The Independent Communications Authority of South Africa (ICASA) has published proposed amendments to South Africa’s Numbering Plan Regulations that could help combat SIM-swap fraud.

The proposal amends Regulation 6A of the Numbering Plan Regulations to require network operators to verify subscribers’ identities in real time for SIM activation, re-activation, and SIM swaps.

“On activation or re-activation of a mobile number on its network, a licensee must verify the identity of the subscriber through biometric verification against the Department of Home Affairs,” it stated.

“In the instance where the subscriber is a South African citizen, a licensee must keep a record of the verification.”

The record must include the subscriber’s full name and surname, their ID number, and the location, date, and time at which the licensee confirmed their identity.

“The biometric data submitted and stored must only be used for subscriber identity verification processes,” ICASA said.

Where a subscriber is not a citizen but a lawful permanent resident, the licensee must keep a copy of their permit in addition to the same records they keep for citizens.

For a foreign national entering South Africa on a short- or long-term stay, the licensee must record their passport number and the country where it was issued.

They must also record the visa number, visa type, and expiry date for short- and long-term visitors that require a visa.

“Numbers assigned to foreign nationals entering the Republic either on short or long term stay shall be active for a period not exceeding the validity of the issued visa or of 90 calendar days,” ICASA said.

Regarding SIM swaps, licensees must verify the subscriber’s identity in real time and ensure that the ID of the subscriber requesting a SIM swap matches that of the subscriber assigned to the mobile number.

“A licensee must not approve a request for a SIM-swap if the identity of the subscriber requesting the swap does not correspond with the identity of the subscriber assigned the number,” ICASA said.

Stakeholders have 30 working days, or until 9 December 2026, to submit written representations on the proposed amendments.

Closing SIM-swap fraud loopholes

SIM-swap fraud is one of the leading tactics criminals use to scam and steal money from people’s bank accounts in South Africa.

The proposed regulations do not address the fact that SIM-swap mechanisms are opt-out, meaning the subscriber must actively opt out to stop a SIM-swap from proceeding.

However, the proposed requirement for real-time identity verification when a SIM swap is requested will likely help to curb SIM-swap fraud in South Africa.

When a SIM swap is requested, some mobile networks send a notice to the corresponding mobile number, informing the owner that a swap is being processed and offering them the option to opt out.

Moreover, the customer must opt out within a specified timeframe to prevent the SIM swap from proceeding.

However, this is problematic in several scenarios. For example, a customer who is overseas without SMS Roaming won’t receive the SMS in time, making it impossible for them to opt out.

Travellers in different time zones may also experience problems if these SIM-swap request notices are sent while they are asleep.

In these scenarios, the SIM swap may proceed without their knowledge, granting the requester access to critical communications sent to that number, such as one-time PINs from banks.

However, mobile network operators themselves aren’t entirely to blame. Vodacom and MTN tried to switch to an opt-in process for number porting in April 2016.

Had they been successful, the issue of fraudulent SIM swaps could have been avoided. However, they gave subscribers 30–40 minutes within which to approve number-porting requests.

Cell C took the networks to court and argued that their practices were unlawful under the 2005 number porting regulations.

Cell C said failed porting requests shot up from 1.5% to 60% of all porting requests from customers switching from Vodacom to Cell C, as a result of the change.

Vodacom settled with Cell C and switched back to the opt-out approach, while MTN continued the court fight, which it lost.

Despite the loss, MTN now uses an opt-in number-porting process. However, it gives subscribers much more time to respond to the requests.

Source: https://mybroadband.co.za/news/cellular/674648-new-rules-to-close-a-big-sim-card-fraud-loophole-proposed-in-south-africa.html