Explanatory Statement
Telecommunications Act 1997
Telecommunications (Industry Standard for Mobile Number Pre-Porting Additional Identity Verification) Direction 2019
Issued by the Authority of the Minister for Communications, Cyber Safety and the Arts
Purpose
The Telecommunications (Industry Standard for Mobile Number Pre-Porting Additional Identity Verification) Direction 2019 (the Direction) is made by the Minister for Communications, Cyber Safety and the Arts (the Minister) under subsection 125AA(4) of the Telecommunications Act 1997 (the Act).
The instrument directs the Australian Communications and Media Authority (ACMA) to make an industry standard that requires gaining mobile carriage service providers to implement customer identity verification processes before accepting a port of a mobile service number.
Pre-port identity verification can help prevent the harm and loss to customers occasioned by unauthorised porting of mobile service numbers, including from fraud and identity theft.
The new standard may also require mobile carriage service providers to provide information and advice to customers about their pre-port identification verification processes and encourage customers to report any suspected unauthorised ports to enforcement agencies and support services.
This instrument is a legislative instrument for the purposes of the Legislation Act 2003. However, this instrument is not subject to disallowance, as it is a direction by a Minister to a person or body (see item 2 of the table in section 9 of the Legislation (Exemptions and Other Matters) Regulation 2015).
Background
Scams over telecommunications networks are a significant problem, causing financial and emotional harm to victims. There have been cases of scammers using limited personal information to fraudulently port a person’s mobile number from their current service provider to another. Scammers have then used the ported number, and other information, to access the consumer’s bank accounts and authorise transactions by sending bank verification codes to the number. The Government wants all mobile service providers to implement stronger pre-port identify checks, to minimise instances of fraudulent mobile number porting and reduce associated financial loss and hardship to customers.
This Direction requires ACMA to determine an industry standard that is to apply to mobile carriage service providers. The Direction will require ACMA to mandate identity verification measures before mobile service numbers can be transferred from one provider to another. The new industry standard will help prevent criminals from fraudulently porting mobile service numbers from one provider to another to access their victims’ bank accounts and other applications containing sensitive information.
The new industry standard to be made by ACMA will need to include pre-port identity verification processes that are practicable, robust, technically feasible and do not impose undue financial or administrative burdens on customers or carriage service providers. ACMA should have regard to the costs of verification on customers, and it is preferable that those costs be nil if practicable.
The Direction includes options for pre-port identity verification that could be included in the new standard. These include various forms of identity authentication before a number is ported, such as: sending a message to the mobile service number that includes a unique verification code; sending a message to the email address of the customer that includes a unique verification code; calling the relevant mobile service number in-store; calling the relevant mobile service number to be ported from a call centre; or using a form of biometric data.
At the time the Direction was made, some carriage service providers had introduced stronger pre-port verification arrangements, or were in the process of doing so, under guidance material developed by the telecommunications industry. The Direction will help achieve industry-wide coverage so that Australians can safely conduct online banking and on activities on their mobile phone.
Industry standards come with enforcement options under the Telecommunication Act 1997, including formal warnings and civil penalties of up to $250,000. In making the new industry standard, ACMA must consider conferring powers and functions on the Telecommunications Industry Ombudsman in respect of consumer complaints about the unauthorised porting of mobile numbers.
Regulation Impact Statement
OBPR has advised that a regulation impact statement is not required for the Direction, but will be needed to inform development of the new industry standard (OBPR ID: 25714)
Consultation
ACMA, Communications Alliance and members of the telecommunications industry were consulted on the proposed Direction.
Notes on Sections
Part 1—Introduction
Section 1 – Name
This section provides that the name of the instrument is the Telecommunications (Industry Standard for Mobile Number Pre-Porting Additional Identity Verification) Direction 2019.
Section 2 – Commencement
This section provides that the instrument will commence on the day it is registered on the Federal Register of Legislation.
Section 3 – Authority
This section provides that the instrument is made under subsection 125AA(4) of the Telecommunications Act 1997 (the Act).
Section 4 – Definitions
This section sets out a number of definitions for the purposes of the instrument.
The note to this section informs the reader that a number of expressions used in the instrument are defined in the Act.
ACMA means the Australian Communications and Media Authority.
