Jason Nunn had never heard of "bill shock" – until he was faced with a monthly demand from Vodafone for £17,484-worth of calls, text and data charges.

It's so big that Nunn claims it could shut down the business he helps to run. And this sorry tale all started when a company phone went missing.

Nunn is the office manager of London-based Business Training Enterprise (BTE), a government-funded training provider for 16 to 19-year-olds that runs courses for those who are not in education or training, and have few or no qualifications. The company typically runs up bills of around £200 to £300 a month, per phone, with its provider, Vodafone.

"We couldn't find one of our phones, so we contacted Vodafone to ask for a new sim card for the number we lost, which they sent," he says. Just over a month later, the monster bill landed. "Obviously we thought it was a mistake but when we queried it, it appeared the missing sim had been used."

It became clear that the phone must have been stolen and the thief had run up £500 a day in data charges. However, because BTE had not reported the phone as stolen in its original call to Vodafone, the telecoms giant insisted it was liable for the entire bill.

BTE's £17,484 debt is the highest Guardian Money has come across for a stolen phone, but the organisation is by no means alone in suffering from a major "bill shock" – the term used to describe unexpectedly high bills.

In recent years we have reported on numerous cases where individuals have had to fork out thousands of pounds to cover "stolen" air time. Some have taken the mobile phone companies to court and won, while others have managed to negotiate a reduced bill. Many have ended up paying the lot.

For BTE the amount is too high to contest in the small claims court, and it employs too many people – 20 – to allow it to go to the ombudsman.

"Legally, it's clear that you are liable for a phone's bill right up to the point of it being reported stolen," says a spokesperson for Which? "It's unfortunate that this leads, on occasion, to consumers being unwitting recipients of very large bills."

In BTE's case, the disputed bill shows hundreds of pounds of usage from the day the phone was reported missing until it was blocked a few weeks later. Some of that includes 333MB of data three days after the phone went missing that cost £500, more data charges totalling £1,286.96 a few days later, and a huge £2,797.88 on a single day later that month. The figures suggest that even if a phone is reported stolen 72 hours after the event, he or she could still be liable for a bill in excess of £5,000.

Telecoms watchdog Ofcom has been looking at the area for the last couple of years. Recent EU regulations mean that all mobile operators must apply a cut-off limit once a mobile internet bill reaches 50 euros – around £42 – per month, while travelling in the European Union. At present, Ofcom does not require mobile phone companies to set equivalent credit limits in the UK, but suggests they should "endeavour" to do so. It is carrying out a review and is due to publish a progress report by the end of 2012.

Nunn has been in dispute with Vodafone about BTE's £17,484,12 bill for over a year now. A few weeks ago, exasperated by the lack of response from the mobile giant and the sudden appearance of letters from its debt collectors, he contacted Money.

"The bill amounts to the same figure as training nine of our students for a year or paying for one full-time member of staff," says Nunn. "Obviously, with funding cuts aplenty, the paying of this ludicrous bill will, without a shadow of a doubt, lead to the immediate closure of BTE."

He adds: "We just cannot understand why a normal monthly bill that averaged around £200 was allowed to go over £5,000 in one week and then continue over £17,000."

Ofcom told us it is talking to the mobile industry to explore ways that "bill shock" can be reduced, such as promoting tariffs that give users the ability to set their own financial caps and receive alerts. "We are also urging mobile providers to better advertise steps that users can take to protect themselves, such as locking their handsets."

We put the case to Vodafone, and a spokeswoman says: "As a general rule, we need customers to tell us when a phone or sim is missing or stolen so we can bar it immediately. Replacement sims can be needed for lots of reasons, so we don't routinely ask a customer why they need a new one, or assume the previous one is missing."

She adds: "Vodafone doesn't monitor accounts – this is the customer's responsibility. The charges are as a result of nearly 9GB of mobile data being used, which would have been the 'out of bundle' cost for this amount of data. Credit alerts are based on account risk, so this would be based on the company's credit file and their spend. Business accounts work differently to consumer accounts and, due to their nature, have a much higher credit alert threshold which varies from account to account."

After pressure from Guardian Money, Vodafone did eventually concede it had "made errors" in its dealings with BTE and recalculated the bill. It has agreed to reduce it from £17,000 to £3,950 plus line rental to cover the charges from 3-10 June 2011. It claims the company did not contact it until 10 June and did not make it clear why a new sim was needed – but BTE maintains it was 3 June. We asked for transcripts of the original phone conversation between BTE and Vodafone, but it said it no longer has them.

After further pressure from Money, Vodafone agreed to let BTE pay the bill off in six £666 monthly instalments, but Nunn says the organisation still cannot afford this. "We are really not trying to be obstructive but just can't find the money," he says. "We did some sums until the small hours and don't have that amount anywhere. The most we can afford is £100 per month."

Vodafone declined to reduce the payments to £100 a month, and BTE is now trying to negotiate with the network operator's debt collection agency before the case goes to court.

How is it possible to run up such a high bill?

How easy is it to spend thousands of pounds on a mobile phone in a few days? The answer seems to be – very easily.

"A four-hour Skype video call or downloading 200 songs would all use up around 1GB of data," said Simon Teague, director of 24 Lockdown, a firm specialising in cyber security. "Mobile phones are essentially small computers now. Downloading music or watching videos will absolutely thrash your data allowance."

Alan Goode, managing director of Goode Intelligence, a research, analysis and consultancy organisation for the mobile security industry, agrees that the person who used BTE's phone would almost certainly have been streaming data. "The fraudsters could be downloading pirated games or programmes and selling them on," he said. "You can tether a mobile phone to a desktop computer and make this sort of activity relatively hard to trace."

He says that the technology available does allow mobile phone network operators' fraud detection systems to work in real time and alert them to this sort of activity – but instead their systems work respectively.

"They are not equipped or motivated to use their anti-fraud systems in the same way as banks," he says. "There should be some sort of safety net for consumers but this is going to require regulator intervention."