What happens when someone reports your text to 7726

Somewhere in the UK, about three times a second on average, someone looks at a text, decides they don't like it and presses "Report Junk". Ofcom's count for the year to April 2025 was an estimated 100 million messages reported through 7726, the free reporting number the UK mobile networks run. Most of those were scams. Some were sent by businesses that had no idea they'd been reported at all.

If you text customers it pays to know what that button does: where the report goes, who reads it, and what happens to the sender. One report on its own isn't supposed to get you blocked, and the reason why tells you what to avoid.

Where a 7726 report goes

7726 spells SPAM on a phone keypad, which is the whole reason it was chosen. Ofcom's page on it, updated in August 2026, gives the mechanics. On an iPhone you "tap and hold on the message, tap More, then the forward arrow, and send to 7726", and on Android it's "tap and hold on the message, tap Forward, and send to 7726". Forwarding is free. Ofcom says the report "alerts your mobile provider to investigate and potentially block the number", and that's the regulator's whole description. It's accurate as far as it goes. The report lands with the network the phone is on, not with Ofcom and not with the police.

The networks say more about what they do next. Vodafone's page calls 7726 "the industry's SMS scam/spam reporting service" and describes the routine: "We will acknowledge this and ask you to send details of the number the SMS you received was sent from." Then "reported SMS are collected and analysed for scam and spam content", and the analysis goes into "the effectiveness of our SMS filters and other mechanisms we use to suppress SMS scams and spam". The next line is the one for senders. "This is done nationally so information shared by you to 7726 is made available to all UK mobile operators." A report from one Vodafone customer is visible to the other networks as well.

It travels further than the networks, too. Vodafone lists the ICO, which "investigates and takes action where it believes that SMS involves inappropriate marketing", and the NCSC, which "will examine whether there is evidence of fraud". The contents of a reported text "may also be shared with law enforcement where this provides evidence", and with Ofcom and "government, commercial and other organisations targeted by SMS frauds". O2's help page, last updated in July 2025, says the same thing in fewer words: "If appropriate, we'll report it to the Information Commissioner's Office (ICO)", and where fraud has followed, "we may need to report the experience to Action Fraud".

So one tap on a phone can, in principle, put your text in front of four networks, the data regulator, the national cyber security agency and the police. Ofcom's guidance says providers may use automated tools or human review to sort the reports, and the ones that get acted on are the scams, but the route exists.

How big the pile is

Ofcom's July 2026 statement on messaging scams puts numbers on it, from data the operators had to hand over. Customers made "a total of 90 million 7726 reports between May 2024 and March 2025 (inclusive), with an average of over 10 million per month between December 2024 and March 2025". The jump over the winter has a specific cause, which Ofcom names: "further implementation of one-click 7726 reporting by mobile network operators on Apple iOS devices". When reporting became one tap on an iPhone instead of a forward to a number nobody could remember, the volume went up. The 90 million leaves out reports made to the larger virtual operators, which Ofcom puts at about 7% of the UK mobile market in 2025, and Ofcom extrapolates from it to the 100 million estimate.

For scale, the same statement says the operators' own detection tools blocked an average of around 50 million messages a month between January and March 2025, which Ofcom rounds to "at least 600 million" blocked a year. Those never reached a phone. The 100 million reported are the ones that did.

And the share of people seeing them is falling, slowly. Ofcom has been asking mobile users since 2021 whether they've had a suspicious text in the past three months. The chart takes the answers from the 2024 research report and the two later Ofcom announcements.

From 74% of mobile users in 2021 to 68% in 2022, 56% in the survey run at the start of 2024, 50% for November 2024 to February 2025, and 40% in February 2026. Ofcom changed its questionnaire in 2025, so the later two points aren't a perfect match for the earlier three, and the question has always covered SMS, iMessage and RCS together. The direction is clear enough. Fewer people are seeing scam texts, and those who do have an easier way to report them, which is how the reporting figure went up while the receiving figure went down.

What people do with a text they don't trust

The 2024 report is the most detailed look Ofcom has published at what happens on the phone itself. Among the 1,136 people in the survey who'd had a suspicious text in the previous three months, blocking the number was the most common response at 63%, with deleting it on 54%. Reporting came fifth.

A quarter reported the text somewhere. Of those who did, 41% used the report function on the handset and 33% "a special number", which in the UK means 7726. Only 15% of mobile users had heard of 7726 at all in 2024, about the same as the 14% in 2022, and 76% said they'd never heard of it or any other reporting number. Asked why they hadn't reported a message, 39% said they didn't know who to report it to, 34% didn't think any action would be taken, and 34% didn't know how.

