Telstra—Telstra fined after failing to verify customer identity, enabling 15 unauthorized SIM swaps tied to fraud losses
Australia's communications regulator ACMA found that between June 26 and October 30, 2025, Telstra failed to use required identity-authentication processes for high-risk account transactions, contravening Section 8 and subsection 13(1) of the Telecommunications Service Provider (Customer Identity Authentication) Determination 2022 and subsection 101(1) of the Telecommunications Act 1997. The investigation identified 15 unauthorized SIM swaps enabled by the lapses, contributing to customer fraud losses. ACMA issued Telstra an infringement notice of A$277,200, published September 3, 2026, alongside an enforceable undertaking.
Scoring Impact
| Topic | Direction | Relevance | Contribution |
|---|---|---|---|
| Consumer Protection | -against | secondary | -0.50 |
| Data Security | -against | primary | -1.00 |
| Overall incident score = | -0.443 | ||
Score = avg(topic contributions) × significance (medium ×1) × confidence (0.59)
Evidence (1 signal)
ACMA infringement notice: Telstra fined $277,200 for identity-authentication failures enabling 15 unauthorized SIM swaps
ACMA's investigation report, published September 3, 2026, found Telstra failed to use required identity-authentication processes for high-risk transactions between June and October 2025, enabling 15 unauthorized SIM swaps tied to customer fraud losses; Telstra paid a $277,200 infringement notice and entered an enforceable undertaking.