Aadhaar verification is becoming cashless as the Unique Identification Authority of India (UIDAI) has integrated 300 different organizations into its system. Now, identity can be verified without providing photocopies of Aadhaar cards when visiting hotels, going to hospitals, or verifying gig economy workers.
Since January, UIDAI has expanded the use of consent-based digital identity checks in everyday services by connecting 300 organizations to its system.
The communications regulator Icasa should encourage or prohibit mobile operators and other private companies from storing, exchanging, or matching customer fingerprints, as well as using prints left by fraudsters during failed SIM card change operations as evidence for the police.
Any leak of a private company's fingerprint database can cause irreparable damage that cannot be compensated by a fine or apologies. Unlike a password or bank card, a fingerprint cannot be revoked; once it is accessible, it is compromised forever along with all the banks and phones that trust it. The consequences for consumers and public safety could be catastrophic.
According to the draft regulations published by Icasa in the Government Gazette on October 28, a person's fingerprint or face is checked against internal affairs records when activating or changing a SIM card, and existing subscribers are given two years for verification. Operators who approve a change for the wrong person will face fines ranging from R2 million to R4 million per violation.
In its own memorandum, Icasa indicates that there are 117.3 million mobile subscriptions in South Africa. Data of this scale will become a target as soon as any private company starts storing it, and the prospect of storing fingerprints for such a number of connections, if allowed by final rules, should worry every consumer and bank in the country.
While checking biometrics through internal affairs is the right step, the final rules must clearly state that no private company has the right to store the actual customer fingerprint. The only authority that should store a South African resident's fingerprint should be the internal affairs. No private company should be forced to collect fingerprints, and no one should be allowed to store or exchange them.
Criminals are expected to attack the new system both online and in person. Online, they will target any databases containing fingerprints, inject malware into scanners in stores, intercept scans during transmission, send phishing messages asking to 'verify' their SIM card with a fingerprint or selfie, and use deepfakes to pass remote facial verification.
In the physical world, corrupt employees or agents may copy scans or approve replacements for a fee, and fake verification agents may collect fingerprints during the two-year re-verification period. Prints can be lifted from glasses and phone screens, victims can be coerced into scanning their fingers during robberies, and insiders in government or contracting organizations can alter or sell identification records.
Each of the approaches presented below allows an operator to confirm a customer's identity without storing their fingerprint. None of these methods are experimental, and versions of each are already in use.
One option is revocable fingerprint tokens. A technique called 'fuzzy extractor' converts a fingerprint scan into a stable secret key, even if two scans are never identical. The operator stores only a salted hash of this key, not the fingerprint itself. Each network receives a unique token, so database leaks cannot be linked, and a compromised token can be revoked and reissued, similar to a password.
Another method is storing fingerprints within the SIM card. A protected fingerprint template is kept in the SIM card's secure chip, which is an approach already used in fingerprint-enabled bank cards. Matching occurs directly on the chip, and the network receives only a signed 'yes' or 'no' response. The third option is encrypted matching with internal affairs. The scan is encrypted before leaving the scanner and compared with the internal affairs record in an encrypted form. Only a signed match or no-match result is returned, so neither the operator nor anyone intercepting the traffic sees the fingerprint, and it is never stored.
The fourth approach is keys that never leave the phone. A fingerprint or face scan can simply unlock a cryptographic key stored in the phone's own secure chip, aligning with the principle of access keys already present in Apple and Android devices. The network or bank receives a signed confirmation from this key, not the biometric data. Since the confirmation is tied to the device, not the phone number, fraudulent SIM card changes alone do nothing to the attacker. The US Cybersecurity and Infrastructure Security Agency already recommends phishing-resistant authentication like this instead of SMS codes.
None of these methods are theoretical. After India implemented over a billion people in its Aadhaar identification system, copies of identification data scattered across banks and mobile companies became a weak point. Their solution was tokenization: citizens can present a revocable 16-digit virtual ID, and each company receives a unique token that cannot be linked between databases or traced back to biometrics. India had to adapt this system. South Africa can build it from scratch.
Regardless of the methods chosen by operators, they must be accompanied by an SMS notification to the existing number, an email notification, and a 24-hour suspension of bank one-time PINs after each SIM card change. Banks can do more right now: standardized network interfaces already allow them to check in real time whether an account has recently been changed without collecting any biometric data. A new change should be seen as a reason to freeze high-risk transactions until confirmed by the customer.
The same rules can help the police catch those behind SIM card fraud. A scan that does not match the account owner may come from a fraudster presenting their own fingerprint or face at the supposed crime scene. Or it may come from an honest customer, such as a pensioner or worker whose prints have faded, or from someone using a faulty scanner.
