Icasa has proposed a major change to how South Africans get and keep a mobile number. Under new draft rules, your fingerprint or face would be checked against Home Affairs records when you activate a SIM card, swap one, or keep the number you already have. The goal is to stop SIM swap fraud. The plan also raises questions about privacy, cost and prepaid customers.
What Icasa has proposed
The Independent Communications Authority of South Africa (Icasa) published draft changes to its numbering plan regulations in the Government Gazette this week. The draft asks mobile operators to confirm who you are using biometric verification against Home Affairs records. This would happen whenever a number is activated or reactivated.
The same check would apply to every SIM swap. If the person asking for the swap does not match the subscriber linked to the number, the operator must say no.
Existing customers are not left out. Operators would get two years to verify the people already on their networks. Icasa says South Africa has about 117.3 million mobile subscriptions. That is a huge job for the industry.
Why Icasa is targeting SIM swaps
A SIM swap happens when a criminal moves your number onto a new SIM card. Once they control your number, they can receive the banking codes sent to your phone. That gives them a way into your accounts.
The idea behind the draft is simple. If a fraudster cannot pass a fingerprint or face check, they cannot take over your number. For victims of fraud, that would be a welcome change.
A new cap of five numbers
The draft also puts a limit on how many numbers one operator may assign to a single subscriber. The proposed limit is five.
Icasa explains this using its own figures. It counts about 117.3 million subscriptions against a population of 63 million, of whom it says 21 million are children. That works out to an average of roughly 2.79 subscriptions per person, though the real figure per adult is higher.
The limit applies per operator, so the draft notes that someone could still hold more than 20 numbers across different networks. Companies are exempt from the biometric checks because they work with operators through contracts and cannot give fingerprints or face images. They are not exempt from the five number limit.
Rules for foreign nationals
Visitors and foreign nationals on short or long stays, other than permanent residents, would face tighter limits. Their numbers would stay active only for the length of their visa, or for 90 calendar days, whichever period is shorter under the draft.
Heavy fines for operators
Operators who break the rules would pay for it. The draft sets out the following penalties.
| Type of breach | Proposed fine |
|---|---|
| Breaking core verification rules, such as approving a SIM swap for someone whose identity does not match | R2 million to R4 million per contravention |
| Failing to verify identity before a SIM swap, or going over the five number cap | R1 million per contravention |
The draft does not say what counts as a single contravention. That detail will matter a great deal once the rules are final.
The prepaid problem
The toughest challenge is prepaid. Icasa’s own explanatory notes say most operators told the regulator last year that they had already rolled out biometric verification. But it was only in postpaid products.
Prepaid SIM cards are sold in enormous numbers. MTN South Africa CEO Ferdi Moolman said in August that MTN alone puts about 90 million prepaid SIMs into the market each year. He put the whole industry at between 200 million and 300 million. Checking a fingerprint or face every time one of those SIMs is sold will not be easy.
Mobile operators, working through the Association of Comms and Technology, agreed an interim plan in June to tighten SIM registration under RICA. Icasa says its new verification rule is separate from RICA registration.
This is also not the first attempt. Icasa introduced subscriber identity verification rules in March 2023. It then suspended them until a start date that was never set. The new draft aims to make the rules simpler to put into practice.
What about your privacy?
Many South Africans will ask what happens to their fingerprints and face data. Under the Protection of Personal Information Act (POPIA), biometric data counts as special personal information. The Information Regulator has said such data may only be processed under the exceptions the law allows.
The draft tries to address these worries in two ways:
- Operators may use biometric data only for identity verification.
- Operators must delete subscriber records within 30 days after a number is deactivated. Exceptions apply if the law or a contract requires them to keep the records, or if the subscriber agrees.
Privacy groups and ordinary users will likely want more detail on how this data is stored and protected. You can read more about your rights on the Information Regulator website.
When would this start?
Nothing changes today. These are draft rules. The biometric checks and the five number cap would only take effect 12 months after the final regulations are published.
There is one gap in the draft. It is not clear whether the two year deadline for existing customers starts when the rules are published or when they take effect. The draft only says it runs from the date the regulations come into effect.
The public has 30 working days to comment, which means a deadline of 9 December 2026. Anyone can send written comments to the regulator. The official notices are on the Icasa website.
What you can do now
You do not need to rush to any store. Still, a few simple steps make sense:
- Keep your ID ready. Your smart ID card or ID book may be needed if the rules go ahead.
- Count your numbers. If you hold many SIM cards with one operator, check how that would fit under a limit of five.
- Watch for warning signs. If your phone suddenly loses signal for no reason, call your network provider quickly. It can be an early sign of a SIM swap.
- Have your say. If you care about privacy or access, the comment period is your chance to speak up.
The bottom line
Icasa wants a simple and strong answer to SIM swap fraud, and linking your SIM to your fingerprint or face is a bold way to do it. Supporters will say it protects bank accounts and makes life harder for criminals. Critics will worry about privacy, the cost for operators and the struggle of rolling this out to prepaid users.
For now, the plan is only a proposal. The final rules could still change after the public has its say. It will be easy to follow the story from here, because every step will be published for comment.
About the Author
