Telstra Penalty: SIM Swap Checks That Were Not Done

The rule is simple: before a phone company moves your number or resets your password, it must check it is really you. For 168,000 interactions, the regulator says it did not.

By Siddharth ShankarUpdated October 11, 2026

When a phone company moves your number to a new SIM, it is making a decision with real consequences. If the person asking is not you, the result can be a drained bank account. Australian rules require specific checks to prevent that. This case is about what happened when those checks were skipped.

What happened

The ACMA announced that Telstra was penalized $1,551,000. The penalty was for conduct between August 2022 and April 2023. The ACMA says 168,000 high-risk customer interactions were handled without the required identity checks, including over 7,000 involving customers in vulnerable circumstances.

The interactions were SIM-swap requests and password resets. Telstra agreed to a two-year court-enforceable undertaking, including an independent compliance review.

How it worked

The 2022 customer identity authentication rules require multi-factor checks, such as a one-time code, before high-risk requests are completed. According to the ACMA, those checks were not carried out for the interactions it identified.

The article does not describe any outside criminal. The failure it addresses is a process one, and the regulator treated it as a breach of rules designed to prevent SIM-swap fraud.

What was exposed

What was at risk was control of a customer's phone number. Scammers use that to receive one-time codes and reset passwords. The ACMA cited average losses of $28,000 for mobile fraud victims.

The ACMA also states that there is no direct evidence anyone lost money because of these breaches. That is not the same as evidence that nobody did, and the article does not claim it is.

How it ended

The ending is a penalty and an undertaking, not a conviction. The penalty is paid to the government. Telstra's two-year undertaking and independent review are intended to fix the process.

For customers, nothing in the article gives individual redress, but it does show a regulator enforcing rules written to protect phone numbers.

A timeline of the case

The conduct ran from August 2022 to April 2023. The ACMA announced the penalty in July 2024, and Telstra agreed to a two-year court-enforceable undertaking with an independent compliance review.

The undertaking is arguably as important as the penalty. It commits the company to a process of improvement that an outsider can check, whereas a penalty is a one-time payment.

Key facts at a glance

• Penalty: $1,551,000
• Conduct period: August 2022 to April 2023
• Interactions without required checks: 168,000
• Involving vulnerable customers: over 7,000
• Types: SIM-swap requests and password resets
• Undertaking: two years, with an independent compliance review

Why this case matters

Many people believe that fraud begins with a criminal tricking a customer. SIM swap fraud can involve tricking a call-centre agent or a weak verification process. If the verification step is skipped, the safest customer in the world is at risk.

That makes your own backup controls important: a port-out PIN, an authenticator app and prompt attention to loss of signal.

What you can do

How to read the numbers

The figure of 168,000 is the number of high-risk interactions where required checks were not done, not the number of fraud cases. The ACMA's statement that there is no direct evidence of loss from these breaches is important context. The rules exist to prevent harm before it happens, which is why breaches can be penalized even without proven losses.

What the article does not say

The article does not name any victims or say whether any identified interaction led to loss. For a criminal prosecution of SIM swappers, see the London SIM swap case.

Related reading that helps with cases like this: what to do if your phone number was in a breach, what an exposed phone number means and how scammers find your phone number and email. You can also try our free phone number exposure check.