Posted on: 1st September 2026, by Magrathea
Last year we wrote about Ofcom’s proposals to close the mobile CLI spoofing loophole and questioned whether there were some fairly significant holes in the plan.
We wholeheartedly supported the intention of stopping fraudsters overseas from presenting UK mobile numbers to make their calls look more trustworthy, but we had serious concerns about the proposed solution.
Ofcom has now published its final decision and, pleasingly, it has listened to some of those concerns. The most complex element of the original proposal has been dropped, although we are not entirely convinced that the remaining solution closes the loophole.
So, what has changed, what does it mean for providers and consumers, and where do we go from here?
A quick recap
The journey to this point began in July 2024, when Ofcom first asked industry for input on how to close this major loophole. This led to a consultation in July 2025, to which we submitted a robust response, as well as meeting directly with the Ofcom team to explain our concerns.
Ofcom’s original proposal was a two-stage ‘withhold and restore’ model.
The first UK network receiving an overseas call presenting a UK mobile number would apply a ‘withheld CLI’ flag. The call would then be routed via the mobile number’s home network to establish whether the caller was genuinely roaming. If validated, the CLI could be restored and the call terminated as usual.
Our biggest concern was that this approach assumed that +447 calls originate through mobile infrastructure. In reality, there are many legitimate app-based and cloud voice services which do not work this way, and where traditional mobile home-routing or access to CAMEL is neither available nor practical.
We argued that this could add significant cost and complexity while still failing to address some of the routes fraudsters actually use.
If you want the more technical explanation of CAMEL, home routing and why we objected to the original proposal, you can read our previous article.
Ofcom listened, at least in part
The good news is that Ofcom has taken on board the concerns raised by us and others and concluded that the ‘restore’ requirement as proposed would be disproportionately expensive and complex.
That part of the proposal has therefore been dropped, a decision we very much welcome.
The ‘withhold’ requirement, however, remains.
Within the next 12 months, before 15 July 2027, the first UK provider to process a call originating outside the UK but presenting a UK +447 number must change the caller ID to withheld. The exception is where the provider carries the call on a channel that verifies roaming by design.
For example, nowadays a large number of calls originating from a UK MNO SIM while travelling abroad will be verified by the home network before terminating with the called party, so roaming has already been verified by design.
For calls that bypass an MNO, such as those generated through cloud-based services, things are not quite so straightforward. However, Ofcom acknowledges that direct routes are already being used to validate calls with fixed-line caller ID and that the same method can be used here.
What does this mean for legitimate calls?
There is, of course, a consequence.
Some legitimate calls made while roaming may now reach the called party with the CLI withheld. Ofcom’s research shows that 62% of people are unlikely to answer a withheld call.
That could mean missed calls from travelling colleagues, customers, friends or family. Ofcom’s view is that the benefit of a significant number of fraudulent calls also going unanswered outweighs the inconvenience caused by some legitimate callers not getting through.
Time will tell whether that balance proves to be the right one.
Does it close the loophole?
This brings us back to one of our original concerns: bad actors don’t necessarily follow good rules.
The new intervention relies on the first UK provider receiving the call correctly applying the withheld flag. Legitimate providers will of course implement the requirement, but those intent on getting scam traffic through will inevitably look for providers, routes or methods that allow them to circumvent it, whether knowingly or otherwise.
This doesn’t mean the intervention isn’t worthwhile. Every additional barrier makes life more difficult for fraudsters. But it does mean we shouldn’t mistake this measure for a complete solution.
Ultimately, the intervention still pushes much of the decision-making onto the called party. Do you answer a withheld call and risk it being a scam, or ignore it and risk missing a legitimate call?
We also raised another concern in our consultation response which remains unresolved. If consumers learn that suspicious overseas mobile calls should appear as ‘withheld’, will they begin to assume that any call displaying a UK number has somehow been validated?
That would be an unfortunate unintended consequence. A displayed CLI should never, on its own, be taken as proof that a caller is genuine.
We still think there is merit in exploring whether consumers could instead be given a clearer indication that a call originated overseas. Someone expecting a call from a travelling relative or colleague could then make an informed choice, while others might simply choose not to answer.
But Ofcom has made its decision, so the question now is how we make the intervention as effective as possible. For us, two things are critical: traceback and consumer education.
1. Traceback
It is critical that the UK establishes a reliable traceback solution so that fraudulent calls which still reach their targets can be traced back through the communications chain.
Blocking individual calls treats the symptom. Quickly identifying where fraudulent traffic originated gives us the opportunity to tackle the source.
Magrathea, through Comms Council UK and NICC Standards Ltd, is actively involved in a number of initiatives intended to drive progress in this area. Despite traceback being highlighted in the Fraud Strategy earlier this year, progress remains frustratingly slow, but we will continue working to bring industry together on what we believe is a critical fraud prevention tool.
2. Consumer education
The second piece is consumer education.
Without it, people may simply notice that more calls arrive with the caller ID withheld, with no understanding of why.
Consumers need to understand that some perfectly legitimate calls may now appear as withheld, but also that a displayed UK number should never, on its own, be treated as proof that a caller is genuine.
The general public also needs greater awareness of the types and scale of scams in circulation and how to detect and protect themselves against them. Consumers remain the last line of defence and, for now at least, awareness is essential to helping them react appropriately.
We can play our part by educating our own customers and helping them prepare guidance for their users. However, we believe Ofcom should coordinate a wider national awareness campaign so that the people these measures are ultimately designed to protect understand what is changing and why.
Implementation at Magrathea
Regardless of our views, the new rules must be implemented by July next year, and unsurprisingly Ofcom is encouraging providers to implement them sooner to help accelerate the fight against fraud.
We will be engaging directly with our clients over the coming weeks to understand where we may need to establish additional direct routes in order to validate legitimate calls. However, we expect this is most likely to apply to those where arrangements are already established to handle geographic CLI and simply need an extension.
Our aim, as always, will be to implement the requirements while minimising disruption to legitimate traffic.
Another step forward, but not the final answer
We welcome any proportionate measure that makes life harder for scammers, and we are pleased that Ofcom listened to industry concerns and removed the most complex element of its original proposal.
But fraudsters continually adapt, and no single technical intervention will solve the problem. Blocking and withholding can help, but they need to sit alongside better intelligence sharing, effective traceback and informed consumers.
We will now focus on implementing the new rules with as little disruption as possible for legitimate traffic, while continuing to push for the wider measures we believe are needed to tackle scam calls at source.
After all, stopping a fraudulent call is good. Finding out who sent it, and stopping them sending the next one, is better.