Summary

  • ACMA’s 30 September 2026 release described separate investigations: 13 Amaysim transfers in 2025 without required additional identity checks, and Ezee Mobile’s failure to publish required advice for customers who suspect a fraudulent port.
  • The 2020 standard places prevention before a transfer and response guidance on a provider’s website. The two cases therefore test different control points and resulted in different enforcement records.

One instrument, two points of failure

A phone number is both a way to reach a person and a recovery credential for services that use SMS. Moving it without the rights-holder’s authority can disrupt communications and expose linked accounts. Australia’s Telecommunications (Mobile Number Pre-Porting Additional Identity Verification) Industry Standard 2020 addresses that risk at two different moments: before a gaining provider proceeds with a port, and after a customer suspects that a port was fraudulent.

The Australian Communications and Media Authority’s 30 September 2026 announcement concerned two separate investigations. ACMA said its investigation found 13 occasions in 2025 when Amaysim transferred numbers without required additional identity verification, resulting in unauthorised transfers. Amaysim paid an A$138,600 infringement notice. The notice concerns alleged contraventions; its terms say payment discharges liability for those allegations and is not an admission or a court finding.

ACMA also accepted an enforceable undertaking requiring an independent review of Amaysim’s policies and procedures, implementation of recommended improvements and regular reporting. Those are future-facing obligations, not evidence that the review or improvements are complete or effective.

In a different case, ACMA issued a formal warning to Switch Mobile Networks, trading as Ezee Mobile. The finding concerned the absence of published advice telling customers who suspect a fraudulent port to contact the Australian Federal Police or relevant state or territory police and government support services. Ezee told investigators that it added the advice to its website in November 2025, after the investigation began. The report records one contravention of the information-publication requirement. It does not connect Ezee to Amaysim’s transfers; these are separate records, not one incident.

The standard makes the distinction explicit. Section 8 requires a gaining provider to use at least one additional identity-verification process before initiating a port, and not to proceed unless the requester is the customer or authorised representative. Depending on the channel, the process may confirm access to the existing device, use a unique code, use biometric data, or follow specified alternatives when the ordinary process cannot confirm identity. Section 9 separately requires providers to publish both the existence of those safeguards and advice about reporting a suspected fraudulent port.

This pairing matters because prevention and recovery are not interchangeable. A website notice cannot stop a weak verification step. A strong verification flow cannot tell a customer what to do when the number has already moved. The enforcement contrast—an infringement notice plus an enforceable undertaking in one case, a formal warning in the other—shows different remedies applied to different findings. The public records do not state a comparative penalty formula, so the difference should not be read as a general ranking of harm or seriousness.

ACMA said it was not aware of financial losses arising from Amaysim’s breaches. It also warned that affected people may face distress, service disruption and time-consuming restoration of accounts and identities. That statement is bounded: it does not establish that no other harm occurred, or that each of the 13 transfers maps to a particular victim outcome. Nor does the payment settle the allegations as a court judgment.

Analysis

What a useful compliance record would show

For prevention, operators need auditable records showing which verification route was used, whether it completed before the port, how exceptions were handled and who could override a failed check. For response, they need to keep the required advice visible, current and findable when a customer is under pressure. A posted page is a compliance artifact; it is not proof that customers saw it or that recovery was quick.

The Amaysim undertaking makes the next evidence question concrete: when will the independent review occur, what recommendations will it make, and how will ACMA report their implementation? For Ezee, the public material establishes that advice was added, but not when all customers could find it or whether subsequent testing found it usable. A later enforcement update or company-wide audit data would change the assessment more than another reminder that the standard exists.

Incentives and the cost of a one-sided control

A gaining provider controls the porting workflow and the evidence that a check happened. Customers bear the immediate disruption when a number moves without authority; losing providers may have limited ability to intervene once the gaining-side process has passed. Regulators therefore need records that connect identity checks to the transaction and consumer-facing advice to a reachable support path.

If operators optimize only for fast port completion, verification becomes a queue step to work around. If they optimize only for written compliance, the advice requirement can become a buried webpage with little practical value. Delays can also harm legitimate customers, so a rigid process that cannot handle lost devices or authorised representatives may shift risk rather than remove it. The durable control is a traceable decision at the point of transfer, paired with a clear recovery route.

Once a number has moved and accounts have been reset or locked, restoring the prior state can be difficult; investments in verification and response design are cheaper before that failure path becomes routine.

Sources