As SIM-swap fraud rises, MTN wants banks to pay for telecom-powered security checks
SIM-swap fraud has been a persistent problem in Nigeria, and although numerous measures have been put in place to address it, the search for a viable solution continues.
SIM-swap fraud has been a persistent problem in Nigeria, and although numerous measures have been put in place to address it, the search for a viable solution continues.
Between 2019 and 2023, Nigerians reportedly lost about ₦12.5 billion to telecom-related financial crimes, according to the Nigeria Communications Commission (NCC). These crimes are usually perpetrated through a combination of SIM-swap fraud and other social engineering practices.
MTN Nigeria says it has a solution to the niggling SIM-swap fraud, but banks and their customers must pay the telcos to build a security layer.
There are two primary ways in which SIM swap fraud occurs.
The first scenario is the traditional SIM-swap attack. A fraudster gains control of a victim’s phone number by having it ported to another SIM card.
The perpetrator visits a Mobile Network Operator’s (MNO) outlet and reports the target’s SIM as lost or damaged. The operator tries to confirm the phone number, NIN linked, and other account details — the fraudster provides these details, most of which were found on social media or via social engineering.
With the new SIM, they can activate account recovery or password reset requests. Once they receive OTPs and transaction alerts, they may be able to compromise financial accounts.
The second scenario is more subtle and, in many cases, more dangerous.
A customer travels abroad or stops using a phone line for an extended period. The line becomes inactive and is eventually reassigned by the telecom operator to a new subscriber. The new owner then begins receiving SMS messages intended for the previous owner, including banking alerts and other sensitive information.
Over time, this results in surprisingly large amounts of information leakage. The new holder of the number can learn where the customer banks, observe account activity, and potentially gather personal information that can be used in account recovery processes. In some cases, even details such as date of birth can be inferred from routine communications sent by financial institutions.
The challenge, however, is that no single participant has complete visibility into the problem. The telecom operator does not know whether a recycled number is linked to any bank account. The bank does not know that a number has been reassigned. The customer may not even realise the number is about to be recycled.
MTN Nigeria’s Chief Corporate Services and Sustainability Officer, Tobe Okigbo, explains that the popular notion that you own your mobile number is false. He clarifies that network operators pay the government for a set of numbers, and subscribers who think they own the lines are actually only renting them.
“On the network, each number has a license attached to it, paid to the service providers (Huaweis and the ZTEs), to maintain a channel for that particular number,” Okigbo explains. “The numbers have to be uniquely yours and unavailable anywhere in the world. This is because your cell phone can connect to any other network, and if it’s not unique, there’d be a conflict if there’s any other number like it elsewhere”
You can only own your number in perpetuity as long as you keep paying. The rule is that if you don’t use your line for 180 days, it’ll be quarantined. Previously, telcos were required to quarantine at 90 days and recycle at 180 days. But the NCC has mandated them to quarantine at 180, then recycle/sell after 365 days.”
Okigbo explains how Nigerians, with the widespread use of Truecaller, contribute to this problem without realising it. Truecaller helps identify callers whose numbers you don’t have saved on your device. But because there’s nothing like free lunch, Truecaller, in turn, requests access to your contacts and copies how you saved them.
“When your number is inactive for a year, and it’s sold, when you call that number it’ll show the name that Truecaller has,” Okigbo explains. “It has nothing to do with the network but then we still blame the network operators.”
Fraudsters can easily latch onto information from Truecaller and piece it together with other fragments to take over an unsuspecting person’s phone number.
Okigbo also points out that the decision to use phone numbers as a form of identity is simply between banks and their customers, and doesn’t involve network operators.
“There’s no time we agreed with banks to use our numbers as an identifier,” Okigbo clarifies. “Ideally, if you’re going to use our numbers as identifiers, the banks should be paying us because if our numbers are used as identifiers, we’d build the security required so that if something goes wrong, we’d be culpable.”
He maintains that telcos are not at fault for recycling mobile numbers that have been inactive for over a year. He wonders why people are asking network operators to build security for a decision they made themselves.
Allowing a mobile number that you have probably tied to your bank account to lie fallow for 365 days could be dangerous. Some Nigeria are unaware that mobile operators offer plans that can help you keep your mobile number active even when you travel to another country.
Okigbo says conversations are ongoing on whether network operators need to inform all the banks before recycling a particular number, explaining that, from a data privacy standpoint, telcos don’t know the exact account linked to a mobile number.
CEO of Lendsqr, Adedeji Olowe, believes there are numerous ways around the situation.
He says telecom operators should do a much better job of educating customers about inactivity and number recycling. A simple SMS reminder campaign every quarter would cost almost nothing and would significantly increase awareness. Many Nigerians do not know that prolonged inactivity can eventually result in a number being reassigned. The regulators, NCC, should be involved and get telcos to prioritise this.
Second, operators should allow customers to register an email address against their mobile number through a simple USSD process. A customer could dial a code, enter an email address, and verify ownership via a one-time code or a verification link sent to that address.
Once an email address is associated with the account, the operator has a reliable way to contact the subscriber even if the subscriber is no longer actively using the SIM. If a line approaches the inactivity threshold, reminders can be sent via SMS and email to notify the customer that the number is at risk of reassignment. Notifications could be sent months or weeks before recycling occurs.
Third, banks can make greater use of telecom network intelligence services. For example, Chenosis, MTN’s API business, provides services that enable institutions to determine whether a number remains active and whether a SIM swap event has occurred.
