Summary

  • In a survey presented to BEREC, regulators from all 28 EU and UK countries responded; 23 countries had anti-fraud legal or regulatory instruments, while respondents in only three considered their instruments sufficient.
  • Twenty-two countries blocked calls considered scams. Cross-border traceback and information-sharing authority are the sticking points in the regulators' workshop report.

Europe has fitted many phone networks with a stop button. It has been slower to agree who may pass the warning to the operator on the other side of a border. That is the awkward picture in BEREC's published account of its anti-fraud workshop. The report draws on a presentation of surveys sent to regulators and mobile providers in 28 countries, the EU members plus the United Kingdom. All 28 regulators and 83 mobile service providers responded.

The numbers deserve to be kept in their own boxes. Twenty-three countries reported legal or regulatory anti-fraud instruments. In only three countries did respondents consider those instruments sufficient. Twenty-two countries block calls judged to be scams; nine have an SMS Sender ID registry, and five have instruments that permit some checking of message content, such as a suspect link. BEREC does not say these are the same countries, or count how many fraudulent calls each block prevented. A stop button, a rule allowing it and proof that it works are three different records.

ComReg's presenter described the practical seam. Mobile providers want to exchange fraud signals within a country, between sectors and across borders. In the survey, they saw privacy and data-protection requirements as obstacles to that sharing. That is their reported assessment, not a finding that all such exchanges are unlawful. ComReg said it cannot currently require operators to scan SMS content without a suitable legal basis. A scam can start as a text and shift the conversation to an internet messaging service, changing who sees the next clue.

Europol's contribution located the same fault line at the border. A spoofed caller identity can be cheap to manufacture, while tracing the call's origin and route through several networks is hard when operational data are sparse. Europol described work with regulators and standards bodies on traceback recommendations. The point is governance as much as engineering: a carrier can flag traffic, but each handoff needs a lawful actor, usable evidence and a recipient able to act.

The European Commission has proposed a larger coordination desk in the Digital Networks Act. As BEREC's report describes its draft Article 103, providers and national authorities would cooperate; a future Office for Digital Networks would gather information about fraud schemes with Europol and ENISA; BEREC would develop technical and legal guidance after consulting the European Data Protection Board and ENISA. The Commission also envisages delegated acts if guidance proves inadequate. That is the proposed route through a legislative process. Today, the report is a survey and a workshop record, not a new EU blocking order.

Sources