How do scammers get my number, and why am I suddenly getting so many spam texts?

Scam texts are often not about you

The Traffic Penalty Tribunal, whose adjudicators decide appeals over penalty charge notices (PCNs), says scam texts about paying a PCN or a parking ticket are “typically sent out in bulk to random mobile numbers, not targeted at individuals based on any personal information or specific circumstances”. Getting one doesn't mean the sender knows anything about you or your car.

The machines behind them explain the scale. The Home Office says scam texts are frequently traced back to SIM farms: devices that can sometimes hold hundreds of physical SIM cards and send thousands of scam texts and calls in seconds. Ofcom says scammers typically use SIM farms to send texts person to person, with tens or hundreds of SIMs in each device. The NCSC puts it plainly: a scam message is designed to sound as if you are being singled out, when criminals are sending out millions of these scam messages.

Five ways your number ends up getting scam texts

Why am I suddenly getting so many spam texts?

Often because a new wave has started, not because something changed on your phone. Scam and spam texts tend to come in runs, and the ICO's own figures show it. When people report a spam text through the ICO's online tool they pick what it was about, and reports about loans and finance went from 12 in January 2026 to 162 in April 2026, then back to 10 by August 2026. In 2025 it was job texts: reports in the ICO's recruitment category rose from 31 in January 2025 to 117 in August 2025.

Other reasons for a sudden rise: you replied to one, which the ICO says confirms your number is active; or a company you use had a data breach, and the NCSC warns that scam messages may follow some time after a breach is made public. The waves of 2026 each have a guide, from parking fine texts to job offer texts and loan texts.

A fake text inside your bank's real conversation

The most unsettling version is a scam text that appears under genuine texts from your bank or a delivery firm. It can happen without the sender knowing anything about your account. Ofcom explains how:

A scammer has my number: what actually matters

• Don't reply, not even STOP, unless you know the company. See should you reply STOP.
• Report and block. Forward the text to 7726 (free on most networks), then block the sender and filter unknown senders: how to block spam texts on iPhone and Android.
• Never pass on a code sent to your phone, to anyone. A code you didn't ask for means someone typed your number into a sign-in page: what to do about an unrequested code.
• Check the number, not just the name. The UK number checker shows what kind of number texted you and whether Ofcom lists its block as in use; a number from a block no provider holds was faked (what an unallocated number means).

Check whether your details were in a breach

The NCSC's advice after a breach: contact the organisation through its official website or social media channels, not the links or numbers in any message, and look out for messages about resetting passwords, compensation or missed deliveries. To see whether your details appeared in other public breaches, it points to online tools such as haveibeenpwned.com. If a password you still use has been exposed, the NCSC says to change it, and to change it on any other account that uses the same one.

Not sure about a particular text? Paste it into the scam text checker or run through the 6-point number checklist.

