Need to know
- Scammers are abusing telco processes to steal mobile phone numbers and cause havoc with personal finances
- Telcos have been directed to crack down on these scams, but support groups say cases have increased and victims are being left traumatised
- You can protect your phone number by guarding your personal details, avoiding suspicious texts and calls and acting quickly if you lose service
Imagine you've just found out you're being scammed.
Someone is moving money out of your bank account and you've lost access to your email and other vital online services.
You pick up your phone, but realise you've suddenly lost signal and, with it, any easy way of quickly shutting down the pilfering happening right in front of you.
This is what it's like to encounter a SIM swap or phone porting scam and find yourself unnervingly disconnected in your hour of need.
On this page:
- What are SIM swap and phone porting scams?
- How scammers are stealing numbers
- Authorities cracking down but cases on the rise
- How to avoid SIM swap and phone porting scams
Older scam finding new life
SIM swap and phone porting scams have been around for several years.
They've been the target of crackdowns by the federal police and Australia's communications regulator, which in the last few years has introduced requirements for telcos to make them harder to carry out.
But cracks have emerged in the system designed to protect consumers from these fraudulent operations and one support group says it's seeing more and more devastated victims come forward.
What are SIM swap and phone porting scams?
SIM swap and phone porting scams are abuses of legitimate processes that telcos have in place to support customers.
A SIM swap is a function that allows someone to have their existing SIM card cancelled and their number moved to another SIM card. Phone porting, meanwhile, is when you contact a new telco to have your phone number moved to it from your existing provider.
Both processes can result in calls and messages to your number being diverted to a new device.
SIM swap and phone porting scams occur when one of these processes happens without you having requested it. Instead, it's been initiated by someone impersonating you in order to divert your texts and calls to a device they control.
In some cases, victims are completely unaware this has gone on until they suddenly lose cellular service.
"It comes out of the blue," says Kathy Sundstrom, national manager for outreach and engagement at IDCare, a cyber support service helping scam victims.
"The first thing you want to do when something has gone wrong is phone someone, but you can't. It's incredibly disempowering when you're not able to have any kind of phone contact."
Mobile numbers the modern key to identity theft
Your phone going to "SOS Only" where you normally have service could be a sign your number has been stolen. Image: Apple
Once they've taken over a mobile number, scammers will be able to receive the text messages organisations often send to authenticate and confirm sensitive changes to personal details and accounts.
This can deliver criminals the ability to change passwords and take control of emails, bank accounts and other vital services, providing them ample opportunity for theft.
"It sets off a chain of events," says David Hofierka, senior policy officer at the Consumer Action Law Centre, another organisation supporting victims of SIM swap and phone porting scams.
"The perpetrator changes [the victim's] email, takes out loans in their name and steals money from their accounts. The customer is helpless and can get really traumatised."
The perpetrator changes [the victim's] email, takes out loans in their name and steals money from their accounts. The customer is helpless and can get really traumatised
David Hofierka, Consumer Action Law Centre
Advocates say this takeover of an individual's identity via their phone is often compounded by the fact many of us now rely completely on mobiles to make calls and get help.
A mobile phone was the only way 63% of Australians could make a call at home in 2022, according to research by the Australian Communications and Media Authority (ACMA) – the same study found only 34% of us still have a landline as a backup.
Advocates say this results in stories of victims having to go to their neighbours for help after their number was stolen while they were at home alone.
Porting theft 'like a physical attack'
Sydney resident TJ* witnessed the effects of a phone porting scam first-hand when his wife's mobile number was stolen and moved to a new carrier.
They first realised something was wrong when TJ received a notification claiming $3000 had been moved out of one of their joint accounts.
At the same time, his wife's phone wasn't able to connect to its usual service provider.
"When she was calling them the following morning, she was told that her number had been ported to another carrier," he explains.
"[It] was only the beginning of a whole process, a web of financial scams that affected us," he recalls.
"Not only did we have that unauthorised $3000 transfer, we found out that simultaneously the scammers had opened credit accounts [and that] my wife's Service NSW, ATO [Australian Tax Office] and Google accounts had been taken over."
TJ says this long term effort to wrench back control of their finances and accounts has taken a particular toll on his wife
TJ says they eventually got the ported number shut down and he and his wife have been able to clear from their name the approximately $15,000 worth of loans, tax refunds and credit lines the scammers obtained.
But they continue to come across more instances where the criminals have sought to impersonate them.
TJ says this long term effort to wrench back control of their finances and accounts has taken a particular toll on his wife.
"It's like a physical attack, it's brutal," he explains.
Victims say the identity theft resulting from a phone porting scam can be 'brutal'.
