1. Regulatory focus
On September 16, Ofcom highlighted telecom fraud-sharing guidance published by CCUK, developed with the Home Office and Ofcom, with input from the ICO; the announcement encourages lawful cooperation rather than establishing a universal mandatory reporting deadline. ([ofcom.org.uk](https://www.ofcom.org.uk/phones-and-broadband/scam-calls-and-messages/sharing-data-to-combat-fraud)) Separately, the ICO says organizations should establish a lawful basis, clarify controller responsibilities and put appropriate safeguards around disclosure, with a data protection impact assessment required where processing is likely to create high risks for individuals. ([ico.org.uk](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/sharing-personal-information-when-preventing-detecting-and-investigating-scams-and-frauds/?utm_source=openai)) For implementation planning, distinguish an occasional incident referral from a recurring intelligence exchange, and document the proposed recipients, purposes and information fields before engineering builds an automated export.
2. Business impact
The guidance distinguishes observed facts, indicators and conclusions, including information that remains unverified; intelligence passed between providers should not turn an unfinished investigation into an assertion of proven wrongdoing. ([ofcom.org.uk](https://www.ofcom.org.uk/siteassets/resources/documents/phones-telecoms-and-internet/information-for-industry/scams/guidance/sharing-data-to-tackle-fraud---guidance-for-telecoms-providers.pdf?v=425582)) For an SMS aggregator, a practical design is to separate the intelligence record from the routing decision, assigning a case identifier, evidence timestamp and review owner rather than treating every incoming indicator as a permanent block instruction. When a case intersects with legitimate OTP traffic, assess whether a restriction can target a specific account or route, and maintain a restoration workflow so that operational recovery does not depend on manually rebuilding the customer's messaging configuration.
3. Operating recommendations
Build a disclosure ticket covering recipient verification, fraud-prevention purpose, lawful basis, necessary fields, access controls and retention; the ICO identifies fairness, accuracy, security, limited retention and documented disclosure decisions as relevant obligations. ([ico.org.uk](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/sharing-personal-data-with-law-enforcement-authorities/?utm_source=openai)) Review candidate fields such as telephone number, domain, incident window and evidence summary individually, rather than attaching complete customer files or message bodies by default. Add a correction ticket linked to the original case, recording which recipients need an update, who owns delivery and when the revision was sent. This supports the telecom guidance's explicit warning against sharing intelligence without a mechanism to correct records when concerns later prove unfounded. ([ofcom.org.uk](https://www.ofcom.org.uk/siteassets/resources/documents/phones-telecoms-and-internet/information-for-industry/scams/guidance/sharing-data-to-tackle-fraud---guidance-for-telecoms-providers.pdf?v=425582))