# Telstra Pays $277,200 After Mobile-Fraud Protection Failures > The ACMA found Telstra skipped required identity checks in 15 unauthorised SIM swaps and failed to protect 13 at-risk customers. Here is what happened, what the penalty actually is, and where to get help if you suspect fraud. - Canonical URL: https://techxtelco.com/news/telstra-fraud-penalty/ - Published: 2026-09-03 - Updated: 2026-09-10 - Topics: Telco, News - Author: David Everson - Image: https://anrkjmgqmwfosbvyzrzc.supabase.co/storage/v1/object/public/article-images/telstra-fraud-penalty/hero-v2.webp - Publisher: Tech X Telco (https://techxtelco.com) Telstra has paid a $277,200 penalty after failing to protect customers from mobile number fraud, the Australian Communications and Media Authority announced on 3 September 2026. Here is what the regulator found, what the enforcement action actually is, and where to get help if you suspect your own number has been hijacked. **Quick answer** The ACMA found Telstra did not use required identity authentication in 15 unauthorised SIM swaps between January and October 2025, and identified 13 instances where extra protections were not provided to customers at risk of fraud. Customers reported combined losses of at least $39,500. Telstra paid an infringement notice and gave court-enforceable undertakings. If you think your number has been swapped or ported without your consent, contact your telco and your bank immediately, and contact IDCARE if your identity has been compromised. ## The Findings at a Glance The ACMA reported two separate categories of failure. They should not be added together and described as 28 different victims. ### What the ACMA Reported - Unauthorised SIM swaps: 15 cases where required identity authentication processes were not used. January to October 2025 - Missing protections: 13 instances where agents did not provide additional fraud protections to at-risk customers. Identified in the same investigation - Customer losses: at least $39,500 in combined reported financial losses. The regulator’s figure, not a count of every affected person - Penalty and undertakings: $277,200 paid, plus court-enforceable undertakings on fraud prevention and staff training. An infringement notice, not a court judgment Source: [ACMA: Telstra pays $277K after consumer fraud losses](https://www.acma.gov.au/articles/2026-09/telstra-pays-277k-after-consumer-fraud-losses), read 10 September 2026. The regulator’s enforcement record identifies the instrument as an infringement notice alongside an enforceable undertaking. This article concerns that administrative action, not a newly announced court judgment or a criminal conviction. Source: [ACMA: Investigation report, infringement notice and enforceable undertaking, Telstra Limited](https://www.acma.gov.au/publications/2026-09/report/investigation-report-infringement-notice-and-enforceable-undertaking-telstra-limited), read 10 September 2026. ## Why a Mobile Number Matters Telstra’s own fraud-prevention guidance warns that one-time codes sent by SMS do not guarantee security once a fraudulent SIM swap or port-out has happened, because the criminal now receives those codes. That is why a suspected account takeover deserves prompt attention. It is more than an inconvenience with the handset. Source: [Telstra: Fraud prevention](https://www.telstra.com.au/cyber-security-and-safety/scams/fraud-prevention), read 10 September 2026. ## If You Suspect You Have Been Affected The ACMA advises contacting your telco and financial institution immediately if you think you have been the victim of a phone scam, and directs people whose identity has been compromised to IDCARE. For Telstra customers, the provider’s fraud-prevention page describes help with recovering affected accounts and services. ### What to Do First - Contact your telco immediately and ask them to secure the service. Ask for a reference number. - Contact your bank or financial institution and tell them the number may be compromised. - Contact IDCARE if identity documents or personal details may have been used. IDCARE is the national identity and cyber support service. - Keep a short record: when you noticed the problem, which service is affected and every reference number you receive. It helps you tell the same story consistently to each organisation. The record-keeping suggestion is our practical advice, not a regulator requirement. The enforcement announcement is not an individual compensation decision, so keep your own losses and circumstances documented when seeking help. ## Sources and How This Was Checked Figures and findings come from the ACMA’s media release dated 3 September 2026 and its linked enforcement record, and the account-protection warning from Telstra’s fraud-prevention page, all read on 10 September 2026. The enforcement instruments themselves were not separately analysed, and no contact workflow was tested. ### Official Pages Used - [ACMA: Telstra pays $277K after consumer fraud losses](https://www.acma.gov.au/articles/2026-09/telstra-pays-277k-after-consumer-fraud-losses): findings, penalty, losses and consumer advice. - [ACMA: Investigation report, infringement notice and enforceable undertaking, Telstra Limited](https://www.acma.gov.au/publications/2026-09/report/investigation-report-infringement-notice-and-enforceable-undertaking-telstra-limited): the enforcement instruments. - [Telstra: Fraud prevention](https://www.telstra.com.au/cyber-security-and-safety/scams/fraud-prevention): SIM swap and port-out risk, and Telstra’s help. - [IDCARE](https://www.idcare.org/): identity and cyber support service. Related on Tech X Telco: [SIM card replacement](https://techxtelco.com/mobile-plans/mobile-insights/sim-card-replacement/), on how a legitimate SIM swap is meant to work.