How scammers are stealing numbers
Because it requires passing themselves off as someone else, scammers need a significant amount of personal information to successfully initiate a SIM swap or port.
These personal details can be collected via phishing – a type of information theft increasingly common at this time of year.
Banks whose customers have been impacted by SIM swap and phone porting scams say victims may initially receive emails or text messages claiming to be from the ATO.
These sort of impersonation schemes are commonly rolled out when we're going from one financial year into another, a time when people are filing tax returns and expecting to hear from the tax office.
Tax time phishing scams often encourage victims to provide information such as their full name, mobile number and address in order to secure refunds or protect their account – details that can be used to attempt a fraudulent SIM swap or phone port.
These sort of impersonation schemes are commonly rolled out when we're going from one financial year into another, a time when people are filing tax returns and expecting to hear from the tax office
In addition to this information, scammers can also weaponise personal details exposed following data breaches or hacks of customer files at large companies.
Putting on an act
Once they have enough of your information, scammers will then contact your telco pretending to be you and try to convince them to transfer your number to a device they control.
They may also spin a story about a lost phone, being in trouble and needing a new device to put pressure on staff to transfer the number.
If a telco sends messages to the holder of the number to authenticate the request, the criminal party may also contact that person and pose as the service provider or another organisation in order to obtain any authentication codes.
Authorities cracking down but cases on the rise
SIM swap and phone porting scams pose enough of a threat that telcos have recently been directed to put in place processes to reduce the chance of unknowingly approving fraudulent requests.
Between 2020 and 2022, ACMA (the telco regulator) introduced rules requiring service providers to use multi-factor authentication to confirm that the person controlling the phone number is actually the one making the request to transfer it.
ACMA says these regulations led to a "significant decrease" in SIM swap and phone porting fraud, but the system hasn't always been as effective as hoped.
For example, last year the regulator fined Telstra over $1.5 million for not properly authenticating customer identities during 168,000 "high-risk interactions", including SIM swaps.
Last year ACMA fined Telstra over $1.5 million for not properly authenticating customer identities during 168,000 'high-risk interactions', including SIM swaps
Furthermore, IDCare says while ACMA's rules initially had a positive impact, the numbers of mobile fraud victims reaching out to it for help have once again started increasing.
The number of people contacting the organisation each month following an unauthorised SIM swap or phone port climbed from an average of 34 over 2023, to 89 in the 12 months to March this year – an increase of over 160%.
Recent police action also shows the continued popularity of the phone porting method – in March this year, the federal police charged a Melbourne man for allegedly trying to port 86 different mobile numbers.
One victim support group has had an increase in people seeking help following a fraudulent SIM swap or phone port.
What's being done?
IDCare says a recent spate of data breaches affecting major companies could be delivering scammers more information on Australian consumers, making it easier to perform unauthorised SIM swaps and ports.
An ACMA spokesperson tells CHOICE the regulator is aware of data indicating a rise in reports of mobile fraud and is currently in the process of working out what's behind the trend.
It says that, in the meantime, it will continue to enforce the existing regulations on telcos requiring them to carefully authenticate requests for SIM swaps and phone ports.
Telcos are reluctant to share detailed information about how they handle SIM swap and porting requests, but Telstra and Optus tell CHOICE they have multi-factor authentication processes in place.
On their respective websites, both telcos say these processes can include putting information into their respective apps or completing an in-store ID check.
Telstra notes that while its procedures are "strict and robust", criminals could potentially bypass them if a victim's identity has been thoroughly compromised.
How to avoid SIM swap and phone porting scams
- Avoid phishing attempts: Scammers need lots of information on you to steal your phone number. Avoid sharing sensitive personal and financial details on suspicious websites or in response to dubious phone calls or messages.
- Beware of changes to your phone service: Look out for messages or emails suggesting you're trying to leave your telco or have requested a new SIM. Contact your provider using details you've found yourself to stop your number being transferred.
- Be sceptical of calls asking for codes: Watch out if you start receiving unexpected authentication messages from your telco and hang up on anyone calling to ask for these codes.
- Act quickly if you lose connection: If your phone starts unexpectedly displaying "SOS only" and you lose service, check your online accounts for any sign of compromise. Contact your bank and telco using details you've found yourself and tell them you're the target of fraud. Contact IDCARE for further assistance.
*Pseudonym.
We're on your side
For more than 60 years, we've been making a difference for Australian consumers. In that time, we've never taken ads or sponsorship.
Instead we're funded by members who value expert reviews and independent product testing.
With no self-interest behind our advice, you don't just buy smarter, you get the answers that you need.
You know without hesitation what's safe for you and your family.
And you'll never be alone when something goes wrong or a business treats you unfairly.
Learn more about CHOICE membership today
Stock images: Getty, unless otherwise stated.