Therefore, our default concept deletes data, rather than punishing. Every failed scan will be encrypted so that no private company can open or delete it, and it will be stored for 14 days by an independent custodian along with the store, employee, device, and time. It will only be transferred to the South African Police Service cybercrime units upon a court order. If the customer, bank, store, or operator does not file a criminal case within this time, the scan will be automatically deleted. For years, criminals hid behind stolen identities. With biometric verification, every change attempt leaves their biometrics at the counter, and this evidence belongs to investigators.
For too long, the burden of ensuring security has fallen on customers, who are told to protect their PINs, while criminals hack the systems around them. Icasa is right in imposing fines. Operators, banks, retailers, and government agencies must hire 'red teams' and security engineers to attack their own systems before criminals do. Prevention also requires the involvement of the police and specialized cybercrime units to solve these cases and hold perpetrators accountable, as criminals stop when they expect to be caught.
We believe that Icasa should define the expected outcomes, leaving the methods to the discretion of the operators, instead of prescribing specific technical procedures in the law. Fraud methods change faster than regulation, and a technique enshrined in law today will become a public target tomorrow.
There is already an international standard for protecting biometric information—ISO/IEC 24745, which requires that stored biometric data cannot be reversed or linked between databases, and that it can be revoked. Icasa could adopt these tests as a criterion that any proposed method must meet, regardless of the underlying technology.
We propose that Icasa confidentially review anti-fraud methods, considering each case individually, approving or rejecting them without publishing details that criminals could study.
According to the draft regulations published by the communications regulator Icasa this week, any operation involving a SIM card—activating a new one, replacing an existing one, or porting a number—will require matching fingerprints or facial data with the Department of Internal Affairs records.
The proposed changes to the numbering plan rules, which were submitted for public discussion in the Government Gazette on Wednesday, mandate that operators must 'verify the subscriber's identity through biometric verification against Department of Internal Affairs records' when 'activating or re-activating a mobile number in their network.'
The new requirements also apply to existing customers. Operators will be given two years to conduct a similar identity check for current subscribers. According to the explanatory note to the draft, there are 117.3 million mobile subscriptions in the country.
Similar checks will also be applied in cases of SIM card replacement, which is frequently used by fraudsters to intercept victims' one-time bank passwords. Operators are obliged to refuse replacement if the person requesting it does not match the records of the subscriber assigned the number.
Furthermore, the draft establishes a limit on the number of mobile numbers one subscriber can receive from one operator—five. Companies are exempt from biometric checks because their relationship with operators is governed by contracts, and they cannot provide fingerprints or facial images; however, they are not exempt from this limit.
Icasa justifies this limit partly based on an average of 2.79 subscriptions 'per person.' This figure is derived by dividing 117.3 million subscriptions by the population of 63 million people, of whom, according to the regulator, 21 million are minors, effectively calculating the average for adults. The average household size of 3.2–3.4 people is also taken into account. Since the limit applies to each operator, the memorandum notes that a subscriber 'may practically be assigned more than 20 mobile numbers through different licensees.'
Foreign citizens staying in the country for a short or long period but who are not permanent residents will receive numbers that will remain active no longer than the validity period of their visa or 90 days.
Operators violating the basic verification rules, including approving a SIM card replacement for a person whose identity does not match, will face fines ranging from 2 to 4 million rands 'for each violation.' Failure to verify the subscriber's identity before a SIM card replacement or exceeding the five-number limit will incur a fine of 1 million rands per violation. The draft does not specify what constitutes a single violation.
The prepaid service segment presents the greatest complexity. The Icasa memorandum indicates that most operators informed the regulator last year that they had already implemented biometric verification, 'but this was only implemented in postpaid services.'
Prepaid SIM cards are sold in huge volumes. Ferdi Moolman, CEO of MTN South Africa, reported in August that only MTN issues 90 million prepaid SIM cards annually, while the entire industry produces between 200 and 300 million.
Operators, acting through the Communications and Technology Association, agreed on a temporary framework in June to tighten SIM card registration while simultaneously insisting on government reform of Rica. Icasa emphasizes that its verification requirement differs from SIM card registration under Rica.
The regulator first introduced subscriber identity verification rules in March 2023 but suspended them until a future start date that was never set. The new draft is the result of a 'clarification of provisions for facilitating implementation' process, as stated in the document.
Biometric data is considered special personal information under the Personal Information Protection Act, which, in the opinion of the Information Regulator, can only be processed in accordance with exceptions in this act. The draft limits the use of this data exclusively to identity verification and requires operators to delete subscriber records within 30 days after number deactivation, unless required by law or contract, or if the subscriber consents.
The biometric rules and the five-number limit will come into effect 12 months after the publication of the final rules. It is unclear whether the two-year period for checking existing subscribers is calculated from the date of publication or from this later date; the draft only states that it is calculated 'from the date the rules come into force.'
