Identity theft is a type of fraud that involves a criminal assuming someone else’s identity to gain a benefit. It includes, but is not limited to, manipulating social media channels, transferring money out of bank or superannuation accounts, and applying for credit cards or loans in the victim’s name.
Phone fight: Mobile number porting scams are the most prevalent form of identity theft, with more than 8000 instances so far this year, researchers say.
The Australian Communications Consumer Action Network says one in five Australians will fall victim to this practice in their lifetimes. A 2016 report from the Attorney-General's department suggested these crimes were costing Australians around $2.2 billion per year.
A common form of identity theft in Australia is unauthorised mobile porting or sim swapping. Porting normally occurs when you transfer your mobile phone number to a new provider. The new telco is required to identify you as the authorised user but a low level of scrutiny has meant this identification check was limited to confirming a customer’s full name, address and date of birth.
Un-authorised porting happens when criminals contact telcos, impersonate actual customers and transfer their victim’s mobile number to a SIM card controlled by the criminal.
Porting scams are still the most prevalent form of identity theft, with more than 8000 instances so far in 2020.
Once the porting request is approved, the criminal has stolen your mobile phone number. Two-factor authentication messages (such as login-confirmation codes sent as SMSs by your bank) will be sent to the criminal instead of the victim.
The Australian Communications and Media Authority reports approximately 2000 mobile phone fraud complaints per year. According to the not-for-profit national identity and cyber support service ID CARE, one in three victims suffers a loss greater than $10,000 and an average of 33 hours of time lost regaining control of their identity.
AntiPort's goal
A multidisciplinary team of researchers at Macquarie Business School’s Centre for Risk Analytics is working on Antiport, which aims to increase awareness of unauthorised mobile number porting and to help consumers protect their identities.
The project is funded by Ecstra, a not-for-profit organisation committed to building the financial capability and wellbeing of all Australians within a fair financial system, in partnership with the Optus Macquarie University Cyber Security Hub.
An interesting fact is that despite criminals typically targeting more affluent individuals such as retirees, students and young adults have also been significantly affected.
Workshops and surveys conducted by the project team revealed that many Australians were vulnerable because they were overconfident and not adequately aware of the risks of mobile number porting.
Even though recent regulatory changes have significantly improved the situation, the problem still exists. Research by the Macquarie team reveals that porting scams are still the most prevalent form of identity theft, with more than 8000 instances so far in 2020.
Mobile-phone-related identity theft has accounted for approximately 30 per cent of identity-theft-related financial losses in 2020.
Psychological stress
Dr Fabiola Barba Ponce, a Research Fellow at the Centre for Risk Analytics who holds a PhD in Psychology, says unauthorised mobile porting can have life-altering consequences.
Risk factors: Dr Fabiola Barba Ponce (pictured) says identity theft can have a range of negative consequences for victims.
“Victims can suffer increased levels of stress and anxiety, sleeping disorders and emotional responses such as anger and paranoia. In extreme cases, there have been signs of post-traumatic stress disorders," she says.
“Those who fall victim to identity theft during the uncertain times we currently live in have the potential to further exacerbate these symptoms and cause even more stress.”
Technology issues
Dr John Selby, an expert on cyber security, says that the two-factor authentication by SMS can be attacked by identity thieves even without porting someone’s number.
Beware: Dr John Selby warns two-factor authentication by SMS can be attacked by identity thieves.
“Sophisticated criminals who gain access to a management layer of a mobile phone network known as Signalling System No.7 can intercept and read SMS two-factor authentication messages sent by businesses or financial service providers without having to do an unauthorised mobile phone port," Selby says.
Recent prevention strategies assisting consumers to avoid poor choices have reduced the rate of these incidents by almost 30 per cent.
"This is due to SMS messages being sent in plain text (without encryption) over the mobile phone network.
“As long as two-factor authentication with the use of mobile phones is the industry standard for resetting passwords for bank and superannuation accounts, email and social media accounts, criminals will still see huge benefits in fraudulent mobile number porting as they can gain quick and direct access to valuable parts of their victims’ digital life for a period of time.”
Education's role
Professor Stefan Trueck, from the Department of Actuarial Studies and Business Analytics, says that while the race between identity thieves and regulators continues, education remains one of the strongest safeguards.
Hope ahead: Professor Stefan Trueck (pictured) says the AntiPort project will help reduce the number of victims of identity theft in the future.
“Recent prevention strategies assisting consumers to avoid poor choices and better protect their personal information have reduced the rate of these incidents by almost 30 per cent,” Trueck says
“Increasing the understanding of risks and awareness of the problem is precisely the aim of the AntiPort project. AntiPort will provide engaging tools such as an informational website, statistics and resources to prevent and respond to various contingencies with an interactive game and video to be launched early next year.
"We believe the AntiPort project will help to reduce the number of Australians who fall victim to identity theft in the future.”
Dr John Selby is a lecturer with the Macquarie Business School and is a member of the Optus-Macquarie Cyber Security Hub.
Stefan Trueck is Professor of Business Analytics at Macquarie Business School and is a Co-Director of the Centre for Risk Analytics.
Dr Fabiola Barba Ponce is a Research Fellow at the Centre for Risk Analytics.
