SIM recycling puts mobile users’ safety at risk

Highlights 

• Mobile operators resell SIMs not in use for 450 days
• India recycles SIMs inactive for 90 days
• Disclosure of confidential data puts users at risk of financial crimes
• Experts suggest regular verification of contact details to avoid threats
• Recycled mobile SIM cards have become a reason for worry as they bear valuable information, such as bank accounts and insurance details of the previous users

Falling into the wrong hands, that information can be a source of social and financial threats.

To the new user also, a recycled SIM card may become a cause for annoying phone calls and messages from relatives and friends of the previous user.

Masum Billah, a private service holder living in the capital's Kalabagan, received an SMS on his phone on 3 March while working at his office. The message said, "Tk20,000 has been withdrawn from your Dutch Bangla Bank Account."

Taken aback, Masum promptly dialled the hotline number of the bank to be reassured that the money had not been deducted from his account.

Masum then realised that the reason behind him receiving calls from unknown people and the text from the bank was the same – he was being mistaken for the previous user of the SIM card that he had recently bought.

Jahanara Begum, a housewife at Banasree in Dhaka, sprang out of bed in the middle of the night as her phone kept ringing. She was nervous, thinking it might be some bad news from her hometown, but the person on the other end was looking for someone else. The caller insisted that the number belonged to his friend.

Jahanara bought the SIM five months ago and has been getting such calls almost on a regular basis.

Like Masum and Jahanara, many mobile phone users unexpectedly get information about unknown people by subscribing to SIM cards that had been used before.

The number of active SIMs is now 17.33 crore while mobile phone operators combined have sold twice as many SIMs, according to sources at the Bangladesh Telecommunication Regulatory Commission (BTRC).

The number of active SIMs is now 17.33 crore while mobile phone operators combined have sold twice as many SIMs

Instead of issuing new series of numbers, the BTRC allows mobile operators to recycle the numbers that have not been in use for more than 450 days. The deactivation period is only 90 days in India, according to its Telephone Regulatory Authority.

After recycling the numbers, mobile operators resell SIMs to new users across the country.

Grameenphone and Robi last recycled unused numbers in October last year. Before deactivating the numbers, both the operators put up a notice on the numbers on their websites to inform the existing users.

Most of the subscribers, however, are not aware of the matter.

That is why a new user gets an SMS when the previous owner of the number deposits money into or withdraws it from their bank account, which is very confidential.

Bankers and security experts say people may fall victim to financial crimes committed using technology because of such instances.

And the unintended sharing of information continues until the previous user corrects his contact details given to their bank and insurance company, in their passport and other documents.

Talking to The Business Standard, some subscribers said they had been told by the mobile operators, via phone calls, to recharge their numbers to keep the SIMs active, but the matter of recycling of unused numbers had never been communicated.

They said the telecom companies should inform subscribers before deactivating and recycling their SIM cards.

Additional Deputy Inspector General of Police Kamrul Ahsan said unscrupulous people might take out loans using a fake identity. "The sharing of information also constitutes a violation of personal privacy."

By using recycled SIMs, new users come to know of basic information of a bank account, such as the name of the bank, account balance and account number, said Syed Mahbubur Rahman, managing director at Mutual Trust Bank.

The deactivation period is not long enough given that many people use multiple SIM cards, and some even stay outside the country for years

ICT expert Sumon Ahmed Sabir

Account number is a very important piece of information. If someone is provoked, they can make a forged copy of a cheque book to cause a financial dispute. To prevent it from happening, "we do not send all the digits of an account to the mobile number as a precaution," he said.

ICT expert Sumon Ahmed Sabir said the deactivation period is not long enough given that many people use multiple SIM cards, and some even stay outside the country for years.

The mobile operators should wait at least 3-4 years before deactivating an unused SIM. Banks and other organisations should also verify contact details periodically, Sumon said.

In defence of the timeframe given before an unused SIM card is resold, Subrata Roy Maitra, vice-chairman at the BTRC, said, "There has to be a regular transaction against each SIM card. Mobile operators cannot keep a SIM active if it remains unused for an indefinite period."

He did not comment on the users' safety issue.