Sources

• Traffic Penalty Tribunal, PCN scam texts: Traffic Penalty Tribunal, 'Alert to common SMS message scams relating to PCN payment' (25 July 2025): "typically sent out in bulk to random mobile numbers, not targeted at individuals based on any personal information or specific circumstances" Short quote; the rest is summarised in our own words. — https://www.trafficpenaltytribunal.gov.uk/alert-to-common-sms-message-scams-relating-to-pcn-payment/, read on 2026-10-02
• Home Office, SIM farm guidance (July 2026): Home Office (GOV.UK), 'Crime and Policing Act 2026 Guidance: Offences relating to the possession and supply of SIM farms and legitimate uses of multiple SIM devices' (published 27 July 2026): "SIM farms are devices that are capable of using five or more physical SIM cards simultaneously or interchangeably ... In practice, SIM farms are commonly used by criminals to carry out fraud, including scam calls and scam text messages. ... Scam texts are frequently traced back to SIM farms, electronic devices which can hold sometimes hundreds of physical SIM cards that can then be used to send out thousands of scam texts and calls in seconds. ... It is an offence to possess a SIM farm without a good reason or lawful authority. ... It is also an offence to supply a SIM farm unless certain conditions are met. ... The Act received Royal Assent on 29 April 2026. A six-month transition period will apply before the offences come into effect. ... From 29 October 2026, a person convicted of an offence may be liable, on summary conviction, to a financial penalty." Contains public sector information licensed under the Open Government Licence v3.0. — https://www.gov.uk/government/publications/possession-and-supply-of-sim-farms/crime-and-policing-act-2026-guidance-offences-relating-to-the-possession-and-supply-of-sim-farms-and-legitimate-uses-of-multiple-sim-devices-accessi, read on 2026-10-02
• Ofcom statement, how scam texts are sent (para 2.23, 2.26): Ofcom, 'Combatting mobile messaging scams: New rules and guidance', statement published 15 July 2026 (checked on 2 October 2026 against the Internet Archive copy of 29 September 2026, as the live site blocks automated access; footnote numbers left out), paragraphs 2.23 and 2.26 and footnote 41: "To send P2P messages, scammers typically use illegal SIM farm devices. These devices allow scammers to generate messages and transmit them over mobile networks using SIMs. Scammers insert SIMs into SIM farms, which typically house tens or hundreds of SIMs. ... With access to A2P messaging services, scammers may be able to send messages with an alphanumeric sender ID, so that their messages appear to the recipients to come from a named organisation (such as ‘HMRC’). This can make messages appear more credible to recipients. ... The alphanumeric ID may look convincing, or scammers may spoof an ID and send new messages to an existing message thread so that the messages appear to come from a legitimate sender." Ofcom copyright. — https://www.ofcom.org.uk/siteassets/resources/documents/consultations/category-3-4-weeks/consultation-combatting-mobile-messaging-scams/main-document/statement-combatting-mobile-messaging-scams.pdf?v=423155, read on 2026-10-02
• Ofcom statement, the new rules in brief: Ofcom, 'Combatting mobile messaging scams: New rules and guidance', statement published 15 July 2026 (checked on 2 October 2026 against the Internet Archive copy of 29 September 2026, as the live site blocks automated access; footnote numbers left out), overview, 'What we have decided - in brief': "Setting volume limits for pay-as-you-go (PAYG) SIMs, to make it harder for scammers to message large numbers of potential victims. ... Blocking numbers used by scammers: preventing scammers from sending messages from numbers that have been identified as responsible for scams. ... Blocking scam messages in transit: identifying and blocking scam messages in transit on their networks by detecting scam URLs and telephone numbers, based on scam reports from customers and third parties. ... Conducting due diligence: preventing criminals from using A2P services to contact potential victims by ensuring that effective Know Your Customer (KYC) checks are made at the onboarding stage. ... Preventing the use of fake alphanumeric sender IDs, including by corroborating Sender IDs against information gathered through KYC checks and maintaining a policy on restricting the use of protected sender IDs and generic sender IDs. ... a right for mobile users to challenge a decision to block a number or message ... We also consulted on a requirement for providers to notify message senders when certain messages are blocked. In the light of new evidence, we have decided not to implement this proposal. ... The new rules and new guidance that apply to P2P messaging will come into effect on 18 January 2027. Those that apply to A2P messaging will come into effect on 15 July 2027." Ofcom copyright. — https://www.ofcom.org.uk/siteassets/resources/documents/consultations/category-3-4-weeks/consultation-combatting-mobile-messaging-scams/main-document/statement-combatting-mobile-messaging-scams.pdf?v=423155, read on 2026-10-02
