New rules to protect consumers against SIM swap fraud

Dept of Infrastructure, Transport, Regional Development and Communications

The Morrison Government has introduced new rules to prevent SIM-swap fraud, which occurs when a scammer takes control of a consumer’s mobile number by using their personal details to request a new SIM. The scammer then hacks the victim’s email or bank accounts.

Between 1 January and 30 September 2021, there were at least 510 incidents of reported fraud from scammers targeting customer authorization processes, resulting in 163 cases of financial loss. These losses amounted to $4.68 million, with the largest single reported loss being $463,782.

The new rules will require stronger customer identity checks when providers undertake high-risk transactions such as SIM-swap requests, changes to accounts or disclosure of personal information.

These checking processes may include use of multifactor identification (two or more proofs of identity including measures such as a unique code or secure hyperlink), biometric data, or government online verification services or documents in line with the Government’s Trusted Digital Identity Framework and the National Identity Proofing Guidelines.

Minister for Communications, Urban Infrastructure, Cities and the Arts, the Hon Paul Fletcher MP, said the new rules will help protect consumers from theft via SIM-swaps, which cost individual victims in Australia an average of around $28,000.

“The Morrison Government is taking action to stop scammers and keep Australians safe. SIM-swap scams are harmful and costly. Consumers should feel safe to engage with their providers without fear of having their private details targeted,” Minister Fletcher said.

“The use of multi-factor authentication process is an effective tool in addressing fraud, because scammers might manage to steal one proof of identity such as your PIN, but they still need to obtain and use the other proofs of identity to access your account,” Minister Fletcher said.

The obligations will come into effect from 30 June 2022. The ACMA will closely review their effectiveness, including actively monitoring data from the ACCC and other sources.

/Public Release. View in full here.