Prepaid SIM card registration process tightened to prevent them falling into the hands of criminals

SINGAPORE: Mr Philip Phee sat on a foldable chair in the busy heartland of Bedok central, staring at a wristwatch he had just picked apart.

The 63-year-old makes a living repairing watches, but his little makeshift booth in between a bubble tea kiosk and a clothes store is an extension of his other business right across the walkway – a handphone shop.

The shop sells used mobile phones, a mix of accessories and prepaid SIM cards. Mr Phee told CNA that he has sometimes received peculiar requests for the SIM cards.

He said some customers have asked if they could get a SIM card without giving any personal details. But he knows better as he has been selling them for 15 years, he said. “Must use IC (identity card) every time you register,” he added.

When asked if he would entertain customers willing to pay more for this illicit service, he said no: “Later get caught.” What does he tell these people then? “Go Geylang find. Geylang sure have,” came his deadpan reply.

The fraudulent registration of prepaid SIM cards – which criminals could use to communicate anonymously for unlicensed moneylending, scams and vice – has made the headlines recently.

On Jan 16, police raided 17 handphone shops in a nine-hour operation at places like Orchard, Woodlands, Pasir Ris and Geylang.

Officers arrested nine men and one woman, suspected of fraudulently registering prepaid SIM cards using the particulars of unsuspecting customers or foreigners who have not entered Singapore or have left the country, police said.

The retailers purportedly preregistered SIM cards using the particulars of others and sold them to customers who wanted to remain anonymous, police added.

Then, on Jan 20, four men and a woman were charged in a case where customers' personal data was illegally used to register more than 460 prepaid SIM cards.

One of them is accused of retaining the passport or work permit numbers of 37 people and using them to register 51 prepaid SIM cards between January 2020 and August 2020. Another allegedly used photocopied passports to register the SIM cards.

CNA sought comments from the Infocomm Media Development Authority (IMDA), telcos and handphone retailers to understand the SIM card registration process, its security measures and how it could be exploited and abused.

An IMDA spokesperson told CNA it takes the integrity of the registration process seriously. “We have put in place rigorous controls, and progressively strengthened these controls to further minimise fraudulent registrations,” the spokesperson said.

REMOVING THE LOOPHOLES

The impetus to regulate the use of prepaid SIM cards in Singapore came after the Sep 11, 2001 attacks in the US, amid global concerns that terrorists were using them to communicate anonymously.

But given that prepaid SIM cards – which IMDA said currently makes up close to a quarter of Singapore’s total mobile subscriptions – are still used for hassle-free and cost-effective communication in legitimate settings, authorities needed to find a way to balance security with flexibility.

In 2005, the Ministry of Home Affairs and the then-named Infocomm Development Authority introduced regulations that limited each user to a maximum of 10 prepaid SIM cards.

“IMDA required all prepaid SIM card registrations to be checked against a central database. This ensures no subscriber can register for more cards than permitted,” the authority said of the new rules that year.

In 2014, IMDA further reduced the maximum number of cards for each user to three.

At this point, retailers used a standalone device to manually key in customers' information, after requesting for their identification document. The same process could also be used to register three SIM cards all at once.

Errant retailers have abused this process, handphone shops and authorities said. For instance, these retailers could make a copy of customers’ ID when they are not looking, or use their details to preregister more than one SIM card without them knowing.

“Once the transaction concludes, they will have an active SIM card which can be sold without requiring any details,” said Mr Winston Foo, 36, at the Mobyshop handphone store in Orchard of the latter method.

“It is also difficult to trace the customer if the customer is a tourist and has already left the country. This is why unscrupulous store owners might be willing to bend the rules.”

Then most recently in November 2021, IMDA further tightened the process by disallowing the manual entry of customer information, and required telcos and their retailers to scan and upload an image of customers’ ID instead. Each registration would only be tied to one SIM card.

“This prevents retailers from using fraudulent subscriber information to register SIM cards,” the IMDA spokesperson said.

CREATING A NEW SYSTEM

Before the latest changes in November, telcos worked to come up with a system that could meet these regulations, knowing the massive effort needed to develop and roll out a new app that could scan IDs, then educate thousands of retailers on how to use it.

