Spam call loophole in South Africa

A major flaw in the registration process when purchasing a SIM card allows spam callers to evade detection.

This is according to Communications Risk Information Centre CEO Advocate Thokozani Mvelase, who told Cape Talk that there are two ways to obtain a SIM card.

The first is registering one’s personal details with a network provider, as required by the Regulation of Interception of Communications and Provision of Communication-related Information Act (RICA).

This can be done in person or online. He says doing so digitally is more secure as it is linked to Home Affairs to verify the information provided.

The required documents include a valid ID and proof of residence.

The second is to purchase a pre-RICA’d or pre-registered SIM card. This can be done by visiting a store with a verified RICA agent or distributor.

In this case, the distributor or agent has already registered their details to obtain the SIM cards, which is legal.

This means that the owner must require the details to be changed when the SIM is exchanged with another user.

However, while the registration process requires this personal information, Mvelase says the RICA agent is not required to verify the information.

“It does not require verification, and that’s a shortcoming,” he argues.

“You can produce an ID or a copy of one and say this is me, and the RICA agent can capture it because that’s who you purport to be.”

Mvelase says this is why digital applications can enforce a verification step, as they can immediately be run against a database.

While the failure to properly register someone’s identity to a SIM can allow them to use it for nefarious purposes, it also puts those who don’t have these intentions at risk.

When asked about promotions where SIM cards are handed out on the street, Mvelase says those people are responsible for having it RICA’d.

“Once you have that pre-RICA’d SIM card and use it as your number, you end up linking your bank account information to that number,” he says.

“All the OTPs get sent to that number. If you lose that number, you can still have OTPs sent to that, but you can’t go and reclaim that number.”

Ramaphosa not happy with RICA

President Cyril Ramaphosa referred an attempt to amend RICA back to the National Assembly in October last year after finding it unsatisfactory. 

However, the parts of the bill he found concerning were highlighted as points of interest during the initial amendment process.

The areas of concern for the President were section 25A(2)(b), which fails to provide for notifying a subject of surveillance after the fact.

Ramaphosa also said the bill lacks procedures for managing confidential information.

Both of these were highlighted as areas that required change by the Constitutional Court, which struck down parts of the law and instructed Parliament to amend it.

In addition, the President also wanted the bill to provide adequate safeguards to address interception directions and notification suspension applications obtained in the interests of only one side.

The RICA Amendment Bill was first introduced by the Department of Justice in 2023 after the Constitutional Court declared critical parts of the surveillance law to be unconstitutional two years earlier.

This came after investigative journalist Sam Sole and the amaBhungane Centre for Investigative Journalism applied to challenge the Act’s constitutionality.

Government agents had used RICA to secretly spy on Sole’s phone communications while he was reporting on corruption.

Jacob Zuma’s lawyer revealed that Sole had been targeted in evidence provided to fight the Democratic Alliance’s application to reinstate criminal charges against the former President.

The Constitutional Court acknowledged the importance of communication surveillance in preventing crime.

However, it found that the interception of communications allowed under RICA was highly invasive and infringed on an individual’s right to privacy.