The National Communications Authority (NCA) is blaming the recent breach of the Central SIM Register entirely on two Vodafone agents and has asked Vodafone to ensure that they are arrested, investigated and prosecuted.
The breach of the Central SIM Register happened when a Vodafone agent in Kumasi, using a device with phone number 0205725275, fraudulently used the Ghana Card details and biodata of one Prince Edward Deba to register three phone numbers without the consent of the customer, and all three numbers were then passed by the NCA’s App with a BCAP-Yes status, as though they were genuine.
Unlike in previous cases of fraudulent SIM registration, where the perpetrators were only able to bypass Stage One of the process, this time round the fraudster also bypassed Stage Two and was actually able to get the NCA to approve of the registration of those three numbers as valid.
The facts of the case are that on April 24, 2023, Prince Deba went to the Vodafone Shop at Junction Mall at Nungua in Accra to register his Vodafone SIM. The registration was done by a Vodafone agent.
Then on May 31, 2023, the final deadline for SIM registration, he checked his phone with short code *402*1# only to find three other Vodafone numbers linked to his Ghana card.
Prince made a report to Vodafone, thinking the fraudulent linkage was only done to his Ghana Card. But he was told at Vodafone that the perpetrators actually used his biodata as well, and the numbers have been given BCAP – Yes (bio capture) by the NCA’s registration App.
Prince was then informed that fixing the problem was beyond Vodafone because all the biodata captured for SIM registration were done with the NCA’s App, which then transfers all the data directly to the NCA’s Common Platform managed by KelniGVG. None of the biodata is stored by any telco. So, it is NCA and only the NCA that actually assigns the BCAP-Yes status to SIM cards and not the telcos.
Meanwhile, months earlier, the NCA’s Director-General, Joe Anokye had told journalists at a press conference that the Stage Two of SIM registration (bio capture) is the process by which SIM cards are rolled over into the Central SIM Register. So, in this case, the fraudulent SIM cards have found their way into the Central SIM Register without being flagged.
NCA’s Theory
Per the NCA’s theory of what happened, the Vodafone agent in Accra dubiously took a picture of Prince Deba’s Ghana Card and sent it to an agent in Kumasi, who then used it to register those three numbers in the App to obtain a BCAP – Yes status for them.
The NCA has therefore asked Vodafone to get both the agent in Accra and the one in Kumasi arrested, investigated and prosecuted.
It has also urged all telcos to ensure that their agents use only devices with near field communication (NFC) technology to ensure that only biodata captured live by the App can be used for Stage Two registration.
Even though the NCA has not said so, it is suggesting that in the case in question, the perpetrators were able to beat the system by using registration devices that did not have NFC technology, so they were able to input biodata captured outside of the App into the App to obtain BCAP-Yes status for the numbers.
Techfocus24 is aware that the perpetrators are being interrogated. It is very likely they will have their day in court depending on what the investigations reveal.
Dodgy Tactics
However, what is even more critical is the breach of the Central SIM Register and the NCA’s indecent rush to have the evidence of that cleared ahead of proper investigations.
The victim of the fraud, Prince Deba and Vodafone have officially requested for details of the biodata used on the App to register those three numbers in the name of Prince Deba to aid further investigations. This is important because all the biodata captured at Stage Two goes directly to the NCA’s common platform, and never stored by any telco.
Again, the NCA had earlier assured Ghanaians that only biodata captured directly and live by the App can be used to register SIM cards at Stage Two. But in this case the NCA is admitting that pictures and biodata captured remotely and transferred to another location was entered into the App for the registration in the absence of Prince, and yet the registration was passed as valid.
Strangely, NCA, being the regulator, has refused to produce the information needed for investigations, and is rather pressurizing Vodafone Ghana to delink all the three numbers from Prince’s details ahead of a probe.
But Prince, who works in the data management space himself, insists that the NCA’s demands on Vodafone to delink the numbers at this stage exposes an indecent haste to eliminate any evidence of a breach of the Central SIM Register. He thinks the numbers should remain linked to his details until full investigations are completed.
NCR Advice Ignored
It will be recalled that, following the earlier incidents of fraudulent SIM registration, Network of Communications Reporters (NCR) proposed to NCA to eliminate all telco agents from the exercise to prevent a breach of Stage Two.
NCR, at the time, also proposed a two-step verification system to be included in the SIM registration process to give consumers visibility of what is going on with the Ghana Card details before any SIM cards are even linked to them.
The current incident has vindicated NCR’s position, but NCA is yet to consider those two proposals.
Meanwhile, the NCA is urging Ghanaians to keep using *402*1# to check the number of SIM cards linked to their Ghana Cards and report any suspicious numbers to their respective telcos.
