A software bug affecting the online portal of Medion Australia allowed customers to replace their SIMs without completing mandatory ID checks, resulting in nine unauthorized SIM swaps. Of those SIM swap frauds, five caused losses to customers worth AUD160,000 (USD105,000) in total. Following an investigation, the Australian Communications and Media Authority (ACMA) has fined Medion Australia AUD259,440 (USD170,400) for failing to comply with the obligation to check customer IDs for ‘high risk’ transactions including SIM replacements.
Medion blamed the bug on a programming error made by their platform provider. They identified the bug on January 10, 2023, and it was fully resolved within two days. However, the bug had been in effect since June 30, 2022, during which time 1,697 SIM replacements were performed without satisfying the requirement for ID checks.
One of Medion’s call center staff lost their job because they reset a customer’s password without authenticating the customer’s identity. The compromised account then executed a SIM swap using the non-compliant route on the web portal. Medion concluded that the call center agent had been deceived but had not acted in a manner consistent with corporate policy or training.
In addition to the fine, the ACMA ordered Medion to appoint an independent consultant who will review how the company complies with the requirement to authenticate customers. The consultant’s report will be circulated to both Medion’s board and to the ACMA. Medion will then be required to implement the consultant’s recommendations.
Medion is a subsidiary of Lenovo, the PC manufacturing giant. The Medion brand is associated with various kinds of electronic gadgets, leading them to supply SIMs and network connectivity as a sideline to the networked devices they produce.
The ACMA keeps demonstrating it is willing to fine any business which fails to comply with their anti-fraud regulations, whether the non-compliant business is a minor provider of comms services or is one of the world’s biggest telcos. Australia’s strict enforcement of its rules stands in contrast to other countries where regulators engage in a lot of posturing but never impose any actual penalties on telcos. There is no reason to believe that telcos in Australia are doing a worse job of tackling fraud than telcos anywhere else, so the number of fines issued by the ACMA is a reflection of regulatory policy. For the sake of protecting customers from crime, far more national regulators should emulate the ACMA’s hard line on enforcing fraud prevention controls.
The ACMA press release about the Medion fine is here.
