The telecommunications regulator has fined Optus for failing to follow anti-scam regulations, leaving some customers thousands of dollars out of pocket.
The troubled telco, still reeling from the fatal triple-zero outage, failed to address a system weakness that allowed criminals to target the phone numbers of 44 Coles Mobile customers, operated by Optus.
Scammers used these numbers to access bank accounts and steal money, according to an investigation by the Australian Communications and Media Authority (ACMA). At least four consumers had their accounts compromised, resulting in a total of $39,000 stolen.
Optus will pay a penalty of $826,320 for the security failures that occurred between September and October of last year. ACMA member Samantha Yorke said the fine represents the maximum allowed and reflects the severity of the breach.
“While this was a one-off issue that was quickly addressed, it is inexcusable for any telco, especially Australia’s second-largest provider, not to have robust customer identity verification systems in place,” she said. “Scammers are always looking for weaknesses, and in this instance, Optus left a vulnerability that directly exposed people to harm.”
Under ACMA rules, telcos must verify the identity of anyone seeking to transfer their phone number to a new provider before completing the transfer. Businesses have collectively paid more than $1.9 million in fines for breaches of this standard in the past 12 months.
