SIM card provider dodges law

uConnect is a Mobile Virtual Network Operator that issues free SIM cards online. Picture from uConnect’s website (fair use).

• Virtual mobile provider uConnect allows customers to buy SIM cards without verifying their IDs.
• uConnect asks for an ID number and address when one orders a SIM card, but does not ask for proof.
• South African law requires that sellers register the ID and residential address of their customers.
• But the law is badly enforced and thousands of crimes are committed using fraudulently registered or stolen SIM cards every year.

Mobile provider uConnect is selling SIM cards online without properly verifying the identity and residential address of its customers.

This contravenes RICA law and makes it easier for fraudsters to buy SIM cards under false identities and commit crimes.

RICA requires all sellers of SIM cards to register the cards with customers’ identity documents and proof of residence. The law is aimed at reducing fraud and crime and enabling law enforcement to identify and trace SIM card users.

Fraudulent SIM cards are implicated in thousands of extortion and mobile banking fraud crimes every year. For example, fraud in the South African Social Security Agency’s (SASSA) payment system for R350 SRD grants has most probably been enabled by fraudulently registered or stolen SIM cards.

GroundUp previously reported how a mobile virtual network operator (MVNO) called Me&You was issuing electronic SIM cards (eSIMs) without requiring RICA-mandated documents. MVNOs provide access to mobile networks by buying bulk access from operators like Vodacom, MTN or Cell C and selling them to customers under their own brand.

After we published our article, Me&You fixed the RICA issue on their website. Both uConnect and Me&You are owned by the Ignition Group. uConnect is also an MVNO, but unlike Me&You, it issues physical SIM cards that can be ordered online and collected from Clicks stores.

uConnect’s website enables you to order a free SIM card in minutes, but does not verify identity numbers of residential address.

Signing up for a free SIM card from uConnect takes only a few minutes.

First, you fill out a form on the website. The form asks for your name, ID number and address, but does not require supporting documents to be uploaded. ID numbers are not checked against the Home Affairs database. So one could provide a fake or stolen ID number and uConnect would be none the wiser.

Then, upon submitting the form, one receives an SMS with a code to use when collecting the SIM card from a Clicks store. The SMS says that your ID will be checked on collection. GroundUp tested the service five times. On no occasion were we asked for any documents when collecting the card from Clicks.

The SIM card works immediately upon collection.

Responses from the companies involved

We reached out to uConnect for comment regarding their failure to properly implement RICA. We pointed out that failing to verify customers’ IDs is in violation of Section 40 of RICA.

Chief Operating Officer Ivor von Nielen’s response was mostly a marketing pitch, highlighting the benefits of using uConnect. Our questions were addressed vaguely at the end of the response: “The subject of your inquiry is taken seriously. We recognise that their [are] unfavorable elements in our communities and societies, however we see these as exceptions and always give our customers the benefit of the doubt.”

“We don’t always get it right and if you or your colleagues have found something in our RICA processes which we have not catered or is not working as designed, we would love to chat to understand this loophole so we can enhance this,” said von Nielen.

We also contacted Ignition Group, uConnect’s owner. The company asked for more details on the alleged non-compliance. We sent them the exact wording of RICA and explained how we were able to purchase a SIM card without ID verification. They responded that it was “highly irregular” and asked for the ID numbers we used to purchase the SIM cards.

Ignition Group also owns Mobilise Expectations (MVN-X), which supplies the backend infrastructure for various virtual network providers in South Africa, including Me&You and uConnect. Mobile Expectations did not respond to our query.

We also asked Clicks for comment. An employee told us that Clicks does not sell UConnect SIM cards. The company is merely a Pargo collection point. It has no responsibility for verification.

Pargo didn’t respond to our query.

A screenshot from Mobilise Expectations’ website showing their MVNO clients.

Why RICA?

The Regulation of Interception of Communications and Provision of Communication Related Information Act (RICA) was passed in 2002. By July 2009, all cell phone users had to register their personal details with their networks for every SIM card they used.

Theoretically, the details of SIM card users can be used to trace back illegal activity to the owner of the SIM cards. RICA also enables law enforcement to monitor the communications of crime suspects, if they obtain a warrant.

But the law is badly enforced by the Department of Justice. Fraudulent or stolen SIM cards are widely available in the market, increasing the prevalence of cyber crime.

MyBroadband reported in April that even though fraudulent SIM cards are used in thousands of crimes every year, of which 27 have been investigated by police as serious crimes since 2020, only one of those investigations have led to an arrest.

About 62% of extortion cases involve unregistered SIM cards and 58% of mobile banking fraud cases are enabled by SIM swaps.

Reducing SIM card fraud could also help South Africa to escape the Financial Action Task Force’s grey list.

The RICA amendment bill, which was sent back to Parliament in 2024 by President Cyril Ramaphosa, contains additional requirements including the biometric verification of SIM card buyers. Parliament must first address the president’s constitutional concerns about the amendment bill before it can be passed and signed into law.

GroundUp has reached out to the Department of Justice multiple times to ask about its enforcement of RICA requirements in MVNOs such as Me&You. We have not received a response to date.

Gosai and Cedras are second-year computer science students at Stellenbosch University.

Support independent journalism
Donate using Payfast