SIM Swap fraud: Super Agents, Telco staff fingered

Telecom operators in the country have certain categories of agents called SUPER AGENTS, who have been given some level of access to the backends of the telcos to do more than regular agents do – these include SIM swapping and liquidity support for other agents. 

This could be the avenue for an emerging kind of fraud involving SIM swap.

Techfocus24 has been speaking with one of such agents who has been in the business for over 25 years and is now a SUPER AGENT for telcos in Accra.

The interview with the Super Agent was occasioned by a recent story of a gentleman whose SIM card was allegedly swapped on a Sunday and his two Ecobank accounts containing GHS4,000 and US$8,000 were completely emptied by the fraudster(s).

Victim’s Story

Per the victim’s story, he got a call from a fraudster pretending to be calling from MTN. The fraudster asked of his name and he mentioned it. Then according to him, the fraudster dropped the line and from that moment on, he completely lost network service on his phone. He could not make or receive calls and could not have access to the internet as well.

The next morning, Monday, he went to MTN to find out what had happened to his number only to be told that he requested for SIM swap the previous day, which was Sunday, and it was done. So, he got the MTN staff to restore his SIM. He then checked his mobile money wallet and it was intact, but his two Ecobank accounts had been hacked and GHS4,000 and US$8,000 had been stolen.

Customer’s Naivety and Easy PINs 

Cybersecurity experts have said that either the victim gave the fraudster more information than just his name, or the fraudster might have had access to the victim’s Ecobank Account PIN, secret questions, and some other details even before he called the victim.

Indeed, Techfocus24 also gathered from some banks that customers tend to use very simple PINs like 000000, 111111, 123456 and worst of all, the last six digits of the phone numbers, all of which as easy for fraudster to decode. Indeed, some banks and telcos have systems that reject such simplistic PINs.

The SIM Swap

Whereas that is yet to be confirmed, the incident raises a number of questions as to who requested for the SIM swap – which MTN staff approved of it – did the MTN staff who approved of it see an ID (Ghana Card) from the customer – did he/she verify that the person requesting for the SIM swap was the same person whose face was on the Ghana Card?

Techfocus24 has been speaking this experienced SUPER AGENT on the grounds of anonymity and he said “super agents have access to do two main things on behalf of the telcos – credit the wallets of other agents when there are no banks to do so, and also apply for SIM swap on behalf of customers.”

According to him, with the SIM swap, the super agent is required to do the following:

1. Take the customer’s name and phone number
2. Ask the customer a number security questions listed by the telco for the agents – such the last two transactions you did among others. 
3. Take a picture of the customer Ghana Card alone
4. Take another picture of the customer holding the Ghana Card to ensure that the face on the card matches that of the holder  

The Super Agent then submits all that information to the backend of the telco, using their own unique ID code called the AXON Number, so that he the agent who put in the request could easily be identified by the telco in question.

According to him, the information once submitted to the telco, is left for the telco staff on duty at that moment to check whether all the details meet the requirement before approving the SIM swap.

“So even if I the super agent have plans to defraud the system, I cannot do it without the help of the telco insider who approves the request for the SIM to be swapped. The insider has the duty to ensure that the information I sent are all correct. So, if he/she fails to do so, or deliberately overlooks the details, the telcos know which agent sent the request and which worker approved the SIM swap,” he said.

Former Telco Staff

The Super Agent also noted that apart from insiders who are in on this fraud, some former workers of the telcos, particularly the IT staff, who have been laid off, are also very familiar with the way things work and they may either be manipulating the system remotely or are working with insiders to do fraudulent SIM swapping and stealing people’s money.

Fraudulent SIM Registration

He is also particularly worried about the way in which the floodgates have been opened for all kinds of people to register SIM cards for others, saying that lots of those people register SIM cards without seeing actual Ghana Cards. They only use other people’s Ghana Card details to register SIM cards for others and that is fuelling the SIM swap fraud as well.

Indeed, there more than enough evidence to show that several people’s Ghana Cards have been used to register SIM cards for others without the knowledge of the Ghana Card owner.

Telco CS Confirms

Indeed, Techfocus24 also reached out to a customer service staff of MTN who confirmed that indeed, when one requests for a SIM swap directly from the telco, they require the following:

1. The name and phone number of the customer
2. A blank SIM card (GHS10)
3. A portrait of the customer (sometimes even video call)
4. The Ghana Card of the customer 
5. The customer must personally show up and make the request

But if the customer went to a super agent to assist, they will also require the customer to provide an alternative phone number to ensure that they are dealing with the actual customer and not a fraudster.

And in all that, the credentials of the staff who finally actions/approves the SIM swap are attached to the process so the telcos can easily trace the approval to that staff.

So, in the case of the victim, the question still remains as to who showed up at the telco’s office or at the Super Agent’s shop and made the request, and whether that person presented a Ghana Card that had his picture on it?

This story is still unfolding…

Source: techfocus24