Act means the Telecommunications Act 1997.
customer means a person with a contractual relationship with a carriage service provider and to whom the carriage service provider has issued a mobile service number.
digital mobile number has the same meaning as in section 15 under the Telecommunications Numbering Plan 2015 (Numbering Plan). Under the Numbering Plan, it means a special services number specified in Schedule 5 of the Numbering Plan for use with a digital mobile service. This term is intended to refer to a number allocated to a carriage service provider by ACMA for the provision of a public mobile telecommunications service supplied by a network using digital modulation.
Gaining CSP means a mobile carriage service provider to which a mobile service number has or is to be Ported. The concept of ‘Port’ and its variants ‘Porting’ and ‘Ported’ is central to the Direction – refer below.
mobile carriage service provider means a carriage service provider that supplies or arranges for the supply of a public mobile telecommunications service, and includes their authorised agents. In this context ‘authorised agents’ is intended to have the same industry meaning as applied in the industry code, C570:2009 Mobile Number Portability - Incorporating Amendment No.1/2015.
mobile service number means a digital mobile number issued by a mobile carriage service provider to a customer in connection with the supply of a public mobile telecommunications service but excludes satellite telephone services as those kinds of services are not portable services for purposes of the Numbering Plan and industry code, C570:2009 Mobile Number Portability - Incorporating Amendment No.1/2015.
Port has been defined as the movement of mobile service numbers between mobile carriage service providers, or mobile carriage networks, using mobile number portability processes. The terms, ‘Porting’ and ‘Ported’ have corresponding meaning. This definition is based on the industry code, C570:2009 Mobile Number Portability - Incorporating Amendment No.1/2015, registered under Part 6 of the Act. This term covers the service that allows a customer to change the mobile carriage service provider involved in providing the public mobile telecommunications, the mobile carrier network involved in providing the service, or both, and retain the same mobile service number.
A satellite telephone service is a carriage service with which end-users make and calls via a satellite-based facility and this definition is included as it is excluded from the definition of “mobile service number’.
SMS message means a message or series of messages sent using a short message service.
Part 2—Direction to ACMA
Division 1—Direction
Section 5– Direction on industry standard
Section 125AA of the Act empowers the Minister to direct ACMA to determine an industry standard by legislative instrument that applies to participants in a particular section of the telecommunications industry, and deals with one or more matters relating to the telecommunications activities of those participants (paragraph 125AA(4)(a)). The section empowers ACMA to make such a standard only if directed to do so by the Minister (subsections 125AA(1) and (5)).
Subsection 5(1) of the instrument provides that the Minister directs ACMA to determine an industry standard under subsection 125AA(1) of the Act that complies with Division 2 of Part 2 of the instrument.
Division 2 of the instrument sets out the participants in sections of the telecommunications industry that an industry standard is to apply to, and the matters relating to the telecommunications activities of those participants with which the standard must deal.
The note to subsection 5(1) clarifies that ACMA may comply with the subsection (and the direction) by determining one or more industry standards.
Under paragraph 125AA(4)(b) the Act, if the Minister directs ACMA to make such an industry standard, the Minister may also direct that ACMA is to do so within a specified period (paragraph 125AA(4)(b)). Under paragraph 5(2)(a) of the Direction, an industry standard referred to in subsection 5(1) is to be determined no later than 28 February 2020 to allow sufficient time for ACMA to undertake consultations and drafting. Under paragraph 5(2)(b) of the Direction, the industry standard must commence in whole no later than 30 April 2020 to allow sufficient time for carriage service providers to adjust to the industry standard (including making information technology changes and training staff).
Although the new industry standard will commence on 30 April 2020, ACMA can demonstrate forbearance towards the industry members that are making genuine and reasonable attempts to implement the new arrangements. Under the Regulator Performance Framework 2014’s Key Performance Indicator 1 (Regulators do not unnecessarily impede the efficient operation of regulated entities), ACMA must recognise that industry will need an appropriate amount of time to create the internal capabilities to ensure that pre-port verification processes are in place. This will ensure that the industry has optimal time to prioritise this process alongside regular business without jeopardizing the effectiveness of pre-port verification capabilities.
