Summary

  • Ofcom found that Tismi lacked appropriate due diligence, a process to reassess misuse risk after transfers, and a formal system for handling and consistently recording reports.
  • About 366,000 numbers were exposed to potential misuse over two years. Ofcom did not report how many were actually used in scams or how many people suffered harm. The penalty was £437,500.

A phone number can travel through several businesses before it reaches the screen where a call appears. Each hand-off creates a small question with a large answer: who checked the next customer, and who kept the record when someone complained?

Ofcom’s case against Tismi answers that question with an unusually plain failure. The UK regulator found that the provider did not carry out appropriate due diligence on customers receiving numbers, did not reassess misuse risks after numbers were transferred or monitored, and had no formal process to handle and record reports consistently. The breaches ran from 15 November 2022 to 1 January 2025 and covered General Conditions B1.6, B1.8 and B1.9(c).

The scale was not abstract. Ofcom said roughly 366,000 numbers were exposed to potential misuse over two years and found evidence of nuisance and scam calls using numbers sub-allocated by Tismi. The figure describes the pool exposed to risk. Ofcom did not report how many of those numbers were actually used in scams or how many people suffered harm. Ofcom also recorded prompt responses by Tismi to some enquiries and complaints from outside agencies. That is useful response evidence, but it is not a substitute for a consistent system that captures every report and turns it into an account of what happened.

The distinction matters because a telecom number is both a routing input and a borrowed public identity. A recipient can use it to reach customers; a caller can also use the number displayed on a screen to borrow a sliver of trust. Due diligence tests who receives that capability. Monitoring asks whether the risk changes after hand-off. A report log lets the supplier connect a complaint to the customer, number range, action and outcome. Without those links, each control is an isolated promise.

Ofcom opened the investigation on 16 October 2024. It directed Tismi in June 2025 to block certain numbers; Tismi had implemented the direction by 24 June. The regulator says Tismi introduced new processes a few months after being informed of the investigation. The case closed on 21 October 2026 with a £437,500 penalty, reduced from £625,000 by 30% for admission and settlement savings. Ofcom now requires evidence of checks, monitoring and response. The missing evidence is the point: a safeguard that cannot leave a record is difficult to distinguish from a safeguard that never happened.

The public confirmation decision will supply fuller particulars. It is not yet available, so the public record does not identify every customer, call or victim. What it already establishes is enough to locate the control failure: three obligations converged on a basic operating discipline—know who receives numbers, revisit risk, and keep an auditable account of reports.

Sources