The Australian Communications and Media Authority (ACMA) has taken action against two more telcos under its crackdown on companies violating the mobile number fraud rules, with businesses paying almost $5 million in penalties in the last 18 months.
SpinTel Pty Ltd (SpinTel) is the latest telco to be penalised, paying $59,400 following an investigation that found scammers used a vulnerability in its systems to gain access to one-time verification codes it used in multi-factor identification processes.
The ACMA investigation found that between February and March 2025 scammers were able to transfer 10 consumers' mobile numbers without authorisation, resulting in reported financial losses of more than $45,000.
Authority member Samantha Yorke said when telcos don't have secure systems and their identity verification systems are compromised, it can lead to serious consumer harm.
"Losing thousands of dollars in seconds can be devastating and have lasting impacts. Once a scammer gets access to your mobile phone service, you're in danger. They can then gain access to your banking apps, health records, personal information and more," Ms Yorke said.
SpinTel has also entered into an 18-month court-enforceable undertaking requiring an independent review of its security arrangements and implementation of recommended improvements.
A second telco, Yomojo Pty Ltd, was issued with a formal warning under the crackdown after the ACMA found it failed to publish advice on its website informing customers who suspect they have been a victim of mobile number porting fraud to immediately report it to police.
Under the Telecommunications (Mobile Number Pre-Porting Additional Identity Verification) Industry Standard 2020, all telcos that provide mobile services must verify the identity of a customer before transferring in their service from another provider. They must also publish information advising consumers what steps to take if they suspect their number has been fraudulently transferred.
"This is the sixth enforcement announcement in the past year under our push to see consumers protected from this type of fraud. We are deeply concerned that so many telcos have had system vulnerabilities placing Australians at risk of preventable harm.
"The ACMA has been providing advice to the telecommunications sector about potential weaknesses and emerging threats as part of our compliance program, and we urge all providers to ensure their systems are tested and secure," Ms Yorke said.
Consumers should contact their telco and financial institution immediately if they think they have been a victim of a phone scam. It also helps other Australians by reporting scams to Scamwatch.
IDCARE can help people whose identity has been compromised or stolen on 1800 595 160 or at https://www.idcare.org/.
Support is also available from Lifeline (131 114) or Beyond Blue (1300 224 636).
