Sender ID spoofing and the MEF registry in numbers

The last scam text that used the sender name "DVLA" was reported to the National Cyber Security Centre in May 2019. The NCSC says so in its Active Cyber Defence report for that year, and adds that the name "has not been seen since". Fraudsters carried on pretending to be the DVLA, from ordinary mobile numbers; what they'd lost was the one word that made the pretence work.

That's what a sender ID registry does when it works. The one the NCSC is describing is the SMS SenderID Protection Registry, run by the Mobile Ecosystem Forum (MEF), and it's one reason a sender name you ask for in the UK gets checked before anyone lets you use it. The numbers behind it are scattered across Ofcom consultations, NCSC reports and operator announcements, so here they are in one place.

What the registry is

A sender ID is whatever a phone shows as the sender of a text: a number, or an alphanumeric name of up to 11 characters. The name is a string in the message header. Nothing in SMS itself ties "DVLA" to the DVLA, which is why a scammer could type it as easily as the agency could. (Our guide to UK sender IDs covers the formats.)

The registry is the industry's fix for that. The NCSC's description, from its report on the fifth year of Active Cyber Defence, is the clearest one going: brand owners "register authorised SenderIDs/alpha tags, define their SMS delivery chains (that is, the SMS aggregators they choose to deliver their traffic), and ... provide a list of unauthorised SenderIDs that they have already seen abused". Participating aggregators consult that list and decide whether to deliver or drop what passes through them. An authorised name arriving by the expected route goes through. The same name by another route, or a lookalike such as DV1A, "should not get delivered to users".

Three things follow. The registry blocks nothing itself; texts never pass through it, and the filtering is done by the aggregators and networks that have signed up. It protects names somebody has registered, so a brand nobody has listed gets no protection at all. And the brands pay for it: Ofcom's October 2025 consultation describes it as "a cross-sector sender ID registry, which brands can pay to join".

MEF's own account, in its 28 January 2026 response to that consultation, dates the registry to 2018, backed by the NCSC, UK Finance and Mobile UK, and says it now covers five territories: the UK, Ireland, Spain, the Crown Dependencies and the Cayman Islands. The NCSC puts the UK registry coming online in mid-2019, with HMRC and the DVLA its first government users.

The numbers, 2020 to 2025

The earliest public count comes from one of the networks. Vodafone's news centre on 28 April 2020, announcing the push against Covid-19 scam texts, said that "so far" the trial was protecting 50 bank and government brands, had 172 trusted sender IDs registered, and had blocked more than 400 unauthorised variants, 70 of them aimed at the government's coronavirus campaign. Fourteen banks and agencies were taking part, with EE, O2, Three and Vodafone all supporting the trial.

Five and a half years later the figure Ofcom quotes, in paragraph 4.37 of its consultation on mobile messaging scams, is "over 700 trusted sender IDs and a blocklist of over 3,750 unauthorised sender ID variants". The statement that followed in July 2026 repeats the same two numbers.

Four times the registered names, then, and nine times the blocklist. The ratio is the interesting part. For every name a brand has registered there are more than five variants on the list of things people have tried instead: a zero for an O, a word tacked on, a letter dropped. Those are names a fraudster has already used, and been caught using, against a brand that was paying attention.

Ofcom's view, in the same paragraph, is that "these measures are having an impact in protecting listed brand names". The footnote says where that comes from: a sample of texts with alphanumeric sender IDs reported to 7726, of which a minority (30%) looked like an attempt to impersonate a real brand. The word "listed" is doing some work there. We'll come back to it.

What it stopped, in the NCSC's words

The NCSC has written up the registry's effect twice in its Active Cyber Defence reports, and both accounts are worth reading because they're the only published before-and-after we have.

The third-year report (covering 2019) describes HMRC, which had already tightened its SMS use in 2017 and seen public reports of fake HMRC texts fall "dramatically". The attacks that carried on used near-miss names: "Gov Tax", "HMInfo", "HMRCUK". Once HMRC logged those in the registry as unauthorised, the NCSC says, "they saw a 70% drop in public reports as the attacks were blocked by participating aggregators before they ever reached their intended targets". The DVLA saw the same thing, and both agencies then watched the attacks move to ordinary mobile numbers (the NCSC calls them long number MSISDNs) from June 2019 onwards. By the end of 2019 TV Licensing had been invited in.

The fifth-year report (covering 2021) is about the pandemic. The registry was used to protect vaccine messaging, then the Covid Pass, then the Census. Early in the year fraudsters started spoofing short codes to make texts look real, so merchants were told to register those as well. Royal Mail, which the NCSC calls "one of the most abused brands" of the year, was onboarded quickly with MEF's help. The outcomes section says the DVLA and TV Licensing "no longer appear in the 'most abused brands' statistics", and the NCSC describes a registry that "has become extremely successful" and needs to move "from a trial solution that now has a track record, to an industrialised solution".

