Which? investigation finds six major banks' numbers spoofable

Which? reported on 30 November 2022 that it successfully spoofed at least one phone number belonging to HSBC, Lloyds, Santander, TSB, Nationwide and Virgin Money¹. The consumer body made calls to a test phone, spoofing the prominent numbers of 14 bank account providers, focusing on the numbers printed on the back of debit cards and listed as fraud helplines¹. It said most calls could not be connected, suggesting the "do not originate" (DNO) list is effective, but that the six named providers had numbers that were not on the list¹.

The DNO database was set up by Ofcom and UK Finance in 2019¹. It lists public telephone numbers that are inbound-only and never used to call customers, so any outgoing call appearing to come from one of them must be spoofed¹. The list is shared with telecoms providers and call-blocking services, which block such calls before they reach the recipient¹. Which? said it is not illegal to spoof a phone number¹.

Ofcom told Which? it decides whether to add a number to the database, taking into account factors such as whether the number is publicly available and the degree of potential harm to consumers, and confirmed that "requests for numbers on the back of bank cards or on bank websites are expected to meet these criteria if submitted"¹.

The banks responded to the findings as follows¹:

UK Finance figures show £60m was lost to authorised push payment (APP) scams involving impersonation of banks in the first half of 2022, with a further £31m lost to impersonation of organisations such as utility companies, communications service providers and government departments¹.

Why it matters for households

Spoofing lets a fraudster's call display a number that matches the one on the back of a debit card or a bank's fraud helpline, which is the check many people use to satisfy themselves a call is genuine¹. Where a bank's number is not on the DNO list, that check can be defeated, and the call may connect¹. The sums at stake are significant: £60m was lost to APP scams involving bank impersonation in the first half of 2022, and £31m more to impersonation of other organisations¹. Which? has a guide on how to check your bank is really contacting you, and its scams and fraud section covers related topics including FSCS protection or APP reimbursement, money mules and recovery room scams.

Which? also noted that not every phone company checks the DNO list, and that technical constraints mean a small number of calls still connect depending on the route across networks¹. It said the list can only stop a proportion of scam calls, because not all spoofing impersonates another organisation¹. On SMS, businesses can protect their names through the "SMS SenderID Protection Registry" run by the Mobile Ecosystem Forum, but Which? said not all SMS providers have signed up and several big brands are yet to join, including The Co-operative Bank, the Post Office and PayPal¹.

What happens next

Ofcom announced in November 2022 that it is strengthening its rules and guidance to require all telephone networks involved in transmitting calls, to mobiles or landlines, to identify and block spoofed calls where technically feasible¹. The rules come into force in May 2023¹. Ofcom said it expects firms to check the DNO list, ensure numbers meet the UK's 10 or 11-digit format, and identify and block calls from abroad spoofing a UK caller ID, with new guidance on "Know Your Customer" checks for businesses and reporting of suspected criminal activity to law enforcement¹.