Subsection 5(3) directs ACMA to consider conferring functions and powers on the Telecommunications Industry Ombudsman (TIO) in respect of customer complaints about the unauthorised porting of mobile service numbers in determining a standard for the purposes of subsection 5(1).
The note to this subsection informs the reader that, if the TIO consents, an industry standard may confer functions and powers on the TIO, in accordance with section 114 of the Act.
Section 130 of the Act empowers the ACMA to vary an industry standard, or standards, as it considers necessary. In the event that the new standard made by ACMA in compliance with the Direction was to be varied, ACMA would have regard to the conditions specified in subsection 5(1) to ensure that the varied standard remained consistent with the direction (in particular, its objects).
Division 2— Industry standard relating to the mobile service number pre-porting additional identity verification and consumer awareness and safeguard information by mobile carriage service providers
Section 6 – Pre-porting identity verification
Paragraph 6(1)(a) provides that the industry standard must apply to mobile carriage service providers who supply public mobile telecommunications services.
Paragraph 6(1)(b) provides that the industry standard must have the following objectives: to prevent the unauthorised porting of mobile service numbers; and to reduce harm to customers arising from the unauthorised porting of mobile service numbers. Those harms could include financial losses, identity theft, inconvenience associated with rectifying an unauthorised port and emotional distress. ACMA’s new industry standard could include additional objectives.
Paragraph 6(1)(c) provides that that the standard must require Gaining CSPs to, prior to accepting the port of a particular mobile service number, use one of the applicable identity verification processes detailed in the new industry standard.
Paragraph 6(1)(d) requires mobile carriage service providers to not proceed with a mobile service number port unless the Gaining CSP has used one of the identity verification processes detailed in the new industry standard.
Subsection 6(2) directs ACMA, in specifying the processes of identity verification to be included in the new industry standard, to ensure the processes meet certain objectives set out in in paragraph 6(1)(b) and in addition, are practicable, robust, technically feasible, and do not result in undue financial and administrative burdens (to either customers or mobile carriage service providers).
ACMA is also required under subsection 6(2) to have regard to the existing processes that mobile carriage service providers may have already implemented or are in the process of implementing. It would be undesirable for mobile carriage service providers to have to invest time and resources in creating and implementing new identity verification processes where they are already suitable solutions. It is intended that ACMA not create prescriptive rules both because of the impact on the industry and because revealing too much procedural detail in the standard could open gaps that scammers could exploit.
Subsection 6(3) provides the following examples of pre-port identity verification processes that ACMA may consider specifying in the new industry standard (although it would be open for the ACMA’s new industry standard to include alternative processes that achieve the objectives):
- sending a unique verification code by SMS message to the mobile service number that is to be ported or sending an email to the customer’s email address
- if the customer is present in a retail store, having the staff member of the Gaining CSP call the mobile service number to be ported and verify the customer receives it in-store
- having call centre staff representing the Gaining CSP call back the mobile service number to be ported to confirm the person initiating the request is the customer or their authorised representative (as the case may be); or
- a verification method that uses one or multiple forms of biometric data.
Subsection 6(3) of the Direction does not prescribe these particular methods be used for pre-port identity verification in the new industry standard, but provides an indication to industry of the types of measures that may be required.
Subsection 6(3) also requires the ACMA to identify clearly which of the specified processes for identity verification it includes in a new standard apply to all customer types and which ones are to apply to specific customer types (e.g. individual/residential customers, small to medium business customers or the enterprise-level corporate customers). Different processes may be more suitable for particular customer categories.
Section 7 – Provision of consumer awareness and safeguard information by mobile carriage service providers
Subsection 7(1) specifies that the industry standard may specify minimum requirements for information and advice that mobile carriage service providers are to provide or make available to customers (or prospective customers) for both of the following purposes:
- help them to comprehend that an identification verification process will apply prior to the carriage service provider accepting ports of mobile service numbers; and
- encourage them to report any suspected fraudulent or unlawful activity or conduct associated with, or otherwise involving, the unauthorised porting of a mobile service number to the Australian Federal Police and applicable State or Territory Police, and a relevant government consumer support services. Currently, these kinds of services include Scamwatch and IDCARE.
The new industry standard may also specify requirements in relation to the manner in which the information or advice is to be provided or made available to customers.