ACMA clamps down on SIM-swap frauds

The Australian Communications and Media Authority will impose new rules on mobile providers to help fight against SIM-swap fraud.

To make such frauds harder to execute, the authority will require stronger customer identity checks for high-risk transactions such as SIM-swap requests, changes to accounts, or disclosure of personal information.

The rules will come into effect on June 30 this year.

One popular use of the scam is to take over a customer’s account so as to receive one-time passwords sent as SMS, and use that to log into other services such as online banking.

“SIM-swap scams can cause a lot of harm as scammers take control of your phone number and then use that to gain access to your online banking accounts,” chair of the ACMA’s scam taskforce Fiona Cameron said.

“These new rules require multi-factor authentication of your identity such as confirming personal information and responding with a one-time code consistent with how other essential services like banking operate. 

“We expect these rules will go a long way to stamping out unauthorised transactions like SIM-swap fraud and improve safeguards for telco customers.”

Telcos that breach the new rules will be subject to enforcement actions including court proceedings.

“SIM-swap scams are harmful and costly,” communications minister Paul Fletcher said in a separate statement.

"Consumers should feel safe to engage with their providers without fear of having their private details targeted.

“The use of multi-factor authentication process is an effective tool in addressing fraud, because scammers might manage to steal one proof of identity such as your PIN, but they still need to obtain and use the other proofs of identity to access your account."

Fletcher said that between January 1 and September 30 last tear, there were at least 510 incidents of reported fraud from scammers targeting customer authorisation processes, resulting in 163 cases of financial loss.

"These losses amounted to $4.68 million, with the largest single reported loss being $463,782," he said.