Phone shop owner fined S$48,000 for registering, selling prepaid SIM cards without customers' consent

SINGAPORE: A mobile phone shop owner was fined S$48,000 (US$35,700) for illicitly registering prepaid SIM cards and selling them to anonymous buyers. 

Koh Wei Ming, also known as Muhammad Amin Koh, used his customers' data without their consent to register the SIM cards. These SIM cards were then sold to unauthorised purchasers. 

"The errant practices took place over a period of four years with more than 1,000 illicit SIM cards sold," the Personal Data Protection Commission (PDPC) said in a media release on Wednesday (Jan 17). 

COMPLAINTS FROM MEMBERS OF THE PUBLIC

According to a judgment dated Oct 17 last year, between February 2020 and September 2021, PDPC received 1,391 complaints from members of the public who received marketing messages despite their numbers being registered with the Do Not Call Registry.

The messages were traced to 95 prepaid SIM cards purchased from Koh, the owner of a shop called Mobile Chat.

Investigations revealed that Koh exploited the SIM card registration process to use his customers' personal data to register for additional prepaid M1 SIM cards that they did not buy. 

One method Koh used to obtain his customers' personal data was duplicate scanning.

After scanning a customer's identity document to register the SIM card they wanted to buy, he would scan the document again to register a second SIM card without them knowing. 

Koh would then hand over only one SIM card to the customer and keep the other to sell it to an unauthorised buyer. 

Another method he employed was keeping the SIM cards his customers did not want to buy. 

Occasionally, a customer who registered a SIM card would not want to continue their purchase after they found out that credit for the SIM card would have to be loaded separately. 

Instead of cancelling or reversing the registration process on such occasions, Koh would keep the SIM cards and activate them without his customers' knowing. He would then offer the SIM cards for sale to unauthorised buyers. 

During investigations, Koh admitted that he wanted to earn extra money from selling the pre-registered SIM cards to unauthorised buyers. 

During the four-year period in which he sold such SIM cards to anonymous buyers, Koh was estimated to have made a profit of about S$35,000, selling about 250 illicit SIM cards per year with a profit of S$35 per card. 

Koh collected and used the personal data of 73 people to register the 95 SIM cards linked with the complaints received by PDPC. However, it was likely that the personal data of many more individuals, about 1,000, was involved in the case, the commission said.

According to the judgment, Koh was notified of the commission's preliminary decision on the case on May 16, 2023, and he appealed the decision a day later, seeking to avoid the imposition of a financial penalty. 

Koh said that he was the sole breadwinner of his family and that he was seeking treatment at the Institute of Mental Health for mental health issues. 

However, his appeal to the commission was rejected. 

"Despite the commission's repeated requests for him to adequately substantiate his assertions of personal and financial hardship, he did not do so," the judgment stated.

PDPC added that the fact Koh was seeking treatment at IMH was not a mitigating factor, especially when he was unable to provide further information on the conditions he was seeking treatment for and how they related to his breaches of the Personal Data Protection Act.

Koh was previously sentenced to 16 months' jail under the Computer Misuse Act last September for the unauthorised modification of the contents of M1's computer system for the registration of prepaid SIM cards, the commission said.

PDPC also said on Wednesday that this is the second case involving the "egregious misuse of individuals' personal data to undertake illicit activities". 

An earlier case involved another mobile retailer, Yoshi Mobile, which sold illicit SIM cards that were used to send unsolicited messages. The retailer was fined S$21,000.

PDPC advised consumers who suspect that their data has been used without their consent to report their concerns to the authorities.