The Australian Communications and Media Authority (ACMA) fined Telstra A$277,000 for failing to follow its own identity-authentication processes designed to prevent SIM swapping.

Assessment

This is a regulatory enforcement action rather than a data breach. ACMA found Telstra's lapses in its SIM-swap prevention processes facilitated financial losses to customers, making it a concrete instance of an Australian regulator enforcing operational and process obligations rather than purely technical controls. The penalty reinforces that carriers carrying identity-brokerage and MFA-reliance trust assumptions are being actively supervised for their documented authentication procedures.

Details

• ACMA fined Telstra A$277,000 for repeatedly failing to perform the identity-authentication checks its own SIM-swap prevention process requires.
• The lapses facilitated at least A$39,500 in losses to 15 customers between January and October 2025.
• A further 13 attempts were identified where staff failed to apply additional fraud protections.
• Telstra accepted court-enforceable undertakings to strengthen fraud-prevention processes and improve staff training.
• The fine follows ACMA's larger A$1.551 million penalty against Telstra in July 2024 for the same failure class.
• The regulator's total SIM-swap enforcement against Telstra now exceeds A$5 million.
• This is a confirmed regulatory enforcement matter; no data breach is involved.