Why you still get so many scam text messages
The “your parcel couldn’t be delivered” text. The one pretending to be your bank. The one from a number that looks suspiciously like your own. If your phone gets several scam text messages a week, you are not imagining it and you are not unusually unlucky.
Ofcom published new rules on 15 July 2026 aimed squarely at this problem, and they are a genuine change in how networks are expected to behave, not just another awareness campaign asking you to be more careful.
They will not make scam text messages disappear overnight, though. The rules take time to land, and knowing the gap between now and then is what actually protects you in the meantime.
What is actually changing?
The rules split into two halves, and the second one is the more interesting of the two.
On texts sent phone to phone, providers must block numbers used by scammers, block scam messages in transit by detecting malicious weblinks and phone numbers inside them, and set volume limits on pay-as-you-go SIM cards. That last one matters because scam operations routinely burn through cheap SIMs to blast out texts in bulk, and a cap makes that model harder to run.
On texts sent by businesses, operators and the aggregators who handle bulk messaging have to run Know Your Customer and Know Your Traffic checks on who is sending what, act on reports from users and third parties, and follow a proper incident process when scam activity turns up.
The most useful part for you is sender ID verification. Those texts that arrive with a name at the top rather than a number, like a bank or a delivery firm, use something called an Alphanumeric Sender ID, and until now a scammer could simply type one in. Under the new rules those names have to be verified against real business information, which attacks the single most convincing thing about a fake bank text.
The messages the rules do not cover
This is worth knowing before you relax.
The rules apply to SMS and MMS, meaning standard texts sent over the mobile network. They do not cover WhatsApp, iMessage or RCS. Ofcom’s reasoning is that those services do not depend on telephone numbers in the same way and sit outside the Communications Act, so they fall outside its powers here.
RCS is the awkward one. It is the upgraded messaging standard that many Android phones now use by default, and it often looks and feels exactly like a normal text, sitting in the same inbox. Whether it is regulated depends on how it has been implemented in the UK, and operators are largely determining that themselves. So a message that looks like a text on your phone may or may not be covered, which is a difficult thing for any reader to act on and a good reason not to treat the new rules as a safety net.
When do these rules actually start protecting you?
Not yet, is the honest answer.
The phone-to-phone duties start on 18 January 2027. The business messaging duties, including the sender ID verification described above, follow on 15 July 2027.
Until those dates, the protection you have is whatever your own network already does voluntarily, which varies between providers. That is roughly four months until the first tranche and nearly ten until the second, which is a long time to rely on spotting scam text messages yourself.
Some networks are tightening things ahead of the deadlines, since the direction of travel is clear. But nothing is guaranteed until the rules are in force.
What to actually do about it right now
Three habits matter more than any regulation while the gap closes.
Key takeaways
- Forward any scam text messages to 7726, which reports it free to your network and helps them block the sender faster.
- Never tap a link in an unexpected delivery, bank or tax text. Go to the real website or app yourself instead of trusting the message.
- Check with your bank by phone on a number you already know, never one given in the text itself.
- Delete and block the sender rather than replying, even to say “stop”, since replying can confirm a live number to a scammer.
- Be extra wary of a text that looks like it came from your own number. That is a spoofing trick, not proof the sender has hacked your phone.
Does reporting a scam text actually do anything?
Yes, and more than most people assume. Reporting to 7726 feeds directly into the data networks use to identify and block scam numbers, which is one of the mechanisms the new rules lean on: acting on reports from users and third parties is an explicit duty on the business messaging side.
A single report will not shut a scam operation down. Thousands of reports across a network, though, is exactly the pattern that gets a number blocked before it reaches many more phones.
It costs nothing and takes about ten seconds, so there is little reason not to do it every time a scam text lands, rather than just deleting it and moving on.
If you are switching network anyway
Scam protection is not usually the reason people choose a network, but it is worth a glance while you are comparing. Our mobile bill explained guide covers what you are actually paying for each month, and our SIM swap fraud guide covers the more serious version of this problem, where a scammer takes over your number rather than just texting it. Our piece on spoofed calls covers the equivalent trick on the voice side.
Whichever network you end up with, the habits above matter more than which logo is on your SIM. No provider has a perfect record here yet.
Frequently asked questions about scam text messages
- What is 7726 and is it free to use?
- 7726 is the free short code every UK network uses to receive forwarded spam and scam texts, spelling “SPAM” on a phone keypad.
- Do the new rules cover WhatsApp messages?
- No. They cover SMS and MMS only. WhatsApp, iMessage and RCS are outside them, because Ofcom’s powers here rest on services that depend on telephone numbers. RCS is the one to watch, since it looks like an ordinary text on many Android phones.
- Can a scam text really come from my own phone number?
- Yes. Number spoofing lets a scammer display any number they like, including yours, so it is not proof your phone or account has been compromised.
- When exactly do the rules take effect?
- Phone-to-phone messaging duties from 18 January 2027, and business messaging duties, including verification of sender names, from 15 July 2027.
- Should I reply to a scam text to unsubscribe?
- No. Replying, even to opt out, can confirm to the scammer that your number is active and reachable.
- Will these rules stop scam calls too?
- No, this package covers mobile messaging. Scam calls are dealt with under separate Ofcom rules.
Ofcom’s rules are a genuine step forward, and the sender name verification in particular should take the shine off the most convincing fakes. But none of it is live yet. Until it is, the free habits above are doing the actual work.
Sources
- Ofcom, New rules to thwart text message scammers and protect consumers and businesses, 15 July 2026. The duties on providers, the pay-as-you-go volume limits, the Know Your Customer and Know Your Traffic checks, and Alphanumeric Sender ID verification.
- ISPreview, Ofcom introduce new UK rules to tackle mobile messaging scams. The 18 January 2027 and 15 July 2027 implementation dates, and the exclusion of WhatsApp, iMessage and RCS.
Checked 28 September 2026.
