On 21 October 2026, Ofcom fined telecoms provider Tismi £437,500 for failing to stop its phone numbers being used by scammers. Ofcom found that Tismi had no proper customer checks, no monitoring and no process for handling misuse reports, which left about 366,000 numbers it had passed on to business customers exposed for more than two years. If you sell voice or dialer services under your own brand, you probably hand out numbers the same way.
On the same day, Ofcom opened a fresh investigation into another number holder, Xtra Phones UK, over concerns that numbers it holds are being misused. Read together, the message is clear. Ofcom isn’t just going after the scammers. It’s going after the companies whose numbers the scammers used.
What Ofcom found
Tismi held blocks of UK numbers and sub-allocated them, which means it passed them on to business customers who then used them. That’s a normal, legal business model. It’s also how most white label voice, dialer and contact center services work: a provider holds the numbers, and its resellers’ customers make calls from them.
According to Ofcom, between November 2022 and January 2025 Tismi had no appropriate or proportionate measures in place to stop those numbers being misused. Three things were missing:
- Customer checks. No proper know-your-customer due diligence on the businesses getting the numbers.
- Monitoring. Nothing watching for misuse once the numbers were live.
- A misuse process. No formal way to handle reports that a number was being abused.
The case didn’t come out of nowhere. Ofcom opened its investigation in October 2024, and in June 2025 it directed Tismi to block specific numbers because of serious misuse. The fine closes a case that ran for two years.
Why this lands on white label providers
Most people reading about Tismi will think of it as a niche number broker. But look at the business model rather than the name. If you run a white label platform and your resellers’ customers make calls from numbers you provide, you’re in the same position. The scammer is your customer’s customer. The numbers are yours.
That chain is exactly why this matters. A reseller signs a new client, the client wants 200 numbers for an outbound campaign, the platform provisions them in minutes. Nobody along the way asked what the numbers were for. It’s fast, and it’s the gap Ofcom just put a price on.
It also connects to something we’ve written about before. Real multi-tenancy is more than a logo swap. When one tenant starts abusing numbers, you need to be able to see it, limit it and shut it off without touching anyone else. If your platform can’t separate tenants cleanly, it can’t police them cleanly either.
The controls to run
Ofcom’s findings map neatly onto three stages: before numbers go out, while they’re live, and when someone complains.
Before numbers go out
Check that the business exists and who runs it. Ask what the numbers are for and write the answer down. Start new tenants on a small block and raise it as they build a track record, rather than handing over hundreds on day one. And keep the evidence. A check you can’t prove you did doesn’t help you much in an investigation.
While they’re live
Watch call volume and call length per tenant, every day. Bursts of very short calls, very low answer rates and sudden jumps in volume are the usual signs of a number being used for scams. Only let a tenant present caller ID from numbers it actually holds. And when a tenant’s use changes sharply, look at the risk again rather than assuming the first check still holds.
When someone complains
Publish one place where anyone can report a misused number. Give it a named owner and a response time you actually keep. When harm is live, suspend first and investigate second. Then log the report, what you did and when you closed it, because that log is what you’ll show a regulator.
Not in the UK? The same duty applies
Ofcom’s General Conditions bind companies that hold UK numbers. If you sell in the US, the matching duties come from the FCC: know-your-customer and know-your-upstream-provider obligations, and the robocall mitigation plans that providers must file and keep current. The FCC proposed changes to that robocall mitigation database in September, and the proposed scope names dialing platforms and call centers. The names differ, but the questions are the same. Who did you give the number to, what did you check, and what did you do when it went wrong?
What to do this week
Pull a list of every tenant with more than a handful of numbers. For each one, find out whether you have a record of who they are and what they said the numbers were for. If the answer is no for your biggest accounts, start there. Then check whether anyone on your team gets alerted when a tenant’s call pattern changes sharply. If nobody does, that’s the next fix.
Multi-tenant platforms in the ICT Vision portfolio, such as ICTPBX, keep each tenant’s users, numbers and settings separate, which is what makes per-tenant review possible. The checks themselves are still a business process, and they’re yours to run.
FAQ
How much was Tismi fined, and when?
£437,500, announced by Ofcom on 21 October 2026, for failing to take appropriate and proportionate steps to stop allocated numbers being misused, including for scams.
What is sub-allocation?
It’s when the company that holds a block of numbers passes some of them to business customers to use. Most white label voice, dialer and contact center services work this way, which is why the Tismi case is relevant beyond number brokers.
How many numbers were involved?
Ofcom said about 366,000 sub-allocated numbers were exposed to potential misuse between November 2022 and January 2025.
What is the Xtra Phones investigation about?
Ofcom opened it on 21 October 2026 over concerns that numbers held by Xtra Phones UK are being misused. It’s an open investigation, not a finding. No breach has been decided.
Does this apply outside the UK?
Ofcom’s rules apply to UK number holders. In the US, similar know-your-customer and robocall mitigation duties come from the FCC. The practical checks are much the same in both places.
Is the reseller or the platform provider responsible?
It depends on who holds the numbers and on your contracts. In the Tismi case, Ofcom held the number holder responsible. If you hold the numbers your resellers’ customers use, assume the checks are your job, and write down which checks your resellers have to do too.
