Summary

  • ACMA reported 13 Amaysim transfers in 2025 without the required extra identity checks. The company paid an infringement notice and undertook to have its procedures independently reviewed.
  • Ezee Mobile received a separate warning for missing reporting advice on its website. That case concerned information for customers, not the Amaysim transfers.

The awkward customer for a mobile identity check is the legitimate one who has lost their phone. Sending a code to the missing device may establish nothing useful. Yet waving the check through would undermine the very safeguard meant to stop somebody else taking the number.

Australia's pre-porting identity standard anticipates that problem. It gives the receiving provider prescribed alternatives, including document checks and government verification, when the usual methods cannot establish who is asking. Losing a handset is an example in the rule itself. It is a reason to use another verification route, not to skip verification.

That distinction makes the Amaysim enforcement file more useful than the penalty headline alone. In its 30 September 2026 announcement, ACMA said required checks had been missed on 13 occasions in 2025, leading to unauthorised transfers. The infringement notice identifies Amaysim as the receiving provider and dates the alleged breaches between 21 August and 3 October. The new provider was responsible for establishing who wanted the move before proceeding with it.

Amaysim paid A$138,600. The notice expressly distinguishes payment from an admission of liability or a finding that the alleged contraventions occurred. ACMA's investigation findings remain the regulator's findings; the payment should not be rewritten as a court judgment.

Nor does payment finish the practical work. ACMA also accepted an enforceable undertaking covering independent review of Amaysim's policies and procedures, implementation of recommended improvements and regular reports to the regulator. Those commitments describe work to be done, not a demonstrated improvement in customers' safety.

The other file starts with a webpage

Switch Mobile Networks, trading as Ezee Mobile, faced a different question: what could a customer find after suspecting that somebody had moved their number?

The Ezee investigation report records an inspection of its website on 27 October 2025. The required advice about reporting suspected fraudulent transfers to police and government support services was absent. Ezee subsequently told investigators it had added the information in November. ACMA issued a formal warning. This was an information-duty breach in a separate investigation, not another account of Amaysim's 13 transfers.

A support page can sound like a small matter beside an identity check. Its importance becomes clearer once the number is gone. Calls may no longer reach their intended recipient; access to accounts that use text messages may also be disrupted. The customer then needs to know where to report the suspected fraud. Section 9 makes publishing that advice a duty in its own right.

ACMA said it knew of no financial losses arising from the Amaysim breaches. That is narrower than saying nobody was harmed. It also noted the potential distress, interruption and effort of regaining access. A missing balance-sheet loss does not restore a phone number.

These records leave two different follow-up questions. Does Amaysim's review lead to changes that work in actual port requests, including difficult exceptions? Does Ezee's published advice remain accurate and findable? An undertaking and a newly added page are evidence of responses. Neither, by itself, tells us how the next affected customer will fare.