 159 service

Free from any UK phone. Dial 159 to verify bank-related calls. Routes through the carrier-level UK number system that can't be spoofed. Participating banks: Bank of Scotland, Barclays, Co-op, Halifax, HSBC, Lloyds, Metro, Monzo, Nationwide, NatWest, RBS, Santander, Starling, TSB, Tide, Virgin Money.

3. Carrier-level reporting

Suspicious SMS → forward to 7726 (free). Suspicious calls → contact your carrier (EE 150, O2 202, Three 333, Vodafone 191) and ask them to log + report.

4. Phone-OS protections

  • iPhone: Settings → Phone → Silence Unknown Callers. Unknown numbers go to voicemail without ringing.
  • Android: Phone app → Settings → Caller ID & spam → Filter spam calls / Block unknown callers.

5. Third-party call-screening apps

Hiya (free + premium), Truecaller (free + premium), RoboKiller (paid). Each maintains community-curated databases of known scam numbers; blocks or warns on incoming calls matching patterns.

If your own number is being spoofed

You may notice strangers calling you angry that you "called them and harassed them" — when you never did. The criminals are using your number as displayed CLI for their outbound scam calls.

What to do

  1. Be polite to angry strangers contacting you. Explain it's not personal — your number is being spoofed. Suggest they report to 7726 / Report Fraud.
  2. Report to Report Fraud yourself at reportfraud.police.uk — your number is being used in fraud.
  3. Talk to your carrier — they may be able to add monitoring or in extreme cases change your number.
  4. Be patient — the pattern usually moves to a different number after days or weeks. Changing your number is disruptive; consider only if the pattern persists.

How to report spoofed numbers (the right channels)

  • Suspicious SMS: forward to 7726 (free, every UK mobile)
  • HSBC-specific SMS: 60599
  • DVLA-specific SMS: 60069
  • Suspicious phone calls: call your carrier (EE / O2 / Three / Vodafone) and report
  • Bank-related fraud calls: dial 159 + your bank's fraud line on back of card
  • Phishing emails: forward to report@phishing.gov.uk (NCSC)
  • Actual fraud loss: Report Fraud at reportfraud.police.uk or 0300 123 2040
  • FCA-regulated firm impersonation: FCA at fca.org.uk/contact
  • Ofcom (aggregate patterns): ofcom.org.uk → Make a complaint

Frequently asked questions

How does number spoofing work?

Caller-ID (CLI) is determined by the calling system at the originating end, not the receiving end. Criminals using VoIP (voice over internet protocol) services can configure their outgoing calls to display any number they want — your bank's real fraud line, HMRC, your local police, or even your own mobile number. The UK telephony network historically trusted the originating CLI without verification, making spoofing trivial for criminal infrastructure based on VoIP gateways. Ofcom has tightened rules since 2022 but enforcement is partial and offshore-routed calls still spoof regularly.

What is the Ofcom Do Not Originate (DNO) list?

The DNO list is a register of phone numbers that should never be the originating CLI for an incoming call to UK consumers. It includes: HMRC's inbound-only numbers, major banks' fraud-line numbers, NHS, DVLA, key Government Department numbers. UK telecoms operators block incoming calls displaying these numbers (which are inbound-only and shouldn't ever originate calls outbound). Ofcom expanded the DNO list significantly 2022-2024 and mandates carriers to apply blocking. Coverage is now strong for major UK institutions; weak for international routes and emerging scam numbers.

Why does my bank's real number still show up on scam calls?

Three reasons. (1) Offshore routes — calls originating from outside UK carrier control aren't subject to UK DNO blocking. (2) Bank's outbound number IS sometimes used legitimately (call centre dial-outs) so DNO listing is selective. (3) Spoofing tech evolves faster than rule-making. The practical implication: caller-ID is INFORMATIONAL, not authoritative. Even if your bank's real number displays, the call might still be a scammer using a VoIP service that bypassed the DNO list. Treat every urgent phone contact as potentially spoofed and apply callback verification.

What protects me?

Five protective layers. (1) Callback verification — apply for ANY urgent phone call (hang up, wait 5 minutes, call known number). (2) UK 159 service — dial 159 from any UK phone to verify bank-related calls; routes through carrier-level system that can't be spoofed. (3) Forward suspicious calls to 7726 (SMS) or call your carrier to report unwanted calls. (4) iPhone Silence Unknown Callers / Android Block unknown callers — sends unfamiliar numbers to voicemail. (5) Third-party call-screening apps — Hiya, Truecaller, RoboKiller — supplementary defence.

Can I report number spoofing to Ofcom?

Yes. Ofcom doesn't investigate individual scam calls but uses aggregate data to prioritise enforcement against specific spoofing operations. Report via the Ofcom website at ofcom.org.uk → 'Make a complaint'. Better routes for individual scam calls: (1) Forward suspicious SMS to 7726 (free). (2) Report Fraud at reportfraud.police.uk for actual fraud cases. (3) Bank fraud line if banking-related — banks share intelligence with industry threat-intel platforms. (4) Phone-paid Services Authority at psauthority.org.uk for premium-rate scams. Each route fuels different anti-fraud work.

What if my OWN number is being spoofed to scam others?

Surprisingly common. You may not realise until you receive angry calls from people you've never called, asking why you've harassed them. The criminals are using your number as the displayed CLI for outbound scam calls. (1) Inform the people contacting you politely that your number is being spoofed — apologise; explain it's not personal; they should report to 7726 / Report Fraud. (2) Report to Report Fraud yourself — your number is being misused for fraud. (3) Talk to your carrier — they may be able to add your number to monitoring or change it. (4) Unfortunately there's no quick fix — the spoofing is by an external criminal you can't reach, and changing your number is the disruptive option. The pattern usually moves to a different number after days or weeks.

Related scam guides

Just had a call like this? Use our free Cold-Call Checker to find out in a minute whether it was legal under the 2026 UK rules, who to report it to (ICO, Ofcom or Action Fraud), and get a ready-to-send complaint — or browse the “who called me?” number guide.

Related scam guides