Smishing in the UK: what the fraud figures say

Four in ten UK mobile users got at least one suspicious text in the three months before Ofcom surveyed them in February 2026. The figure is in the statement Ofcom published on 15 July 2026, and it comes with a back-of-envelope sum attached: 40% of 55 million adults is around 22 million people, and if each of them gets one such message every three months, that is "in the order of 100 million" scam texts a year landing on UK phones. Ofcom adds "potentially substantially more". Those are the ones that get through. The operators blocked at least 600 million on top.

Smishing, if you've not met the word, is phishing by SMS: a text that pretends to come from a courier, a bank, HMRC or the surgery and asks you to tap a link or ring a number. If you text customers for a living, every one of those 100 million makes yours a little harder to trust.

What the fraud figures say

The money figures come from UK Finance, the trade body for banks and payment firms, which publishes an Annual Fraud Report each summer from its members' data. The 2026 edition, covering 2025, puts total losses at £1.28 billion across authorised and unauthorised fraud, up 4% on 2024 and the highest since 2021. Cases reached a record 4,062,198. Authorised push payment fraud (APP, where the victim is talked into sending the money themselves) rose 19% to £576.4 million across 248,070 cases.

None of that is a smishing figure on its own. The closest UK Finance gets is a table of what it calls APP fraud "enablers", built from case data that records where the victim says the scam started. For 2025, 66% of APP cases started online (mostly lower-value purchase scams, so 32% of the losses) and 17% started through telecommunications, which the report describes as "usually higher value cases such as impersonation scams", accounting for 28% of losses. Telecoms here means calls and texts together; the report doesn't split them.

Two things stand out in that table. The telecoms share of cases has barely moved in four years: 18%, 16%, 16%, 17%. The share of money has fallen a long way, from 45% of APP losses in 2022 to 28% in 2025, while the "unable to ascertain" row has grown from 4% of losses to 24%. So some of that fall is scams the banks can no longer trace to any channel, and UK Finance says as much: the victim "will not, in every case, be aware of where the initial compromise happened".

The scam type most tied to texts is impersonation of police or bank staff, which UK Finance says often begins "with a phone call or text message" claiming there has been fraud on the account and the money must move to a "safe account". That category fell to £55.5 million and 6,016 cases in 2025, both the lowest it has ever recorded, with 80% of the losses returned to victims. Impersonation of other organisations (a utility, a phone company, a government department, usually about a fine, a tax bill or a refund) came to £36.9 million across 18,435 cases.

Ofcom's own estimate of what messaging scams cost is smaller than people tend to assume. Combining the UK Finance figures with Crime Survey data on how scams first make contact, it puts the loss from messaging scams at "approximately £50 million" a year. It also quotes the Payment Systems Regulator's analysis of 2023, in which around £107 million of the £340 million of APP losses examined started with a voice call or text message: over 27,000 scams, about £4,000 each. Tens of millions, then, out of a hundred million messages. Most scam texts fail. The damage they do on the way to failing is to the trust in every other text.

How many get through, and how many get reported

Ofcom has asked the same survey question since 2021, and the trend is down. In September 2021, 75% of mobile users said they'd had a suspicious text in the previous three months. In February 2025 it was 50%. In February 2026, 40%. Ofcom offers two explanations without choosing between them: the operators' blocking has improved, and people send fewer texts of any kind, so there is less for a scam to hide among. (The second point is the subject of our post on how many texts the UK still sends.)

The blocking numbers are large. From formal information requests to the operators, Ofcom found they blocked just over 30 million messages a month on average between May 2024 and March 2025, passing 50 million a month in February and March 2025. Mobile UK, the operators' trade body, reported over 166 million scam messages blocked in the first quarter of 2026. Hence Ofcom's "at least 600 million" a year.

Then there's 7726, the free number you forward a dodgy text to. When Ofcom set out its proposals in October 2025, the four network operators had told it their customers made 89.8 million 7726 reports between May 2024 and March 2025, more than 10 million a month from December 2024 onwards once one-tap reporting arrived on iPhones. Over the full year to March 2025 the count passed 100 million, and that excludes the larger virtual operators, about 7% of the market. Awareness is the odd part. In the February 2025 survey only 18% of mobile users said they were aware of 7726 and 72% had never heard of it or any other reporting number; a year earlier it was 15%. A hundred million reports from fewer than one in five people tells you how much of this is arriving.

The NCSC runs the other reporting route. Its phishing scams collection page, read in October 2026, showed 59.6 million reports to the Suspicious Email Reporting Service as of September 2026, with 263,700 scams removed across 466,300 URLs. Its page on scam texts gave the 7726 side of the same effort as 41,900 scams removed across 93,300 URLs. Our post on what happens when someone reports your text to 7726 follows a report through the system.

