24 October 2026 | Community Smart Hub
Your phone rings. The number looks like an ordinary UK number. The caller says they work for your bank, a delivery company or someone you already do business with. They may even know your name.
Would that make you trust the call?
A decision announced this week by the UK’s communications regulator, Ofcom, is a reminder of why a phone number is not proof of identity.
What happened this week?
On 21 October 2026, Ofcom fined telecoms provider Tismi £437,500 after finding that it had failed to put appropriate safeguards in place to prevent telephone numbers allocated to it from being misused, including for scams.
According to Ofcom, approximately 366,000 numbers were exposed to potential misuse during a period of serious failings extending from at least November 2022 to January 2025.
The regulator identified inadequate checks on business customers, insufficient monitoring for misuse and a lack of a formal process for handling reports.
An important distinction: Ofcom did not say that all 366,000 numbers were used for fraud or that 366,000 people were scammed. It said those numbers were exposed to potential misuse because necessary controls were missing. Read Ofcom’s announcement.
Why a real number may still be untrustworthy
There are two different problems worth understanding.
Number spoofing is when a scammer makes a call appear to come from a number that is not actually theirs. Your screen might show a bank’s number or a familiar local number even though the call originated elsewhere.
Misuse of a valid number happens when somebody can obtain or use a genuinely allocated telephone number for dishonest purposes.
Providers are expected to check their business customers and respond to signs of misuse. The Ofcom case concerns failures to put those safeguards in place.
These problems are different, but the lesson for the person receiving the call is the same:
A familiar-looking number, on its own, cannot tell you whether the caller or the request is genuine.
Ofcom also warns that criminals can fake the number displayed on caller ID. Read its guide to scam calls and messages.
What changes when AI enters the picture?
An impersonation attempt may now involve more than a persuasive script.
AI tools can generate convincing messages and synthetic voices that sound like someone you know. That makes it even more important to verify a request independently, rather than judging it by how professional the caller sounds.
There is no suggestion in Ofcom’s Tismi announcement that AI voice cloning was involved.
The connection is a wider safety lesson: a believable voice, a recognised name and a legitimate-looking number are all signals, not permission to hand over information or move money.
The UK Government has separately identified AI-generated impersonation of loved ones as an emerging deepfake threat. Read the government case study.
Five safer steps when a call seems urgent
- Stop before acting. If someone unexpectedly asks you to transfer money, reveal a security code or change payment details, you do not have to decide during that call.
- End the call and make contact yourself. Use a number you already trust, such as the one printed on your bank card, saved in your organisation’s approved contacts or listed in its official app. Do not rely on a callback number supplied by the caller.
- Keep security details private. Do not reveal passwords, PINs, one-time security codes or account recovery information. Do not move money to a supposed “safe account” on an unexpected caller’s instructions.
- If you have already shared details or sent money, act quickly. Contact your bank or the affected service using independently verified contact details. Explain what happened and follow its security and recovery advice.
- Report it. In England, Wales and Northern Ireland, use Report Fraud or call 0300 123 2040. In Scotland, report fraud to Police Scotland on 101. Forward suspicious SMS messages to 7726; report messages received through WhatsApp and similar apps using their in-app tools.
See Ofcom’s advice on what to do about a scam call, text or message and Report Fraud’s contact information.
Practise the decision, not just the warning signs
Imagine a caller says they are from a supplier your community group uses.
They have your organisation’s name, a UK telephone number and an invoice reference. They say the supplier’s bank account has changed and payment must be made in the next hour.
What would you do?
The safest next step is not to guess whether the voice sounds real.
It is to pause the payment and check the request through a previously trusted contact route and your organisation’s approval process.
This is the approach we practise in Community Smart Hub’s AI Trust Lab, including our Five Questions Behind a Digital Claim investigation.
Participants learn to ask:
Did the message come through the expected route? Who is actually making the request? Do they have authority to make it? Has the document changed? Does the story match independent evidence?
You do not need specialist technical knowledge to use the most important protection: end an uncertain conversation and verify the request independently.
At Community Smart Hub, our community training helps people practise those decisions using safe, fictional scenarios involving suspicious messages, altered invoices and synthetic media.
The goal is not to make everyone an AI expert. It is to help more people feel able to make a safe next decision.
Remember: the number on your screen may be real. The request still needs checking.