“There was a very intense period of developing the system,” Dr Anna Yip, Singtel’s chief executive officer of consumer Singapore, told CNA.

“I think it's fair to say there were some teething problems ... and there are certain things we are still finetuning to continuously make sure that (a good) experience both for the retailers and for the customer is there.”

For instance, some retailers found that the app’s scanner could not detect the personal details under poor lighting or if the ID was worn out. Some customers also refuse to let their IDs be scanned, citing data privacy concerns.

But Dr Yip said Singtel’s retailers have found ways of overcoming them, including installing more lights in their shops. One shop in Little India she visited tested the app on six different phones and knew which phone performed the best.

For customers who do not want their IDs to be scanned, Dr Yip said they could download Singtel's prepaid services app to scan their own ID and face. The extra facial recognition feature, which Dr Yip said is unique to Singtel, adds an extra layer of fraud protection.

“We all have to adapt to the technology, you just have to learn how to optimise not only on the technology front, but also on the human side,” she said. “So, our people will go to the shops regularly to make sure they know how to do it.”

TELCOS MUST INSPECT RETAILERS

On Friday (Feb 11), CNA was given a demonstration of the registration process at the Singtel Comcentre in Somerset.

The sales assistant only accepted an original ID like an IC or passport. The app’s scanner automatically detected the required details on either side of the IC, including name and address, and filled them in. This process took between 20 to 30 seconds.

The app also checks if the customer will exceed the limit of three SIM cards, in which case the customer will be prompted to deregister other SIM cards first.

The sales assistant could choose to manually enter the required details after verifying the ID and matching it to the customer. This helps when the scanner fails to auto detect, sometimes when the ID is worn out or of a foreign origin.

In theory, errant retailers using the different telco registration apps could still upload photocopies of IDs and manually enter their stolen details, but the apps have a backend feature that detects illegitimate uploads of IDs and alerts the telcos.

Telcos are also required to inspect their retailers, know who they are and who they sell to, as well as ensure they keep within the SIM card limit.

Dr Yip said Singtel audits its retailers “very regularly”.

“Every month, we have people doing spot checks, mystery shopping, to make sure that the performance (of the app) is there and also people are not doing funny things,” she said. “And we definitely do not condone anyone who try to do it a different way or use third-person registration.”

A StarHub spokesperson said the number of errant retailers has remained “small”, adding that the telco conducts regular checks on them and will not hesitate to take “punitive action”.

“We take a serious view of this matter (of fraudulent registration) and we are working closely with the authorities to ensure this process is robust,” the spokesperson added.

Despite the controls in in place, a small number of errant resellers continue to try circumventing the registration system to conduct their illegal activities, the IMDA spokesperson said.

“Such errant resellers will be investigated and prosecuted by the police,” the spokesperson said. “We will also continue to work closely with the police and the telcos to terminate these errant resellers’ contracts, and blacklist the individuals involved.”

WHAT’S IN IT FOR ERRANT RETAILERS?

At another handphone shop in Bedok, a sales assistant who only wanted to be known by his surname Mr Fong, 34, said errant retailers might choose to take the risk to earn more money.

While a prepaid SIM card typically costs S$15, an illegally preregistered one could go for S$45, he said. “There is market demand,” he continued, adding that he gets about four to five requests for anonymous SIM cards each day.

Mr Ronald Tay, who was behind the counter at nearby O Mobile, said errant retailers could be working with crime syndicates, although he feels the tightened registration process makes their activities more difficult.

“It’s more complicated now,” the 33-year-old said, adding that the hefty fines for circumventing the rules are a strong deterrent. “So, I don’t think nowadays people do such things.”

IMDA said it will continue to review and improve its controls to ensure they are effective in deterring fraudulent registration. The authority is studying facial recognition as one such measure, something that China implemented in 2019 to tackle the issue.

However, Mobyshop’s Mr Foo believes the current process is “stringent enough”, while Mr Tay said further measures could complicate and lengthen the registration process for a product that he said does not make him much profit.

“It would take a lot of time just to earn S$1,” he said. “It’s not worth it.”