Summary

  • Ofcom launched a call traceback proof of concept on 3 November. It plans to start at the terminating provider and follow each upstream handoff until it finds the origin, the UK entry provider or a provider that fails to reply.
  • The regulator will initially use formal section 135 information requests with one-to-two-working-day deadlines because call records may not last long. The trial has no published success rate yet.

Start at the receiving end

The number on a screen is a poor map of the route a call took. In its 3 November industry notice, Ofcom set out a proof of concept that asks the terminating communications provider which provider delivered a suspected scam call. It may also ask the holder or suballocatee of the displayed number whether the call came from its customer. If the answer is no, the inquiry moves upstream provider by provider.

Ofcom says the trace will stop when it reaches the originating provider, identifies the provider that brought the call into the UK, or encounters a provider that does not respond. It intends to walk the chain systematically even if other intelligence already points toward a likely origin. The method values a documented handoff over a shortcut that cannot be reconstructed later.

The initial tool is a formal request under section 135 of the Communications Act 2003. Ofcom says a response must be clear, complete and accurate by the deadline; failure may lead to an investigation and a significant financial penalty. Section 137 also requires the demand to describe the information sought, give reasons and be proportionate.

The clock travels with the call

Ofcom expects to give providers just one or two working days. Call data, it says, may not be retained for extended periods. Requests will arrive in final form at first, without a draft stage. A recipient should preserve the specified records immediately and report any difficulty. The regulator says genuine requests will come from an @ofcom.org.uk address, a detail worth checking before moving call metadata.

The published form asks for a traceback ID, the downstream provider, presented and network calling numbers, destination number, start and end times, and relevant call patterns. Each provider must say whether it routed the call to the named downstream company, whether it originated the call or holds the number, who sent it the call, and whether it changed the number in transit. That last handoff is the information the next request needs. A caller ID alone cannot fill the gap left by a silent carrier.

The proof of concept should run for several months, with an initial review early in 2027. Ofcom will examine whether traces succeed, how useful the information is for supervision and enforcement, and the resource burden on providers and itself. Its launch notice gives no completed trace, penalty, response-time distribution or measured reduction in scams.

Sources