The communications regulator Icasa should encourage or prohibit mobile operators and other private companies from storing, exchanging, or matching customer fingerprints, as well as using prints left by fraudsters during failed SIM card change operations as evidence for the police.
Any leak of a private company's fingerprint database can cause irreparable damage that cannot be compensated by a fine or apologies. Unlike a password or bank card, a fingerprint cannot be revoked; once it is accessible, it is compromised forever along with all the banks and phones that trust it. The consequences for consumers and public safety could be catastrophic.
According to the draft regulations published by Icasa in the Government Gazette on October 28, a person's fingerprint or face is checked against internal affairs records when activating or changing a SIM card, and existing subscribers are given two years for verification. Operators who approve a change for the wrong person will face fines ranging from R2 million to R4 million per violation.
In its own memorandum, Icasa indicates that there are 117.3 million mobile subscriptions in South Africa. Data of this scale will become a target as soon as any private company starts storing it, and the prospect of storing fingerprints for such a number of connections, if allowed by final rules, should worry every consumer and bank in the country.
While checking biometrics through internal affairs is the right step, the final rules must clearly state that no private company has the right to store the actual customer fingerprint. The only authority that should store a South African resident's fingerprint should be the internal affairs. No private company should be forced to collect fingerprints, and no one should be allowed to store or exchange them.
Criminals are expected to attack the new system both online and in person. Online, they will target any databases containing fingerprints, inject malware into scanners in stores, intercept scans during transmission, send phishing messages asking to 'verify' their SIM card with a fingerprint or selfie, and use deepfakes to pass remote facial verification.
In the physical world, corrupt employees or agents may copy scans or approve replacements for a fee, and fake verification agents may collect fingerprints during the two-year re-verification period. Prints can be lifted from glasses and phone screens, victims can be coerced into scanning their fingers during robberies, and insiders in government or contracting organizations can alter or sell identification records.
Alternative Solutions
Each of the approaches presented below allows an operator to confirm a customer's identity without storing their fingerprint. None of these methods are experimental, and versions of each are already in use.
One option is revocable fingerprint tokens. A technique called 'fuzzy extractor' converts a fingerprint scan into a stable secret key, even if two scans are never identical. The operator stores only a salted hash of this key, not the fingerprint itself. Each network receives a unique token, so database leaks cannot be linked, and a compromised token can be revoked and reissued, similar to a password.
Another method is storing fingerprints within the SIM card. A protected fingerprint template is kept in the SIM card's secure chip, which is an approach already used in fingerprint-enabled bank cards. Matching occurs directly on the chip, and the network receives only a signed 'yes' or 'no' response. The third option is encrypted matching with internal affairs. The scan is encrypted before leaving the scanner and compared with the internal affairs record in an encrypted form. Only a signed match or no-match result is returned, so neither the operator nor anyone intercepting the traffic sees the fingerprint, and it is never stored.
The fourth approach is keys that never leave the phone. A fingerprint or face scan can simply unlock a cryptographic key stored in the phone's own secure chip, aligning with the principle of access keys already present in Apple and Android devices. The network or bank receives a signed confirmation from this key, not the biometric data. Since the confirmation is tied to the device, not the phone number, fraudulent SIM card changes alone do nothing to the attacker. The US Cybersecurity and Infrastructure Security Agency already recommends phishing-resistant authentication like this instead of SMS codes.
None of these methods are theoretical. After India implemented over a billion people in its Aadhaar identification system, copies of identification data scattered across banks and mobile companies became a weak point. Their solution was tokenization: citizens can present a revocable 16-digit virtual ID, and each company receives a unique token that cannot be linked between databases or traced back to biometrics. India had to adapt this system. South Africa can build it from scratch.
Regardless of the methods chosen by operators, they must be accompanied by an SMS notification to the existing number, an email notification, and a 24-hour suspension of bank one-time PINs after each SIM card change. Banks can do more right now: standardized network interfaces already allow them to check in real time whether an account has recently been changed without collecting any biometric data. A new change should be seen as a reason to freeze high-risk transactions until confirmed by the customer.
The same rules can help the police catch those behind SIM card fraud. A scan that does not match the account owner may come from a fraudster presenting their own fingerprint or face at the supposed crime scene. Or it may come from an honest customer, such as a pensioner or worker whose prints have faded, or from someone using a faulty scanner.
Therefore, our default concept deletes data, rather than punishing. Every failed scan will be encrypted so that no private company can open or delete it, and it will be stored for 14 days by an independent custodian along with the store, employee, device, and time. It will only be transferred to the South African Police Service cybercrime units upon a court order. If the customer, bank, store, or operator does not file a criminal case within this time, the scan will be automatically deleted. For years, criminals hid behind stolen identities. With biometric verification, every change attempt leaves their biometrics at the counter, and this evidence belongs to investigators.
Security is an industry issue, not a customer issue
For too long, the burden of ensuring security has fallen on customers, who are told to protect their PINs, while criminals hack the systems around them. Icasa is right in imposing fines. Operators, banks, retailers, and government agencies must hire 'red teams' and security engineers to attack their own systems before criminals do. Prevention also requires the involvement of the police and specialized cybercrime units to solve these cases and hold perpetrators accountable, as criminals stop when they expect to be caught.
We believe that Icasa should define the expected outcomes, leaving the methods to the discretion of the operators, instead of prescribing specific technical procedures in the law. Fraud methods change faster than regulation, and a technique enshrined in law today will become a public target tomorrow.
There is already an international standard for protecting biometric information—ISO/IEC 24745, which requires that stored biometric data cannot be reversed or linked between databases, and that it can be revoked. Icasa could adopt these tests as a criterion that any proposed method must meet, regardless of the underlying technology.
We propose that Icasa confidentially review anti-fraud methods, considering each case individually, approving or rejecting them without publishing details that criminals could study.
