Once we uncovered fraudulent purposes for the Sassa SRD grant, we realised that creating an utility was just one piece of the puzzle. The fraudsters wanted cellphone numbers to use and to obtain a one-time Pin, however how have been they getting these cellphone numbers?
We began asking questions, and we then discovered a comparatively new community service – Me&You Cellular – whose processes may be abused with a view to get hold of a cellphone quantity in two minutes with out being correctly registered below South Africa’s Sim card registration legislation, generally referred to as Rica.
Me&You Cellular launched in South Africa as a cellular digital community operator (MVNO) in Might 2015. Its eSim providing launched in late 2023.
Most cellphones nonetheless use a Sim card, however more and more telephones are providing an embedded Sim or eSim, which is way more handy. In principle, one can have an nearly limitless variety of eSims on a single cellphone, whereas there are normally solely slots for one or two bodily Sim playing cards.
The Regulation of Interception of Communications and Provision of Communication Associated Data Act, higher referred to as Rica, began coming into impact in 2005. By July 2009, all cellphone customers needed to register private particulars with their networks for each Sim card they used.
The act states that any buyer who receives a Sim card should present the related digital communication service supplier with their full title, ID quantity and proof of tackle.
The aim of this a part of Rica is to forestall criminality with cell phones, corresponding to making a fraudulent utility for a social grant. By having the small print on report of all Sim card customers, criminality utilizing a cellphone may be traced again to a specific individual. Legislation enforcement may get hold of a warrant to observe communications from a specific cell phone.
Strain
There may be worldwide strain for nations to implement legal guidelines like Rica to satisfy anti-money laundering necessities (see right here and right here). There are additionally necessary criticisms of Rica. Intel Watch argues that in its present type the legislation’s “lack of safeguards and outdated strategy have enabled surveillance abuses, undermined public oversight and failed to guard constitutional rights”. However Intel Watch requires extra safeguards, not for the legislation to be thrown out.
Historically, getting a cellphone quantity with out going by way of Rica means going to a dodgy cellphone retailer and buying a fake-Rica’d bodily Sim card. Alternatively, you would need to know an insider at a community service who would be capable to get you a Sim card registered to another person. However because of Me&You Cellular, you may get a free fake-Rica’d eSim from the consolation of your private home.
The corporate’s web site fails to confirm your first title, final title, tackle or ID quantity. You’ll be able to add irrelevant paperwork as your proof of tackle and ID; we uploaded a arithmetic task for the tackle, and an image of the corporate’s brand for the ID. No downside; we activated a free eSim instantly.
Your entire course of is astonishingly simple, and you’ll be able to generate as many cellphone numbers as you need utilizing any ID quantity, with any title, surname, tackle and documentation, all without cost.
We reported this concern to Me&You Cellular by way of its web site contact type, which is the one contact mechanism the corporate provides. We acquired no reply. We subsequently despatched questions for this text however acquired no response. We emphasise that we now have used these eSims solely for the aim of exposing the issue described on this article.
We additionally notified the division of communications & digital applied sciences in mid-October. Most of the cellphone numbers on the division’s web site went unanswered however ultimately we received by way of to the minister’s workplace and got an e-mail tackle to report the issue. We did this, however aside from affirmation of receipt, there was no response. Questions despatched for this text additionally went unanswered.
Issues
An organization search reveals that the administrators of Me&You Cellular are Sean and Donovan Bergsma, two brothers who between them are the administrators of a number of dozen corporations, together with the web categorized adverts platform Gumtree.
A GroundUp journalist contacted Donovan Bergsma by cellphone. He was evasive once we requested him to elucidate the Rica verification course of for Me&You Cellular, however he did get an official to name the journalist again. The journalist defined that we obtained an eSim by typing nonsense within the utility fields and importing irrelevant paperwork. The official instructed the journalist that purposes are manually checked inside 24 hours and if the knowledge doesn’t stand as much as scrutiny, the quantity is deactivated.
There are three issues with this. First, this isn’t what the legislation calls for; Rica needs to be correctly carried out with a view to get a Sim card.
Second, 24 hours is greater than sufficient time to hold out fraud with a cell quantity. For instance, somebody wishing to make a number of fraudulent SRD grant purposes might get hold of a variety of eSims from Me&You Cellular inside a brief time period and use these to make fraudulent purposes.
Third, in our expertise it’s merely not true that the numbers are being deactivated inside 24 hours. On 8 November we checked two eSims that had been activated utilizing nonsense Rica data on 15 and 28 October. Each have been nonetheless energetic. — Joel Cedras and Veer Gosai, (c) 2024 GroundUp 2024
Get breaking information from TechCentral on WhatsApp. Enroll right here
