Amaysim pays $138,600 after unverified mobile number ports

Amaysim has paid a $138,600 penalty after Australia’s communications regulator found it transferred mobile numbers without required anti-fraud identity checks.

The Australian Communications and Media Authority said, in a public release reported by Mirage News on 30 September 2026, that its investigation found Amaysim breached mobile number porting rules on 13 occasions in 2025. The regulator said the failures resulted in unauthorised mobile number transfers.

The rules are not red tape for the sake of it. They are meant to stop criminals taking control of a person’s mobile number, then using it to intercept one-time passcodes from banks, email accounts and other online services.

iTnews, in a separate report dated 30 September 2026, said the breaches occurred between 9 May and 29 October 2025 and involved the Telecommunications (Mobile Number Pre-Porting Additional Identity Verification) Industry Standard 2020.

That standard requires the telco gaining the number to run an additional verification process. According to iTnews, the provider must confirm the person asking for the port has rights to the number and direct access to a phone using it.

The iTnews report said ACMA’s findings drew partly on cybercrime reports lodged through ReportCyber and the Australian Financial Crimes Exchange about alleged unauthorised ports to Amaysim.

The failures came through two channels, according to iTnews. Eight ports went through Amaysim’s online porting channel without additional identity verification. Another five were initiated through its customer service channel, also without verification.

ACMA’s description of how the failures occurred was redacted, iTnews reported. However, the enforceable undertaking referred to Amaysim strengthening controls related to the manual override of port-in requests. iTnews said it understood the override applied to the customer service channel, where staff could bypass the requirement to send a verification code.

The infringement notice was issued in May and covered seven of the 13 contraventions, according to iTnews. Each attracted a penalty of $19,800. Paying an infringement notice is not an admission of liability, although iTnews reported Amaysim’s undertaking says it acknowledges ACMA’s findings.

ACMA has also accepted a court-enforceable undertaking from Amaysim. The regulator said, according to the public release carried by Mirage News, the undertaking requires an independent review of policies and procedures, implementation of recommended improvements and regular reporting to ACMA.

iTnews reported the 12-month undertaking requires Amaysim to appoint a regulator-approved independent consultant to review its porting governance, systems, staff training and access to fraud and security expertise. It must also audit every port-in, port reversal and number cancellation request each quarter, and file board-approved compliance reports with ACMA after seven and 12 months.

ACMA chair Nerida O’Loughlin said in the regulator’s public release that robust identity checks are essential to protect consumers from mobile number fraud.

Amaysim told iTnews it had taken action to strengthen verification processes, compliance controls and governance arrangements. The company also said it was not aware of any financial harm to customers arising from the incidents.

ACMA also said it was not aware of financial losses from the breaches, according to both accounts. But the regulator warned victims can still face distress, disruption to essential services and the burden of restoring compromised accounts and identities.

In a separate investigation, ACMA issued a formal warning to Switch Mobile Networks, trading as Ezee Mobile, for failing to provide consumers with information about reporting suspected scams to police and government support services.

The regulator said telcos have now paid more than $5.2 million for breaches of mobile number fraud rules under its compliance crackdown.