Scam & fraud protection for mobile users, and what your network is really doing about it

Type "mobile safety" into any UK operator's blog and you'll mostly find guidance on parental controls, screen time limits, and keeping kids safe online. That's worthwhile content, but it leaves out the adults who are actually losing the most money to scammers. Ofcom research shows that in a recent three-month period, almost 45 million people in the UK were on the receiving end of a suspected scam call or text, and 82% of adults had encountered suspicious contact of some kind.

Roughly one in six UK consumers say they've fallen victim to a phone scam, losing an average of £798 each time.

So what are the networks actually doing to protect the adults paying their bills? We looked past the press releases and mapped what EE, O2, Vodafone, Three and the wider industry have shipped, promised, and are still leaving to chance.

How scam calls and smishing actually work on UK networks today

Two channels dominate. Scam calls typically use spoofed caller ID, making a call from a fraud farm overseas look like it's coming from a UK landline or even your bank's real number. Smishing (scam text messages) relies on spoofed sender IDs too, plus malicious links disguised as delivery notifications, HMRC rebates, or bank security alerts. Ofcom's own estimate puts the scale at around 100 million suspicious messages reported to UK networks in the year to April 2025, affecting roughly half of all mobile users.

This has become a network-level problem rather than just a user-awareness one because spoofing exploits weaknesses in how calls and messages are routed, not just gaps in people's judgement. Responsibility has moved further up the chain, onto the operators and the regulator, whether they wanted it or not.

What EE, O2, Vodafone and Three actually offer

The picture is more fragmented than the marketing suggests.

Virgin Media O2 was first out of the gate with Call Defence, a free AI-powered scam and nuisance call detection tool that uses real-time behavioural analysis to flag suspected fraud calls before you answer. It launched in November 2024, rolled out automatically to Pay Monthly and SIM-only customers on Android and iOS 18+, and O2 says it now blocks tens of millions of scam calls and messages a year at no extra cost to customers.

Vodafone's answer is Scam Call Protection, an AI tool built with call-verification specialist Hiya that flags likely scam calls before the phone even rings through properly, warning customers what they're about to pick up. Since Vodafone and Three completed their merger, the combined VodafoneThree network says it blocks millions of scam texts and fraudulent calls every day, and has stopped more than two million fraud attempts targeting the banking sector specifically. Three customers now sit on this same shared infrastructure, though the operator has been quieter than its stablemate about promoting it as a distinct feature.

EE takes a different approach. Scam Guard combines network-level call labelling with a Norton-powered security app that scans emails, texts and websites for scam indicators, and bundles in password management and dark web monitoring. It launched at £1 a month in July 2024 and has since risen to £2 a month, billed on a rolling 30-day basis. The deeper protection is tied to the account holder; other lines on a family plan get call labelling only, so covering the whole household means paying for multiple subscriptions.

That leaves an odd split in the market. Two networks now offer AI-driven scam-call detection as a free, default feature, while EE, one of the UK's largest operators, charges for the more comprehensive version on the same basic call-labelling infrastructure that's free elsewhere.

The 2026 Telecoms Charter versus what's actually live

In 2026, BT, EE, VodafoneThree, Virgin Media O2, TalkTalk, Sky and the Comms Council UK signed an updated Telecoms Charter committing the industry to upgrading systems within a year to stop spoofed calls appearing as UK numbers, deploying AI at scale to flag fraudulent calls and texts, cutting fraud-victim support response times to two weeks, and sharing more data with law enforcement to dismantle scam operations.

Ofcom, separately, has been moving on regulation rather than voluntary pledges. Its July 2026 rules require mobile providers to cap how many messages pay-as-you-go SIMs can send in bulk, block numbers already reported for scam activity, and screen business message senders through "Know Your Customer" and "Know Your Traffic" checks before their texts ever reach a customer's phone.

The difference matters. The charter is a statement of intent with a one-year runway on its headline commitment. The Ofcom rules are the first sign of actual enforcement teeth. Readers comparing networks should treat the charter as a scorecard to revisit in 2027, not a guarantee of what's protecting them today.

What real customers are reporting

Customer-facing review platforms and community forums tell a less polished story than the press releases. Recurring themes include call labelling that's inconsistent between networks when a call crosses operator boundaries, spam and scam texts that still land despite an operator's tools being switched on, and confusion over which layer of protection (network-level labelling, a separate security app, or the phone's own OS filtering) actually caught, or missed, a particular scam. EE's own product commentary acknowledges some of this overlap. Modern iPhones and Android handsets already include built-in spam filtering and call screening, which raises a fair question about how much a paid add-on is adding versus duplicating.

There's a reporting gap too. The UK's free 7726 scam-text reporting shortcode generates a large volume of data that networks use to identify and block new scam campaigns, but the process still relies on customers taking the extra step to report rather than the network catching everything automatically. Protection that depends on people remembering to flag things only works as well as the people using it.

Practical steps every mobile user should take, regardless of network

Whatever protection your operator provides, a few habits close most of the remaining gap. Never act on a text or call that pressures you to move money, click a link, or share a one-time passcode immediately; genuine banks and government bodies won't rush you. Forward suspicious texts free to 7726 so your network can act on the pattern, not just your individual message. Check your operator's app or account settings to confirm whether scam-call or message protection is switched on by default or needs activating. If you're on EE and considering Scam Guard, weigh it against what your phone's built-in spam filtering already does before paying monthly for overlapping cover. And if you or someone in your household has lost money to a scam, report it to Action Fraud and your bank straight away; speed matters more than almost anything else in recovering funds.

More can, and should, be done

The gap that got us here (a mobile industry that's built genuinely good child-safety content but comparatively thin, inconsistent adult fraud protection) hasn't fully closed. O2 and Vodafone have shown that free, AI-driven, opt-out scam protection is technically and commercially viable right now. EE's choice to charge for its equivalent, on a network that handles the same basic call-labelling infrastructure, sits awkwardly next to that. The 2026 Telecoms Charter and Ofcom's new messaging rules both point the right direction, but a charter with a one-year deadline and a regulation still bedding in are promises, not protection you can rely on today.

Until "scam protection" is a free, consistent, clearly explained baseline across every UK network, rather than a patchwork of paid add-ons, OS-level guesswork and industry pledges, adults will keep carrying more of the risk than they should.

Have you ever been scammed via your mobile device? Tell us what happened, which network you were on, and whether their protection helped or let you down. It's exactly the kind of real-world evidence that should be shaping what operators build next.

Data sourced from Ofcom (scam calls and messages research; mobile messaging scam rules, July 2026), Virgin Media O2 (Call Defence launch), Vodafone UK / Hiya (Scam Call Protection), VodafoneThree (fraud-blocking figures), EE Scam Guard product pages, and Mobile UK / Comms Council UK (2026 Telecoms Charter)