I saw this article on stuff which got me thinking - what can we do to prevent number porting fraud? Ultimately my gut feeling is an SMS alone should not be enough to reset a password online, let alone one that gives you full access to a bank account. Unfortunately, ANZ, SBS and Westpac (asks for a security question first) all allow your password to be reset over SMS with fairly minimal checks involved.

So what checks are done before your number is ported out? Only two things are checked before your number is ported. These are:

• Losing carrier, i.e. the old provider
• Phone number;
• Depending on the account type: 

   

  • Prepaid mobiles - SIM number
  • Postpay mobiles - account number

Without physically having the SIM card on-hand, in which case all bets are off anyway, it is relatively difficult to find the SIM number. I'm not aware of any provider that emails it or shows it in their online portal. However, for postpay customers, assuming your email or physical mail is compromised in some way it's quite likely that a hacker could find your bill which likely has your account number on it. Accordingly, if the hacker has access to your bill & you're on postpay - your number can now be ported out.

Some ideas to stop this: (Ordering from (IMO) best to worst)

 

1. Amend the porting process so that once the port is accepted by both carriers a txt message is sent to the number with a unique link to an online portal to confirm the port. Enable does this when you switch UFB providers and it works really because it also lets you specify the date you'd like it to happen
   
   

    

   • Pros: Requires you to have physical access to the number to port it = significantly more secure, wouldn't require any changes on the carriers side, doesn't rely on any one carrier to securely implement it, i.e. no carrier weaknesses.
   • Cons: Slightly delays the porting process
     
     
2. Require a unique security code for porting - similar to UDAI used for .nz domains.
   
   

    

   • Cons: Could be a pain to securely store & transmit the information to the customer, i.e. if their online portal account got compromised
     
     
3. "Porting lock" on your account - similar to that used on .com domains & on credit files where any port would be automatically rejected unless you changed the flag on your account
   
   

    

   • Cons: Could be a pain to securely store & transmit the information to the customer, i.e. if their online portal account got compromised
     
     
4. Require the SIM number for postpay, as it is currently for prepay

What do you think?