What a scam text copies from a real one

Ofcom's 2024 research asked people what kind of suspicious text they'd had. The winner, by a distance, was a message "from a courier company/Royal Mail which asks me to click on a link", which 51% of mobile users had received in the three months to January 2024. A message from an organisation asking them to call a number came next on 14%. In the February 2025 wave, 51% of SMS users again reported the courier-style link text.

That's the template. Short, a brand name, a reason you'd half expect (a parcel, a refund), a link, and a nudge to act now. It works because it looks like the texts people really get. The one part a scammer can't easily fake is the sender, and even that has a hole in it. Ofcom's statement explains that with access to business messaging services a scammer "may be able to send messages with an alphanumeric sender ID, so that their messages appear to the recipients to come from a named organisation (such as 'HMRC')". Ofcom went through a sample of 4,000 7726 reports and found 137 that were both scams and sent under an alphanumeric sender ID. Of those, around 65% used "fabricated or obscure business names" that matched no real company, and a minority, about 30%, were trying to pass as a real brand. Loose controls on sender names at the bottom of the supply chain, in other words, and that's what the new rules go after.

What people check before they trust a text

The same Ofcom survey asks what people weigh up when deciding whether a text is genuine. The February 2025 answers are below, and they are the most useful rows in this post if you write texts for a business.

Expectation comes first. 77% said they consider whether they were expecting the text at all, 73% the spelling, grammar or tone, 70% whether it asks them to do something. The look of the URL in a link scores 55%, and 49% consider whether they've had texts from that name or number before. Whether a company is named at all is down at 44%, and whether that named company is trustworthy, 32%. A brand name on its own buys you less than you'd think. People trust a text because they were waiting for it, it reads properly, and it comes from a name that has texted them before.

What they do with a suspicious one is blunt. In the 2024 wave, 63% of people who'd had a suspicious text blocked the number, 54% deleted it, 30% checked whether the number was real, and 25% reported it. Only 2% clicked the link and did what it said. Your real text, if it looks like a scam, gets the same treatment: blocked, and that's your number gone for that customer.

The rules arriving in 2027

Ofcom's July 2026 statement, Combatting mobile messaging scams, turns all this into obligations on the networks and on the aggregators that carry business texts. The ones that matter for a business sender: operators and aggregators must run "Know Your Customer" checks on new senders and "Know Your Traffic" checks on what they send; they must prevent fake alphanumeric sender IDs by checking a requested name against information about the business; they must keep a policy on protected and generic sender IDs (Ofcom's example of a generic one is "customer service"); and they must act on scam reports to block sender IDs, links and numbers. The person-to-person rules (volume limits on pay-as-you-go SIMs, blocking of known scam numbers) take effect on 18 January 2027, and the business messaging rules on 15 July 2027.

Most of this already happens at any careful provider; the rules make it compulsory everywhere, which is the point. For a sender it means that picking any name you like and sending the same afternoon is on its way out, and that a name which looks like a bank or a government body will be refused. Our guide to UK sender IDs covers what gets approved and why.

How not to look like a scam

Put the survey rows next to the scam template and the advice is mostly obvious. The surprising bit is how much of it comes down to habit.

Send texts people expect. Tell them at sign-up what you'll text and from what name, then do exactly that. An expected text passes the first and biggest test (77%) before anyone has read a word of it.

Put your name first, every time, and keep the same name and number. "Crown Dental: your check-up is on Thu 19 Nov at 10:30. Reply C to confirm." The 49% who look for a name or number they've seen before are checking for consistency, which a rotating or shared number throws away.

Don't ask for the things scams ask for. No "verify your account", no "update your payment details", no "urgent action required". If a customer has to pay, point them at the way they already pay you, and say so in the text.

Treat links with care, because 55% of people look at them. A link on your own domain reads as yours; a generic shortener reads as nobody's. If you track clicks, use a branded short link, and don't put a link in a text the customer wasn't expecting.

Write it properly. Spelling, grammar and tone are the second thing checked. One stray capital or a "Dear customer" and you've matched the pattern.

Make replying easy and act on replies. A text that answers "Reply C to confirm" with a human is the opposite of a scam, and a customer who can reply "is this you?" and get a yes will keep trusting the number.

Expect your sender name to be checked, and pick one that survives it. CaptiFi Connect reviews every alphanumeric sender name before use, including a check against the MEF SenderID Protection Registry, and a person looks at each new account before it can send; the sender ID page explains what that means in practice.

Ofcom's 100 million suspicious texts a year works out at a bit under two a month for every adult in the country. The text you send lands in the same inbox as those, and gets judged on the same first question: was the customer expecting it?