How did StarHub fail in its e-SIM identity verification process?

Question

Accepted Answer

StarHub's e-SIM Identity Verification Lapses Under Investigation

StarHub is currently under investigation by the Infocomm Media Development Authority (IMDA) for failing to implement adequate identity verification measures when re-issuing e-SIMs through its app. This security lapse allowed unauthorized individuals to gain control of a customer's phone line, subsequently accessing sensitive personal data, including banking One-Time Passwords (OTPs). The breach highlights critical vulnerabilities in the digital onboarding process for e-SIM services.
Inadequate Verification for e-SIM Re-issuance

The core of the issue lies in StarHub's Giga sub-brand not fully adhering to identity verification protocols during the e-SIM re-issuance process via its mobile application. This failure meant that the necessary checks, such as verifying user identities through Singpass or official photo identification, were not consistently applied. Such omissions create an opening for malicious actors to exploit the system by posing as legitimate users.
Exploitation Leading to Banking Information Access

Hackers successfully exploited this security gap to take over at least one customer's phone line. By gaining control of the mobile service, they were able to intercept sensitive communications, critically including SMS OTPs sent by banks for transaction authentication. This allowed them to potentially compromise financial accounts and access confidential banking information, underscoring the severity of the security breach.
IMDA's Mandate for Mobile Operators

The IMDA has clarified that mobile operators are required to implement robust identity verification procedures for both SIM and e-SIM services. This includes verifying users through established digital identification methods like Singpass or by examining physical identification documents when new SIMs are issued or when existing numbers are ported. This regulatory stance aims to bolster the security of telecommunication services and protect consumers from fraud.
Expert Warnings and Enhanced Security Measures

Industry experts have cautioned that without stringent identity verification, e-SIMs are susceptible to hijacking if personal details are compromised through phishing attacks or data breaches from other sources. In response to the incident, Giga has stated that customer security and privacy are paramount and is cooperating with IMDA. Furthermore, best practices, such as implementing two-factor authentication for telco applications, have reportedly been applied by Giga, and consumers are advised to adopt strong personal cybersecurity habits.

Reading history

Hide →

This history is cleared when the page is closed.

How did StarHub fail in its e-SIM identity verification process?

Loading

Was this article helpful?

Helpful

Not helpful

Report an issue

1

0

0

Share with friends