Warning to South Africans who travel overseas

South Africans using a mobile virtual network operator (MVNO) for their primary phone number may be at increased risk of fraudulent SIM swaps.

South Africa’s MVNO market has exploded with new players and evolving products in recent years.

The expansion can be attributed to the country’s three largest mobile networks — Vodacom, MTN, and Telkom — launching MVNO platforms in the past five years.

Before their entries, Cell C was the only operator to offer the service.

The more extensive networks of the bigger operators are undoubtedly an attractive drawing point for companies looking to capitalise on the insatiable local demand for connectivity.

In most cases, MVNOs can offer far more affordable prepaid mobile data than the major networks due to lower operating costs.

Aside from not having to install or maintain any physical radio network infrastructure or equipment themselves, MVNOs can operate with a much smaller headcount and office space.

Most also allow customers to order a physical SIM or download an eSIM through the web or a mobile app, reducing the costs and hurdles in onboarding.

That plays well into South African consumers increasingly favouring online shopping in recent years. Many people now regard not having to visit a physical outlet as a big benefit.

MVNOs are also often part of larger businesses such as banks, grocers, or clothing stores.

Depending on their positioning within the larger company, they may not need to be profitable or as profitable as other divisions.

However, MyBroadband recently found a common issue among many of the newer MVNOs — a lack of support for international roaming.

Just four out of 13 of the major MVNOs in South Africa support the feature. These are FNB Connect, PnP Mobile, Shoprite K’nect, and Standard Bank Connect,

The table below provides a summary of which MVNOs support international SMS roaming.

The big opt-out problem

Many mobile network users may be averse to activating roaming out of fear of running up huge bills.

However, SMS is an absolute must-have while abroad, because it is the sole channel major mobile networks use to communicate requests for SIM swaps.

Fraudsters have long targeted SIM swaps to illegally take control of people’s numbers.

Using stolen or leaked personal information and, in some cases, collaborating with corrupt mobile operator employees, they initiate a SIM swap for a number belonging to the intended victim.

If a fraudulent SIM swap attempt was made, the customer must reply to an SMS to opt out of the process to avoid losing control over their number.

If no response is received within a certain time, the SIM swap request is assumed to be legitimate.

Therefore, a rogue SIM swapper may gain access to a victim’s banking apps and various online platforms on which they use SMS for two-factor authentication.

A person using a SIM without SMS roaming or those who have not activated SMS roaming will not get the SIM swap notification.

The other problem with the opt-out approach is that it does not account for time differences.

If a fraudster successfully initiates a SIM swap at 08:30 in the morning in Johannesburg but the person who uses the number is in New York, they will receive the notification at 02:30 in the morning.

Vodacom and MTN provide two hours for opting out, after which the swap will proceed. By 04:30 in New York, the phone number will no longer be under the rightful user’s control.

Use an MVNO as a supplementary provider

Vodacom and MTN previously tried to switch from opt-out to opt-in.

However, Cell C launched a legal challenge to the planned changes, arguing it was against the country’s porting regulations.

The High Court subsequently ordered that cellular networks must follow an opt-out process for SIM swaps, as opt-in often resulted in legitimate porting requests not being completed.

To avoid not receiving an SMS about a potential fraudulent SIM swap, it may be best to keep your main number on a major mobile network or MVNO that supports roaming in the countries you intend to visit.

It is also essential to always turn on SMS roaming when going abroad.

Fortunately, many smartphones now support dual SIM connectivity, so you could still enjoy lower mobile data prices while in South Africa using an MVNO as a secondary provider.

While abroad, people with dual SIM devices can use a SIM from an operator in the country they are visiting as a secondary option to avoid high data roaming fees.