• NCSC, why scam texts can seem personal: NCSC, 'Data breaches: guidance for individuals and families' (published 28 January 2021): "Criminals can then use this information when creating phishing messages (such as emails and texts) so that they appear legitimate. The message has been designed to make it sound like you're being individually targeted, when in reality the criminals are sending out millions of these scam messages. ... To check if your details have appeared in any other public data breaches, there are a number of online tools that you can use, such as https://haveibeenpwned.com" Contains public sector information licensed under the Open Government Licence v3.0. — https://www.ncsc.gov.uk/guidance/data-breaches, read on 2026-10-02
• NCSC, after your details are exposed: NCSC, 'Data breaches: guidance for individuals and families' (published 28 January 2021): "Be alert to suspicious messages (we've published guidance that can help you with this), which may be sent some time after the breach is made public. Remember, your bank (or any other official organisation) will never ask you to supply personal information." Contains public sector information licensed under the Open Government Licence v3.0. — https://www.ncsc.gov.uk/guidance/data-breaches, read on 2026-10-02
• NCSC, what you share online: NCSC, 'Phishing scams: If you've shared sensitive information' (published 26 November 2021, reviewed 5 September 2022), 'Make yourself a harder target': "Criminals use information about you that’s available online (including on social media sites) to make their phishing messages more convincing." Contains public sector information licensed under the Open Government Licence v3.0. — https://www.ncsc.gov.uk/collection/phishing-scams/what-to-do, read on 2026-10-02
• ICO, when a firm may text you: ICO, 'I keep receiving marketing text messages (spam), but I want them to stop': "Yes, but organisations must only send marketing text messages to you in the following circumstances: ... As best practice don’t share your telephone number, for example by putting it on the internet. ... Unfortunately, the numbers sending these messages often change, so your network provider can’t guarantee to stop all spam messages." Information Commission's Office, 'I keep receiving marketing text messages (spam), but I want them to stop', page read 2 October 2026, licensed under the Open Government Licence. — https://ico.org.uk/for-the-public/texts/, read on 2026-10-02
• ICO, advice in the June 2026 fine notice: ICO, 'Manchester firm fined £300,000 for bombarding people in debt with over 5.5 million unlawful texts' (23 June 2026): "This led to more than 60,000 complaints being made to us and Mobile UK’s 7726 spam reporting service. ... If you receive a marketing text from an unfamiliar company, do not reply or click any links. Responding confirms your number is active and may lead to more messages. ... ICO uses complaints to this service to investigate companies breaking the law and take action." Information Commission's Office, 'Manchester firm fined £300,000 for bombarding people in debt with over 5.5 million unlawful texts', 23 June 2026, licensed under the Open Government Licence. — https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/06/manchester-firm-fined-300-000-for-bombarding-people-in-debt-with-over-55-million-unlawful-texts/, read on 2026-10-02
• NCSC, how to spot a scam: NCSC, 'How to spot a scam email, text message or call' (published 26 November 2021, reviewed 5 September 2022): "Urgency Are you told you have a limited time to respond (such as 'within 24 hours' or 'immediately')? Criminals often threaten you with fines or other negative consequences. ... If you have any doubts about a message, contact the organisation directly. Don’t use the numbers or address in the message – use the details from their official website." Contains public sector information licensed under the Open Government Licence v3.0. — https://www.ncsc.gov.uk/collection/phishing-scams/spot-scams, read on 2026-10-02
• ICO, spam-text reports by category (data): ICO, nuisance calls and messages data sets, PECR monthly totals 2024 (https://ico.org.uk/media2/mxvjlvfe/pecr-monthly-totals-2024.xlsx), 2025 (https://ico.org.uk/media2/f2wbk1cj/pecr-monthly-totals-2025.xlsx), 2026 (https://ico.org.uk/media2/as2ivs2v/pecr-monthly-totals-2026.csv), row "Text", one column per category: "2026 Monthly PECR reporting totals by month, contact type and call category (as determined by complainants)" Information Commission's Office, PECR monthly totals 2024, 2025 and 2026 (data sets, nuisance calls and messages), licensed under the Open Government Licence. — https://ico.org.uk/action-weve-taken/complaints-and-concerns-data-sets/nuisance-calls-and-messages/, read on 2026-10-02
• NCSC, forwarding to 7726: NCSC, Report a scam text: "Most phone providers are part of a scheme that allows customers to report suspicious text messages for free by forwarding it to 7726. If you forward a text to 7726, your provider can investigate the origin of the text and arrange to block or ban the sender, if it's found to be malicious." — https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message, read on 2026-09-29

Quotes from GOV.UK, legislation.gov.uk, mygov.scot, the NCSC, the ICO and NHS England are used under the Open Government Licence v3.0; material from Ofcom is Ofcom copyright. Other pages are summarised in our own words or quoted briefly, with a link. How we check.