SIM card cartels causing havoc

South Africa is increasingly being exposed to the chaos caused by SIM card cartels, resulting in SIM card fraud that can have devastating effects on its victims.

Communications Risk Information Centre (COMRiC) CEO Advocate Thokozani Mvelase told MyBroadband that they have already made two major busts this year in conjunction with the police.

Although this may seem few, one of the busts resulted in the arrest of 48 suspects and the confiscation of two million illegally obtained SIM cards. In addition to the SIM cards, bulk SMS machines were also confiscated.

Mvelase also said that the police can’t handle this problem as it is outside their investigative abilities due to the intricacies of the crime.

“It is also possible that even if there were other cases or investigations in the past, they never progressed far,” he said.

“We don’t believe law enforcement will be able to process the complexity of these types of incidents on their own, as it requires an appreciation of technology and digital evolution risks, especially in the telecoms industry.”

Therefore, it will also require the help of regulators such as the Independent Communications Authority of South Africa (Icasa), with whom Mvelase says COMRiC has begun talking to partner against this crime.

However, he believes multiple government departments, including the Department of Justice, Communications, Home Affairs, and many others, have a role to play.

One instance of SIM card fraud Mvelase says can be particularly dangerous is smashing (SMS phishing) because it hurts victims financially. This attack uses social engineering and SMS to manipulate people into downloading malware or sharing sensitive information.

Another type of attack is SIM swap fraud, in which someone ports a victim’s number to another SIM card.

SIM swaps are needed if someone lost their phone or switched service providers. However, criminals exploit the process.

Many digital platforms use cellphone numbers to verify someone’s identity, and if scammers can access someone’s cellphone number, identity theft becomes a significant risk.

According to COMRiC, the use of stolen SIM cards also poses major challenges to network service providers and authorities by undermining the integrity of the telecommunications network.

Having stolen SIM cards in circulation also hinders law enforcement’s efforts to track and apprehend criminals.

SIM swaps, although decreasing, largely contribute to financial fraud in South Africa.

SABRIC’s same report found that 7,657 incidents, or 76% of mobile banking fraud reported in 2022, involved an unauthorised SIM swap.

A MyBroadband forum member recently shared their experience of falling victim to SIM card fraud.

The user started by receiving four phone calls from the same number before answering. The caller told them there was a problem with their bank account. Assuming it was a scam caller, they hung up.

No personal information was exchanged.

Later that day, they received a notification that R200 worth of airtime had been purchased for an unknown number.

“I then realised that my phone had lost network connectivity,” they said.

“I blocked my banking profile and contacted MTN.”

What frustrated the reader most was how the SIM swap was able to take place without them being notified about it.

MTN South Africa recently told MyBroadband that its postpaid customers must go in-store for a SIM swap, which requires biometric authentication.

Prepaid customers can process SIM swaps through a self-service USSD request, in-store assistance, or MTN’s call centre.

MTN said it had comprehensive access controls in place to ensure that only authorised users can perform the SIM swap transaction.

A Vodacom spokesperson told MyBroadband that to protect against SIM swap fraud, it sends notifications to customers, notifying them to contact its call centre if they did not request a SIM swap or if they suspect fraud on their line.

“Customers then have up to two hours to take action in line with our SIM swap process and company policies and procedures,” the spokesperson explained.

Telkom allows customers to conduct SIM swaps at its stores or through its WhatsApp channel.

“To minimise the potential for internal fraud, we have robust security processes in place, including biometric verification, to ensure our customers are protected from fraud,” Telkom said.

“The WhatsApp channel also features a verification process before a customer proceeds with the SIM swap. Where fraud is suspected, we deal with each case on its merits.”

Cell C facilitates SIM swaps via its physical stores and customer call centre.

The mobile network said it had various authentication and verification processes to identify and verify individuals who phoned in for SIM swaps.

For in-store requests, customer authentication processes include verifying the customer’s identification document.

Cell C said it implemented strict policies and monitoring mechanisms to detect and prevent insider involvement in fraudulent activities.