The NCSC's account is also honest about the limit. A registry stops a name being spoofed. It doesn't stop the fraud; it moves it, to a number the target doesn't recognise, which is a worse disguise and a smaller catch for the scammer.

Where the gap is

Ofcom's consultation looked at a sample of 4,000 reports to 7726, the free number for forwarding scam texts. Of those, 137 were scam texts sent under an alphanumeric sender ID, and Ofcom "determined that around 65% were using fabricated or obscure business names, which did not appear to be associated with a real company". The conclusion in paragraph 4.38 is that existing industry efforts on sender IDs "are not consistent and this leaves them open to abuse by scammers".

That's the hole a registry can't fill. It protects the names on its list, and a made-up name is on nobody's list. A text from "ParcelHub-UK" or "Account Team" isn't impersonating a registered brand, so there's nothing to match it against, and it sails through any provider that let the sender pick it without asking what they do. The scale of what gets through is in Ofcom's survey work: 50% of UK mobile users said they'd had a suspicious text or iMessage between November 2024 and February 2025, and an estimated 100 million suspicious messages were reported to the operators via 7726 in the year to April 2025. By Ofcom's February 2026 survey the three-month figure had come down to 40%. (The wider fraud numbers are in our post on smishing in the UK.)

Ofcom's decision: rules for everyone, no mandatory registry

Ofcom did consider going the way of Ireland, Singapore, Australia and Italy, which it says "have centralised registration rules". Its view, in paragraphs 5.150 to 5.154 of the consultation, is that a mandatory registry "could be an effective means to achieve our policy objective" and could be "particularly effective in preventing brand impersonation tactics used by scammers", but that the cost would land on small and medium sized businesses "even though they are not likely to be spoofed by scammers". So it didn't propose one.

The responses split. BT and techUK agreed a registry would be burdensome. Which?, Twilio and The Campaign Registry wanted one, as "a single, reliable source for verifying sender IDs". VodafoneThree said Ofcom should push wider take-up of the MEF registry instead. MEF itself opposed a regulator-run registry (public funding, slow to build) while arguing that mandatory registration "combined with declared use cases" would work better than content filters, because carriers "apply phrase-based content filters without the necessary sender or use case context" and block legitimate texts as a result. Ofcom held its position in the 15 July 2026 statement, under a heading that says it plainly: "We are not introducing A2P sender ID registration at this time."

What it introduced instead applies to every provider that carries business texts. From 15 July 2027, operators and aggregators must run "Know Your Customer" checks on new business senders, corroborate the sender IDs they ask for against what the business does (Ofcom's example: a business that says it's a hairdresser shouldn't be sending parcel delivery texts), keep a policy on protected sender ID lists and on generic names such as "customer service", and act on fraud reports by blocking the sender IDs, links and numbers involved. The person-to-person rules, on pay-as-you-go SIM volumes and the like, start earlier, on 18 January 2027.

Ireland went the other way, and it's a useful comparison. ComReg's registry has labelled texts from unregistered sender IDs as "Likely Scam" since 3 July 2025, and a blocking phase due to start on 3 October 2025 was deferred in September. Its public counter on 15 October 2026 showed 22,092 registered sender IDs from 16,301 owners, in a country where ComReg estimates 615 million business texts were sent in the whole of 2024.

Thirty times as many names registered, for a market a fraction of the UK's size. That's the difference between a registry that brands worth spoofing pay to join and one every sender has to use or be labelled a scam. Whether the UK gets there eventually, Ofcom's statement leaves open with those three words, "at this time".

What this means when you ask for a sender name

Most UK businesses will never join the MEF registry. A florist is not a target for impersonation, and the registry is priced for banks. What the numbers above do explain is what happens when you ask your texting provider for a name.

Pick something built from your trading name. Whoever checks the request compares it against the registry's protected list and its blocklist, and anything close to a bank, a government body or a delivery company gets refused, however innocent the reason. "Crown Dental" is fine. "DVLA-Dental" is not, and neither is anything with a zero where an O should be.

Expect to be asked what you do, and for the name to be matched against the answer. That's Ofcom's hairdresser test, and from July 2027 it's compulsory everywhere. A provider that doesn't ask is the kind the fabricated-name scammers use.

Keep one name and use it every time. The NCSC's look at 7726 data found "a lot of genuine messaging is reported as spam", and a name customers have never seen before is the usual reason. If you'll want replies, remember that a name can't receive them; one-to-one texts from a number are the better choice for anything conversational, and our sender ID page sets out when to use which.

If you are a brand people would bother to spoof, the registry is where to go, and the NCSC reports are the evidence for what it does: HMRC's 70% drop, the DVLA off the abused-brands list, Royal Mail onboarded in a bad year.

CaptiFi Connect reviews every alphanumeric sender name before it can be used, including a check against the MEF registry, and a person looks at each new account before it can send a text. The names that pass are the boring ones, built from the business's own name. The NCSC last saw "DVLA" on a scam text in May 2019.