Sweden introduces obligation to block fraudulent text messages and telephone calls

Background On 1 August 2026 new rules came into force in Sweden aimed at combating fraud and other forms of deception carried out via telephone calls and text messages. The rules were introduced through an amendment to Chapter 4 paragraph 12 of the Swedish Electronic Communications Act (2022:482), enacted as SFS 2026:1302.

Providers of publicly available number-based electronic communications services (‘providers’) are now obliged to block calls and messages suspected of being used for fraud, or to deceive a large group of recipients. The new rules respond to the increasing scale of fraud committed via telephone calls and text messages: according to a survey published by the Swedish Post and Telecom Authority (PTS), approximately 29,000 cases of telephone fraud were reported to the Swedish police in 2023, with proceeds of crime amounting to 708 million Swedish crowns.

The total cost for the Swedish business sector of all types of fraud was estimated at 4.5 billion Swedish crowns in the same year. Despite voluntary measures already taken by operators, including the blocking of 40,000–50,000 calls with manipulated numbers per day, fraud of this scale has persisted, which is what prompted the legislator to make blocking mandatory. key aspects of the new obligation 1.

What does the obligation entail? Providers must refrain from connecting a call or delivering a text message if the traffic data gives reason to believe that it is being sent as part of a fraud, or with the aim of misleading a wider group of recipients in any other way. This obligation covers both fraud as defined in the Swedish Penal Code (e.g. links to malicious websites or requests to provide bank or personal details) and other forms of deception.

The most common methods used today are: vishing, voice-based phishing carried out over the phone; spoofing, disguising the caller's identity so that the call or message appears to come from a trusted or known source; wangiri, calls or text messages with a sender name that falsely gives the impression of coming from a public authority or a trusted sender; and smishing, text messages sent to establish contact, often as A2P texts sent simultaneously to a large number of recipients with a sender name resembling that of a trusted sender.

2.The assessment must rely on traffic data, not message content Whether a message should be blocked must be assessed on the basis of traffic data and traffic patterns, such as the calling and called numbers, the time and duration of calls, and the sender’s name (however, never the content of the message).

Providers may, for example, check the sender’s name for A2P text messages against a register: if the actual sender’s name does not match the registered one, this may indicate fraud. The Swedish legislator has deliberately refrained from specifying exact technical methods, however, since fraud methods are evolving rapidly and providers are best placed to determine the appropriate solutions themselves.

3.No general monitoring obligation Providers are not required to monitor all calls and messages: the obligation to act arises only where unusual traffic patterns give reason to suspect fraud. The mere fact that someone makes many calls, or that a text message is sent to many recipients at once (e.g. legitimate authentication codes or customer messages), is not in itself sufficient to trigger the obligation.

So-called ‘grey routes’ (unauthorised, cheaper routes for text messages that circumvent termination charges) do result in unusual traffic patterns, but do not in themselves imply fraudulent intent. Providers therefore need solutions accurate enough to distinguish genuine fraud attempts.

The technical solutions must be secure, reliable and accurate; to minimise the risk of legitimate messages being blocked by mistake. Providers must also take accessibility into account, particularly for vulnerable groups such as people with cognitive impairments, and must not create barriers by blocking communication formats that certain users rely on.

4. New, limited right to process traffic data The new rules grant providers an explicit but limited right to process the traffic and subscription data necessary to fulfil this obligation, but never the content of the messages themselves. The data may be processed only to the extent and for the duration necessary and must be erased immediately thereafter.

This is without prejudice to other applicable laws and regulations, including the EU General Data Protection Regulation (GDPR). Supervision and sanctions PTS is the supervisory authority for this new obligation, as it is for other obligations under the Swedish Electronic Communications Act, and has the authority to investigate what measures a provider has taken to comply with the blocking obligation.

Supervision may be triggered by a complaint or any other indication that a provider is failing to comply or is otherwise taking measures that are not permitted. As for sanctions, the Swedish legislator has decided that there is currently no reason to impose an administrative fine for breach of the obligation to block fraudulent calls and text messages.

Instead, PTS may rely on other supervisory measures, such as notifications and orders. The expected process is that PTS would first notify the provider of a suspected breach and give it a reasonable opportunity to comment, before issuing an order requiring rectification either immediately or within a reasonable period.

Such an order may be accompanied by a conditional fine, the amount of which is to be determined pursuant to the Swedish Act on Conditional Fines (1985:206), based on the principle of proportionality and the circumstances of the infringement. What should companies do now? Providers should review, and where necessary formalise, their anti-fraud measures to ensure the statutory obligation is met – with particular focus on ensuring that checks rely solely on traffic and subscription data, that such data is processed and deleted proportionately, and that the solutions used are accurate and accessible.

As part of this review, providers should also assess whether their existing technical solutions are fit for purpose under the new rules. Privacy documentation, including privacy policies and retention schedules, may also need updating to reflect the new processing activities carried out on traffic data.

PTS has also published information that secondary legislation in the form of PTS ordinances will be adopted at the beginning of 2027. Provider should therefore also monitor the issuance of these ordinances to ensure full compliance with the additional requirements. For more information, please contact Mårten Lindberg and Ana-Maria Barbu-Nyström.