Summary

  • Ofcom’s September guide explains how UK communications providers can share fraud-related data under existing law; it is joint guidance, not a blanket disclosure mandate or a new power to access customer records.
  • The hard operational question is whether shared information remains accurate, proportionate and clearly labelled as fact, indicator or suspicion—and whether an unfounded signal can be corrected.

Fraud often crosses a boundary before a provider can see the whole pattern. A call may enter through one wholesale carrier, reach a retail service, imitate a bank and prompt a victim to move money through a separate institution. Each participant holds a fragment: a number, a traffic pattern, a customer complaint or a receiving account. The fragmented view is a problem for detection. Combining the fragments can create another one: a suspicion about a person or business may travel farther and faster than the evidence that produced it.

Ofcom’s September 2026 announcement points to a new practical guide for UK communications providers on sharing data to tackle fraud. Comms Council UK, the Home Office and Ofcom developed it, with input from the Information Commissioner’s Office. Ofcom encourages providers to take account of it. That institutional arrangement matters, but it does not turn the document into a new statutory gateway or a command to disclose every suspicious record. The guide is a route through existing frameworks, intended to make providers more confident about when, what and how to share.

The legal footing changed earlier in the year. The Data (Use and Access) Act 2025 added a recognised legitimate-interest basis for processing necessary to detect, investigate or prevent crime, including fraud. The relevant provision took effect on 5 February 2026. The guide says a provider relying on that basis need not complete a separate legitimate-interests assessment. That is a meaningful reduction in one procedural step. It is not permission to send any personal data to any recipient: necessity remains part of the statutory condition, and the rest of the data-protection framework still governs what happens to the information.

The guide asks providers to make the decision concrete. What harm are they trying to prevent? Is the information likely to help? Can the purpose be achieved with less identifiable data? Is the recipient appropriate? Are access limits, anonymisation, pseudonymisation or a sharing agreement suitable? What was sent, to whom, for what reason and with what expected result? These questions turn “fraud prevention” from a general label into a record that can be reviewed later.

That record needs to preserve distinctions in the underlying evidence. The guide tells providers to check that information is accurate, current and clearly separates fact from suspicion. A traffic spike, an invalid calling-line identity or a customer complaint may be a useful indicator. None alone establishes who caused it, whether a customer acted deliberately or whether a business is culpable. A defensible notice should describe what was observed, when and by whom, while identifying inference and uncertainty. If a concern is later found to be unfounded, the source says the provider should record that and update the relevant scheme.

The distinction between anonymised and pseudonymised information is similarly consequential. A telephone-number list can look anonymous after names are removed, yet remain personal data if a provider or recipient can reconnect numbers to people. Broad call patterns can also permit identification when combined with other information. The guide recommends reducing identifiability where possible, but does not treat a token, hash or aggregate as a substitute for asking what the recipient can infer.

Existing schemes give providers a way to avoid building every exchange from scratch. The guide maps policy bodies, data-sharing organisations and operational data feeds, naming groups such as Cifas, the Telecommunications UK Fraud Forum, the Cyber Defence Alliance and National Trading Standards. Its supporting document describes examples that move telephone numbers, call records, domains, malicious-message keywords and other information between organisations. A shared scheme can supply a recipient, a process and established expectations.

It cannot automatically validate every incoming allegation or decide what consequence another company should impose.

The supporting material also shows why “impact” must be read carefully. One example reports that 1,275 numbers were removed from use in the fourth quarter of 2025 and that 300 to 400 more were being removed each month, while the problem continued to grow. A Cyber Defence Alliance case says 491 businesses called by a number associated with vishing were referred to banks for monitoring or investigation; the document explicitly says it did not know how many of those businesses experienced fraud or how many losses were prevented.

Cifas reports two million active National Fraud Database cases, 444,000 filings in 2025 and £2.1 billion in savings reported by members.

Those figures can show activity, reach and operational scale. They do not share a common denominator, and the guide does not present them as an independently audited causal estimate of losses avoided. Numbers withdrawn from use are an output; the number of people protected is an estimate; a case referral is not a confirmed victim; and member-reported savings are not a counterfactual study. The material is useful as an inventory of working mechanisms, not proof that every channel performs equally well.

The guide also names limits that data-protection analysis cannot settle on its own. Competition law and rights of defence sit outside its scope. Information shared for fraud prevention should not become a pretext for competitors to coordinate commercial exclusions. Providers are asked to distinguish intelligence-sharing from using shared information as the basis for a collective decision to refuse interconnection or business. If an operator is accused, it needs a path to understand and challenge the information; if a customer is misidentified, a correction must reach the same network of recipients that received the original signal.

The September document therefore adds connective tissue to a system already composed of law, regulators, carriers, banks, fraud-prevention organisations and law enforcement. Its contribution is practical: it makes the legal and operational route more legible, particularly for smaller providers. Its success should be judged by the quality of the decisions and corrections that follow—not by the fact that a guide was published, by the number of records exchanged, or by an unqualified claim that sharing has prevented a stated amount of fraud.

Sources: Ofcom announcement and guide; supporting case examples; Data (Use and Access) Act 2025, Schedule 4; commencement regulations.; ICO guidance on pseudonymisation; ICO guidance on sharing personal information to tackle scams and fraud; UK telecommunications fraud sector charter; UK Fraud Strategy 2026–2029; Ofcom guidance PDF for telecoms providers