A New Zealand consumer affairs TV show called Target ran an episode on 19th April 2011 about a young Vodafone customer that appeared to have left a Nokia mobile phone and SIM card unattended for a few moments, only to find that it had disappeared on her return to collect it.

The gist of this particular episode was to publicize the unsatisfactory response from Vodafone once they were contacted by their customer about the lost SIM card and handset.

It appeared from this episode that another party (allegedly a Michael) was in possession of the customers SIM card and was actively using it to make calls and send text messages.  The customer upon realising that the SIM was being used by another party contacted Vodafone for assistance.

It appears that in this instance Vodafone placed a bar on the phone to prevent calls being made from it.  However, it then became apparent that the party in possession of the SIM card was simply able to call up Vodafone and answer a few security questions to have the card unbarred/unblocked.  The third party was easily able to answer the security identification questions posed by Vodafone as they all related to recent call history such as calls made and texts sent.

In my opinion, I feel that a customer should be able to completely cancel a SIM card if it becomes lost or stolen (regardless of whether it is a Pre-Pay or contract account).  If I compare this to the banking industry, when a credit card or EFTPOS card is cancelled due to misplacement or theft it can not be reactivated and a replacement must be re-issued.  Vodafone should operate in a better manner for the safety of its customers.

I believe that the SIM card concerned in this particular incident was a pre-pay SIM, of which you don’t have to register your personal information with Vodafone when you purchase one.  I can see how without any sort of registration Vodafone is limited in it’s ability to accurately identify that a person on the end of the phone is the legitimate subscriber of the mobile account.  If you don’t have a method of identifying users who have not registered then you would take a big risk in blocking accounts.  Anyone could call up and have any unregistered pre-pay accounts cancelled.

The overall security of ones handset and SIM card should be a shared responsibility between the customer and the mobile network provider.  When the provider is informed of a loss or theft they should take immediate actions to cancel the SIM card completely assuming they can verify that the caller is the owner with certainty.  If a customer subsequently locates his or her SIM card they should still be required to get a replacement.  Who pays? that’s another story.

Mobile network providers are able to block lost or stolen handsets (by IMEI)  from being used on their networks.  They can also block them from being used on any network worldwide if they are members of the appropriate international GSM group.  I believe Vodafone is member of such a group.

The last time I inspected the requirements for having a handset blocked through Vodafone they were quite stiff.  You have to prove that you owned the handset with documentation showing the IMEI on it as well as providing a copy of the police report reference number before they will action it.

So what can an end user do to protect their phone?  We see a lot of fancy tracking systems out there to find your lost or stolen phone, but even the most basic phones and SIMs have one key security feature, a PIN code.

You can prevent unauthorised use of your handset by placing a PIN code on it.  Whenever the phone is turned on, the PIN is required to proceed.  If you lock your phone correctly before placing it somewhere then it can’t be used without the correct PIN code.

There are some limitations with PIN locking a handset.  An unauthorised user may be able to wipe, or ‘factory reset’ the phone depending on its model.  If this is done, at least your information has been protected.  If it has been successfully barred on all available mobile networks, it will still remain useless to the thief for use as a phone.

This does not prevent someone from removing the SIM card and inserting it for use in another phone.  To protect your SIM card you need to place a PIN number on this as well.  Any time a phone is turned on (or transferred to another phone) with a protected SIM card inside it will require the PIN.  If an adversary tries to enter the PIN and does so incorrectly a number of times it will BLOCK the SIM card.  There are two levels of blocking for SIM cards and with enough false PIN entries the end result is that the SIM becomes permanently blocked.  Not even Vodafone can reactivate it after this has occurred.

We can only achieve solid phone security when we combine educated end users with mobile network providers that are willing to act on these incidents.  Also, if you are currently using a pre-pay account it would pay to ensure your details are registered with the mobile provider concerned.

You may also be interested in:

1. Consumer Magazine Internet Providers Report December 2010 Consumer Magazine is published both in electronic and magazine form...
2. Switching from Vodafone to ZC Mobile Ever since owning my first mobile phone i’ve been a...
3. Switching Off Sim Lock on the Samsung W531 Cell Phone The Samsung W531 Cellphone is currently being marketed and sold...

Tags: Vodafone

This entry was posted on Wednesday, April 20th, 2011 at 6:09 pm and is filed under Discussion, Observations. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.