NPA urges businesses to verify IDs of SIM card buyers to prevent SMS authentication fraud

The Yomiuri Shimbun

11:17 JST, May 10, 2021

The National Police Agency in January asked the Telecom Services Association, a Tokyo-based industry group of information and communications technology-related businesses, to begin verifying the identities of subscriber identity module (SIM) card buyers at the point of sale, The Yomiuri Shimbun has learned.

The move is aimed at preventing acts of fraud in which agency services that handle authentications using short message services (SMS) via mobile phone SIM cards allow unscrupulous actors to abuse smartphone apps. Verifying the IDs of buyers will make it easier for the NPA to identify and crack down on these shady operators.

Mobile phone carriers and other communications firms have already started confirming the identities of SIM card buyers.

The SMS authentication system works by sending a confirmation code, usually numerical digits, to the telephone number of a smartphone user via SMS. The user is asked to enter the confirmation code for the authentication. As it is seen as a highly secure system, it has been adopted for many smartphone apps, such as electronic payment services.

However, since a few years ago there have been numerous acts of fraud by anonymous operators posing as agency services for SMS authentication. They inform fraud groups of the telephone numbers of the SIM cards they bought from discount communications operators, and then also inform those groups of the confirmation codes sent by app operation firms. This makes it possible for fraudsters to exploit smartphone apps without revealing their identities, and make use of electronic payment services.

Under the current law, businesses selling SIM cards are not required to confirm buyers’ identities. Therefore, the NPA decided to ask them to do so.

The illicit use of apps by agency service operators for SMS authentication constitutes unauthorized creation and use of private electromagnetic records. The Saitama prefectural police and the Metropolitan Police Department have cracked down on these agency service operators for SMS authentication on suspicion of committing that crime since last year.

The NPA has instructed prefectural police headquarters across the nation to strengthen the crackdown on these agency service operators.