SUMMARY
This is AI generated summarization, which may have errors. For context, always refer to the full article.
MANILA, Philippines – The exploitation of vulnerable consumers’ data is fueling the black market in “pre-registered” SIM cards used in digital fraud, according to the Cybercrime Investigation and Coordinating Center (CICC).
CICC director Rojun Hosillos told Rappler on Tuesday, August 15, that a large number of the 30,000 SIM cards seized during the August 1 raid on the offices of gaming firm SA Rivendell have been used as recipients of crime proceeds via online payment services like GCash and Maya.
Law enforcers are trying to follow two tracks, the official said: an organized crime group facilitating the acquisition of ‘pre-registered’ SIM cards, and lawbreakers who may have found a way to register the SIM cards through exposed identity and credentials of Filipinos.
“We are checking if there are actual registrants, if there is a way of automated registration, who collects these SIM cards should they be registered by actual persons, how these SIM cards are transported, how these SIM cards have social media and financial apps credentials, etc.,” Hosillos said.
In a separate interview on August 14, the head of tech advocacy group Democracy.net.ph said both tracks are related as the process of SIM card registration is vulnerable to using fake identities.
The raid on gaming firm SA Rivendell led to a haul of paraphernalia used for fraudulent cryptocurrency scams. It prompted the Department of Justice to invite telecommunications firms to help the case build-up by tracing how syndicates got hold of thousands of SIM cards
‘Sale of identity’
The Presidential Anti-Organized Crime Commission said random tests after the August 1 raid showed that the seized SIM cards have been activated.
“In this case, it is apparent that there was a sale of identity of SIM registered with another person,” Globe general counsel Froilan Castelo acknowledged in an interview on August 15.
He did not elaborate but said it was among the reasons for the company’s support for the government’s efforts to combat cybercrime on digital platforms.
Castelo mentioned the proposed Anti-Money Mule bill, filed by Senator Juan Miguel Zubiri in March. The proposed law penalizes the sale of identity using bank accounts and SIMs by another person to another.
Rappler reached out to Globe and Smart Telecommunications to follow up on their internal probes and steps to plug private sector vulnerabilities found in the enforcement of Republic Act No. 11934 or the SIM Card Registration Act of 2022.
Smart said it could not yet answer the questions. Globe said it would provide more detailed answers as developments arise in their internal probe.
PAOCT earlier said it would turn over the SIM cards to Smart and Globe to obtain the names of those who activated the SIMs.
Vulnerabilities
The head of Democracy.net.ph, an information and communications technology rights advocacy group noted several vulnerabilities under the SIM Card Registration law that make it difficult to halt digital fraudulent schemes.
Jun Macarambon, the group’s president, said phishing remains a menace because scammers are able to register using fake identities.
He urged telecommunications companies to periodically test their registration process as no system is 100% secure.
He also said a regular compliance check by the NTC is necessary to secure and audit the SIM card registration system.
“The registration system of the telcos could be bypassed or registered using stolen IDs. There should be a part in the registration system where telcos may verify if the registered mobile user is valid. Although this may have an additional cost to telcos as it will take time to verify,” Macarambon told Rappler.
“There is also a risk of hacking the SIM registration system. There is a risk for data breach. NTC should conduct a compliance check regularly,” he added.
“I think what the telcos and NTC should do is to strengthen law enforcement, fix the policies about SIM registration, review the privacy policy, and conduct regular security audit for this SIM registration system,” Macarambon said.
Based on the National Telecommunications Commission (NTC) website, 67.83% or 113,969,014 total SIM cards have been registered as of July 30, 2023. There are a total of 168,016,400 total subscribers as of December 2022.
The Department of Information and Communications Technology is assigned to perform an annual audit on mobile networks’ compliance with information security standards.
Research by the Global System for Mobile Communications Association Intelligence (GSMA) showed the main limitation of SIM registration solutions remains the potential for fraudulent registration. It also cited the transfer of phones to other people, and the difficulty of tracking or blocking international roaming phones.
The most serious terrorists and criminals are also likely to be the most effective at evading any barriers, including SIM registration, that are placed in their way, the research added.
In one of its case studies on addressing handset crimes, it proposed IMEI (international mobile equipment identity) registration to address issues of criminal activities, including handset theft and hijacking.
The IMEI is a unique reference number for mobile phones where the mobile network is required to store both the SIM or mobile number associated with each of the registered mobile users. – Rappler.com
Add a comment
How does this make you feel?
There are no comments yet. Add your comment to start the conversation.