That was the position in early 2024. The iOS one-click change since then means a customer no longer needs to know the number exists. The handset's own report button and 7726 are now, on a lot of phones, the same thing. The report button is the easy option, and annoyed customers use it on real businesses as well as on scammers.

Can a legitimate text end up in the pile?

Yes, and the industry told Ofcom so in writing. In its response to the 2025 consultation, Mobile UK "raised concerns about the quality of 7726 reports, noting that genuine messages and unwanted spam are often reported as scam messages". Comms Council UK made the same point and called for Ofcom to require providers to apply checks before acting on a report.

Ofcom agreed, and the wording in the final statement is the part worth keeping. Reports "may contain incorrectly reported messages that are not scams, including commercial messages, spam or other content that the user simply did not want to receive". Operators are therefore expected "to interrogate such reports to filter out messages that they do not reasonably believe were intended to scam the recipients, to reduce the risk of false positives". The guidance that goes with the rules gives an example: providers should filter out "messages (such as commercial marketing messages)" and "may use automated tools or human review to carry out this validation".

That's a real protection, with a limit built in. A text that is plainly marketing, from a sender the network can identify, is supposed to be filtered out of the scam pile before anyone blocks anything. A text that looks like a scam is not. Ofcom's own sample shows what "looks like a scam" means. Its analysis of 4,000 7726 reports found 137 that were both scams and used an alphanumeric sender name, and of those "around 65% were using fabricated or obscure business names, which did not appear to be associated with a real company". A made-up name on a message that asks you to click something is the pattern the filters are built to catch. A legitimate business texting from an unregistered name nobody recognises, with a shortened link and no way to reply, is wearing the same clothes.

The rules also change what your provider has to know about you. From 15 July 2027, Ofcom's new conditions for business messaging require operators and aggregators to run "Know Your Customer" checks on new senders and ongoing "Know Your Traffic" checks on account activity and fraud reports, and to check alphanumeric sender names against what they know about the business. The person-to-person rules, including volume caps on pay-as-you-go SIMs, come in earlier, on 18 January 2027. 7726 reports stop being a side channel and become one of the inputs your aggregator is required to act on.

What a careful sender does about it

The practical response is texts that don't look like the ones in Ofcom's sample. Put your name in the first few words, and make it the name on the door. "Crown Dental: your check-up is on Thu 19 Nov at 10:30. Reply C to confirm." A registered sender name that matches your business is checkable, which is what the new corroboration rule asks for. A variant of a bank's name, or a generic word like "Alerts", is what the blocklists exist for.

Send only to people who are expecting you. The ICO's reporting form "takes about 5 minutes", it feeds investigations ("we will use the information you provide to help us investigate and take action against those responsible"), and the ICO doesn't reply to the reporter ("we don't respond to complaints individually"), so you'll never know a complaint was made until it matters. Someone who signed up last week doesn't fill that form in. Someone who has no idea who you are does. Our guide to the UK marketing rules covers consent, and it's shorter than a penalty notice.

Give people a way out that's easier than the report button. Ofcom's own advice to the public is to reply STOP to a sender they recognise and never to reply to one they don't. "Reply STOP to opt out" at the end of a marketing text turns an irritated customer into an opt-out rather than a 7726 report, and an opt-out costs you nothing. A report you never see, from a customer who has also blocked the number, is a different kind of loss.

Keep links boring. Your own domain, written out in full, pointing somewhere the customer expects to go. The courier message asking people to "click on a link" was the single most reported type of suspicious text in Ofcom's 2024 survey, named by 51% of mobile users, so a short unfamiliar link is the shape people have learned to distrust.

Keep a steady rate from the same sender name. The "Know Your Traffic" checks coming in 2027 look for accounts whose behaviour changes suddenly. A business that has sent 300 reminders every weekday for a year looks like what it is.

And read your replies. If a customer answers "who is this?" or "stop texting me", reply, and take them off the list. A two-way number means the complaint comes to you first, which is the cheapest place for it to arrive.

CaptiFi Connect checks every new account by a person before it can send, reviews sender names against the MEF registry before they're used, and handles STOP, UNSUBSCRIBE and the other opt-out words automatically on a two-way number, so the annoyed customer reaches you rather than their network. On Ofcom's count that network is reading over 10 million reports a month, and passing on what it learns to the others.