Fraud is becoming an increasingly common threat, with criminals finding new and more sophisticated ways to target people. Their tactics can make scams harder to recognise and avoid.
One method involves impersonating mobile providers to gain access to customers’ accounts, order expensive devices and then trick customers into sending the devices directly to the fraudsters.
A recent case shows how this type of fraud can happen and the warning signs to look out for.
The scam explained
In February 2026, a customer received a call from someone claiming to work for their mobile provider. They were told they needed a replacement SIM card because of network upgrades.
The fraudsters then moved the conversation to WhatsApp, where the mobile provider’s fraud team couldn’t monitor the communications. They used a business account with the provider’s name and logo to make their messages appear genuine.
During the WhatsApp call, they asked the customer for a one-time passcode sent to their phone, claiming it was needed to order the new SIM card. In fact, the fraudsters used the code to access the customer’s online account. Once logged in, they ordered an expensive new phone.
When the phone arrived, the fraudsters contacted the customer again, claiming the wrong item had been delivered. They asked the customer to return the unopened package using a prepaid QR code. This made the return process appear straightforward and legitimate.
When the customer questioned the request, they were offered £100 compensation for the inconvenience. The customer returned the phone, unknowingly sending it directly to the fraudsters. A few days later, the customer checked their account and noticed a new agreement for a high-end phone and an increased Direct Debit. They contacted their mobile provider, who identified that they had been victim to mobile provider impersonation fraud.
How to protect yourself
- If someone contacts you claiming to be from your mobile provider, stop and check the request is genuine before sharing any personal information.
- If in doubt, end the conversation immediately and contact your mobile provider directly using the number on their official website or app.
- Never share your online account password or one-time passcode with someone who contacts you unexpectedly.
- If you’re asked to return an unexpected delivery, contact your mobile provider directly before sending anything back.
What to do if this happens to you
- If you think someone has gained access to your mobile account or placed an order without your permission, contact your mobile provider immediately. They can investigate what has happened and once confirmed as fraud, will ensure that you aren’t left with an unpaid bill or debt on your account. They will also advise if you need to take any other steps to protect yourself from future fraud.
- Report it to your bank.
- Tell the police about cybercrime and fraud at reportfraud.police.uk or by calling 0300 123 2040.
- In Scotland, contact Police Scotland on 101.