Amaysim has paid A$138,600 after the Australian Communications and Media Authority found 13 breaches of mandatory identity checks during mobile number transfers in 2025, the regulator announced on 30 September 2026. ACMA says the failures allowed unauthorised transfers and that it is unaware of financial losses arising from the breaches. The case shows why control of a mobile number can matter well beyond making calls.
A number transfer, usually called porting, lets a customer keep their mobile number when moving between providers. That convenience also makes identity checks important: an unauthorised transfer can move control of the number away from its legitimate customer. Messages intended for that person may then reach somebody else, including security codes used to access other accounts.
Providers taking on a number must complete the applicable identity verification before transferring it. ACMA’s porting guidance sets out the obligations for receiving providers, including approved verification processes. A request to move a number should therefore trigger a check of the person’s authority, rather than being treated as an ordinary administrative change.
The regulator’s response includes work beyond the financial penalty. Its case record lists the investigation report, infringement notice and enforceable undertaking. Under the undertaking described in ACMA’s announcement, Amaysim agreed to an independent review, implementation of improvements and reporting to the regulator. These commitments concern the controls intended to prevent another unauthorised transfer.
Customers should distinguish an unexpected loss of service from proof of fraud. An outage or account problem can also stop a phone working. Techord’s guide to disaster roaming explains a separate arrangement for eligible network disruptions during natural disasters. However, ACMA’s recovery guidance says people who suspect their number has been stolen should contact their provider promptly and seek reversal of an unauthorised transfer. Using another phone or a trusted internet connection may be necessary if the affected service no longer works.
The consequences can extend to accounts connected to that number. ACMA advises affected people to contact their bank, change relevant passwords and seek support or report the incident through the appropriate channels. Number porting is also different from a SIM swap within the existing provider, although both can result in someone else controlling incoming calls or messages. Describing what happened accurately helps the provider investigate the right process.
Account security can reduce reliance on text-message codes where alternatives exist. ASD’s security guide describes stronger multi-factor authentication options, including security keys and authenticator applications. Multi-factor authentication remains valuable compared with a password alone; the practical question is whether an important account offers a method that does not depend on continued control of one mobile number.
The absence of known financial losses should be read narrowly. It describes what ACMA knew about these breaches, rather than guaranteeing that unauthorised porting is harmless or that every consequence has been measured. For customers, unexpected transfer notifications deserve attention. For providers, the enforcement outcome puts the focus on whether identity checks reliably stop a transfer before control of a number changes hands.
