Protecting our customers from SIM swap scams

Scams cost Australian consumers, businesses, and the national economy hundreds of millions of dollars each year and can cause serious distress to victims and their families. With criminals developing increasingly sophisticated methods to catch people out, we all need to be vigilant in checking for clues that can alert us to if something is a scam. Telco providers like Optus are particularly on alert for ‘SIM swap’ scams.

In short, a SIM swap scam occurs when a fraudster takes control of your mobile phone number then uses it to steal from you. 

How does a fraudster do this? When attempting a SIM swap scam, fraudsters will try to gather as much personal information about you as possible. They may also apply emotional pressure to service agents, a process known as ‘social engineering’ to convince a carrier they are the account holder.

An unauthorised SIM swap occurs when a scammer takes control of your mobile phone service by asking your telco provider to cancel your SIM card and connect your phone number to a SIM card in their possession. 

The fraudster may pretend they are changing carriers or have lost their device. Usually, the scammer uses your personal details, such as your date of birth and address, to convince the provider the request is legitimate. 

Once the number is changed to a new SIM, anyone texting or calling your number will get through to the fraudster’s device, not your smartphone. Once the fraudster has access to your mobile service, they will also receive the two-factor authentication messages which allows them to access your other accounts – like your email or bank account.

The fraudster is then set up to inflict serious harm.

Optus, along with the wider telco industry, is working to enhance existing protocols and controls to prevent unauthorised access to customers’ accounts and services. 

In line with the new Telecommunications Service Provider (Customer Identity Authentication) Determination 2022 introduced by the Australian Communications and Media Authority (ACMA), we are continuing to expand our Multi Factor Authentication protections to a wider range of transaction types, such as changes to accounts, disclosure of personal information or SIM swap requests.

In the case of SIM swap requests, further identity verification checks, such as completing an in-store ID check may be required. When completing a SIM swap through one of our contact centres, there is a delay integrated into the process to protect our customers if the request was not initiated by them.  

While some customers may feel these extra steps are burdensome, Optus takes customer security and data very seriously and knows this is the best way to protect people from scams.

To ensure all our customers can interact with Optus in a manner that is suitable for them and their circumstances, Optus has an established Account Security team. The role of this team is to assist vulnerable customers, or those experiencing exceptional circumstances such as domestic violence, to verify themselves using non-standard methods. 

We encourage customers to be vigilant about the security of their personal information, regularly change their passwords, not re-use passwords between multiple accounts, and be wary of sharing their personal details and identity documents.

A good rule to remember is: If in doubt, don’t. This means don’t answer that suspicious call, don’t click on an unfamiliar link, and don’t give out personal or bank account details unnecessarily.

Transacting with Optus via the My Optus App is the most secure method.

If you think your Optus account has been compromised, please get in touch with us as soon as possible to let us know. You can call us on 133 937 or message us at any time on My Optus app. 

Most importantly, if you do think your details may have been compromised or have any concerns about the security of your bank accounts, contact your financial institution immediately to alert them.