Southern Phone Company Limited has paid a $2,500,560 penalty for breaching anti-scam laws following an Australian Communications and Media Authority (ACMA) crackdown on mobile number fraud.
The ACMA investigation found Southern Phone breached the rules on 168 occasions over an 8-month period between July 2024 and February 2025, when scammers were able to manipulate the telco's systems to bypass required identity verification processes.
Scammers were able to gain control of consumers' mobile number services and access their bank accounts, with 20 consumers reporting combined losses of at least $393,000.
Authority Member Samantha Yorke said Southern Phone had exposed people to serious financial harm and stress over a long period.
"Many individuals suffered substantial financial losses, and we know that identity fraud can cause lasting emotional distress," Ms Yorke said.
"The vulnerabilities in Southern Phone's systems went undetected for over a year and should have been identified and addressed much earlier to prevent consumers experiencing this harm.
"The penalty paid in this case is the highest imposed by the ACMA for breaches of this kind and reflects the seriousness and scale of Southern Phone's failures."
In addition to the financial penalty, the ACMA has accepted a 36-month court-enforceable undertaking from the business that requires an independent review of its processes, regular security tests of its systems and reporting to the ACMA.
Disrupting mobile number fraud is a current ACMA compliance priority. The ACMA is actively monitoring compliance with fraud prevention obligations and will take strong enforcement action if non-compliance is found. Telcos have paid over $4.6M in penalties under the current crackdown.
"This is the third enforcement action we have taken this year that has involved scammers exploiting a vulnerability in a telco's number porting processes. Telcos need to acknowledge that this is an established technique being used by scammers and harden their defences," Ms Yorke said.
The Telecommunications (Mobile Number Pre-Porting Additional Identity Verification) Industry Standard 2020 sets out rules requiring telcos to verify the identity of people wanting to transfer their numbers to a new provider before a transfer is completed.
Consumers should contact their telco and financial institution immediately if they think they have been a victim of a phone scam. It also helps other Australians by reporting scams to Scamwatch.
IDCARE can help people whose identity has been compromised or stolen on 1800 595 160 or at https://www.idcare.org/. Support is also available from Lifeline (13 11 14) or Beyond Blue (1300 224 636).
