Telstra paid A$277,200 after skipped ID checks let SIM swaps through

In September 2026, the Australian Communications and Media Authority announced that Telstra had paid a A$277,200 penalty after an investigation found the carrier failed to use required identity authentication processes in 15 unauthorised SIM swaps between January and October 2025. In 13 instances its agents also failed to provide additional fraud protections to customers who had raised concerns or were already flagged as being at risk of fraud. Customers affected reported combined financial losses of at least A$39,500.

ACMA authority member Samantha Yorke said Telstra's frontline staff 'did not follow the provider's own processes, leaving customers vulnerable to SIM swap scams and other types of mobile fraud' — not rules the company lacked, but rules it skipped. She also framed the positive duty: when a telco becomes aware a customer is at risk of fraud involving their service, it must offer protections that are additional or tailored to the situation. Telstra accepted court-enforceable undertakings to strengthen its fraud prevention processes and retrain customer-facing staff.

The penalty was the seventh enforcement action under ACMA's mobile number fraud crackdown, which has now extracted more than A$5 million in penalties from the sector.

A$277,200 penalty; customers reported combined losses of at least A$39,500; retraining plus court-enforceable undertakings.

Frontline staff failed to run the identity authentication processes Telstra itself required before authorising SIM swaps.

Agents skipped additional fraud protections in 13 cases where customers had raised concerns or were already flagged as at risk.

A phone number doubles as the recovery key to banking, email and government services, so a fraudulent swap converts directly into money stolen.

The failures ran for at least ten months before the regulator's investigation caught them.

Fraud controls fail at the frontline: a process that exists on paper but is skipped at the counter leaves the customer holding the loss.

Telstra paid the A$277,200 penalty and gave ACMA court-enforceable undertakings to strengthen fraud prevention and retrain customer-facing staff. The sector-wide crackdown has now produced seven enforcement actions and more than A$5 million in penalties.