Telstra Fined $277,200 for Major SIM Swap Security Failures

In a significant move against telecommunications fraud, the Australian Communications and Media Authority (ACMA) has penalized Telstra $277,200. The fine follows an investigation that revealed systematic failures in identity verification during SIM swap requests. For the online gambling and financial sectors, this case serves as a stark warning. SIM swapping is a preferred method for criminal syndicates to bypass two-factor authentication, allowing them to drain accounts, including those at online casinos and banks.

The ACMA probe determined that between January and October 2025, Telstra failed to follow mandatory authentication processes in 15 separate unauthorized SIM swaps. Perhaps more concerning were the 13 instances where Telstra agents failed to implement additional safeguards for customers who were already flagged as high-risk or who had expressed direct concerns about their security. These failures directly led to financial losses totaling at least $39,500 for the affected individuals.

Numbers and facts

The financial penalty of $277,200 reflects the severity of the oversight. According to ACMA, this is part of a broader crackdown on mobile number fraud, which has seen the industry pay over $5 million in penalties to date. Telstra’s frontline staff were found to have ignored the company’s own internal safety procedures. Beyond the fine, Telstra has entered into court-enforceable undertakings, committing to a comprehensive review and upgrade of its fraud prevention training and technical protocols.

„In this case, Telstra’s frontline staff did not follow the provider’s own processes, leaving customers vulnerable to SIM swap scams and other types of mobile fraud. When a telco becomes aware that a customer is at risk of fraud involving their service, it must offer protections that are additional or tailored to the situation.“ - Samantha Yorke, Authority Member of the ACMA

Background

SIM swap fraud occurs when a malicious actor convinces a mobile carrier to port a victim's phone number to a new SIM card under the attacker's control. Once the transfer is complete, the criminal receives all calls and texts intended for the victim, including one-time passwords (OTPs) used for financial transactions or gambling site logins. The ACMA emphasizes that these operations are often run by organized crime groups, making robust verification by telcos a vital line of defense for the entire digital economy.

Why it matters for German players

For players in Germany, this incident highlights the necessity of the strict regulatory environment established by the Interstate Treaty on Gambling 2021 (GlüStV 2021). While the Telstra case occurred in Australia, the mechanics of the fraud are global. Germany’s central systems, such as LUGAS, and the oversight of the Joint Gambling Authority of the States (GGL) provide high levels of protection, but user-end security remains paramount. If a mobile provider fails to secure a phone number, even the most compliant German casino account could be at risk.

German players are strongly advised to play only at GGL-licensed casinos listed on the official whitelist. these operators adhere to strict limits, such as the €1,000 monthly deposit cap and the €1 per spin stake limit. Because SIM swaps can be used to hijack accounts, players should consider using app-based authentication rather than SMS-based codes whenever the casino or their bank offers it. Security in the German market relies on the synergy between regulated operators and secure personal communication channels.

What it means for GGL-licensed casinos

For casinos operating under a GGL license, the Telstra incident underscores the importance of monitoring for suspicious account activity that might indicate a compromised device. German law requires operators to maintain high standards of data protection and anti-money laundering (AML) checks. If a provider suspects a customer has fallen victim to identity theft, they must take immediate action to freeze the account. This case shows that the weakest link in the security chain is often not the casino itself, but the service providers supporting the player's digital identity.