Exetel has paid a $694,860 penalty after the communications watchdog found the telco failed to comply with anti-fraud rules designed to stop criminals hijacking mobile numbers.
An Australian Communications and Media Authority (ACMA) investigation found Exetel breached the rules on 73 occasions in June and July 2024 after scammers manipulated its systems to bypass parts of the required identity verification processes. The breaches allowed criminals to gain control of mobile number services and access consumers’ bank accounts, with reported losses of at least $412,000.
Authority Member Samantha Yorke said Exetel had exposed people to serious financial harm and stress.
“We are aware of reports of significant financial losses suffered by consumers, and we know that this kind of fraud can also lead to misuse of personal information and ongoing emotional harm connected to identity theft,” Ms Yorke said.
“While Exetel took steps to fix its issues soon after they were identified, the simple fact is the vulnerabilities should not have existed in the first place and the people impacted should have been protected.”
“These scams are often perpetrated by sophisticated criminal syndicates and telcos must ensure their online portals and forms are secure and cannot be compromised.”
The financial penalty is the largest to date for contraventions of these rules, according to the ACMA, which has made disrupting mobile number fraud a compliance priority. The regulator said it is actively monitoring whether telcos are meeting their fraud prevention obligations and will take strong enforcement action if it finds non-compliance.
Under the Telecommunications (Mobile Number Pre-Porting Additional Identity Verification) Industry Standard 2020, telcos must verify the identity of anyone seeking to transfer their number to a new provider before a transfer is completed.
Consumers who believe they have been targeted should contact their telco and financial institution immediately. Suspected scams can be reported to Scamwatch at scamwatch.gov.au. IDCARE provides support for identity compromise on 1800 595 160 or at idcare.org. Mental health support is available from Lifeline (13 11 14) and Beyond Blue (1300 224 636).
