Vodafone breached mobile ID rules after IT system change

Telco provider, Vodafone, found itself in hot water after changes to its IT system meant that it failed to verify the identity of 1028 prepaid mobile customers before activating their services, an investigation by the Australian Communications and Media Authority (ACMA) found.

The breaches occurred over a 12-month period, between 6 January 2015 and 6 January 2016, as a result of changes to Vodafone's IT systems that allowed customers to self-select online that their identity had been verified in-store, without any further checks that this had actually happened, the ACMA found.

In an effort to significantly improve its processes, a court-enforceable undertaking commits Vodafone to conduct a review and risk assessment of any future proposed changes to its systems and processes, instigate training programs, conduct compliance audits every six months and report to the ACMA.

A Vodafone spokesperson explained it has since taken steps to confirm the identity of those customers or cancel services in cases where this verification wasn't possible, and resolve the underlying issue.

“We can assure our customers that our systems and processes are robust, and we are continually working to ensure we act in accordance with the law,” the spokesperson said. “We have been working closely with the ACMA to satisfy them of our ongoing compliance, and are committed to the terms of the undertaking.”

ACMA acting chair, James Cameron, warned that telcos must check that changes to their IT systems don't run the risk of contravening legal requirements.

"Verifying the identity of prepaid mobile customers helps law enforcement and national security agencies obtain accurate information about the identity of customers for the purposes of their investigations," he said. 

The Telecommunications (Service Provider - Identity Checks for Prepaid Mobile Carriage Services) Determination 2017 requires all telcos to verify the identity of customers of prepaid mobile services before activating their services.

The ACMA attention comes after Vodafone’s legal efforts to turn around the ACCC’s decision not to allow a wholesale domestic mobile roaming scheme was rejected by the Federal Court.

Vodafone filed legal action for a judicial review of the Australian Competition and Consumer Commission's (ACCC) process in its domestic roaming inquiry following its draft decision on 5 May, which saw it reject proposals to allow a wholesale domestic mobile roaming service.

If a national roaming service were to be declared by the ACCC, it would allow mobile network carriage providers tap into infrastructure belonging to other telecommunications providers to access additional coverage.

In its half-year financial report in July, the telco spruiked about spending $2 billion on its mobile network and technology in 2017, despite reporting a half-yearly loss of $81.5 million.