Telstra fined 1.5million | Dirt Report

Why Telstra was fined

The Australian Communications and Media Authority fined Telstra $1.5 million after finding that the company did not adequately authenticate customer identities during important transactions. The relevant rules required multi-factor authentication for actions such as resetting passwords and replacing SIM cards.

ACMA’s investigation covered the period from August 2022 to April 2023 and identified 168,000 high-risk interactions where Telstra did not comply with the requirements. More than 7,000 of those interactions involved customers in vulnerable circumstances.

The failure did not prove that customers had directly lost money as a result of the breach. However, ACMA member Samantha York said mobile fraud victims lost an average of $28,000, and warned that SIM swap scams could result in victims losing their savings, phone numbers and personal information.

Why SIM swaps are a security risk

A SIM swap occurs when a replacement SIM card is requested, such as when an existing SIM is lost or damaged. If the replacement process is not properly secured, a criminal may be able to move a victim’s phone number to another SIM card.

That can be particularly serious because SMS messages are used by many services as a fallback authentication method. A person controlling the number could potentially receive verification codes for services such as banking and social media accounts, depending on the security controls used by those services.

The transcript notes that ACMA did not find direct evidence linking the identified interactions to customer financial losses. Telstra has agreed to a two-year undertaking requiring action to address the breaches and future transactions. The undertaking is court-enforceable if it is not followed.

Telstra’s response

A Telstra spokesperson said the company supported regulations focused on customer security, but described the 2022 requirements as significant in scope. The ACMA findings indicate that Telstra’s systems were not compliant when the rules came into force.

The fine follows earlier penalties mentioned in the report. Telstra was ordered to pay $10 million in 2018 after a Federal Court finding that it misled 100,000 customers through premium direct billing. The transcript also refers to a $50 million Federal Court penalty in 2021 for unconscionable conduct.

Reported Smart Modem replacement delays

The report also discussed a separate Channel News story about Telstra customers waiting weeks for replacement Smart Modems. The reported issue involved failed modems leaving customers without an NBN connection, while the modem’s 5G emergency SIM backup was also reported to fail when the power unit stopped working.

According to the report, some customers experienced delays replacing failed equipment. It also described a customer being told to remain calm during a support interaction, with a claim that becoming angry could result in the replacement order being cancelled. Telstra reportedly attributed some of the delays to StarTrack rather than to its own operations.

The Smart Modem issue was presented as a separate customer service problem from the ACMA fine. The transcript did not provide independent testing results or a confirmed total number of affected customers.