[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fI933SUJpZNWHHaENGlhhfBBZr-XTt-NgZkMQHIGN5b4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"e5d13cad-950e-40c7-ba88-404a8f38c722","sim-swap-fraud-costs-telecom-200k-under-gdpr","a5ea04f4-2132-4b17-b251-cf0039bdaec3","SIM Swap Fraud Costs Telecom €200K Under GDPR","XFERA MÓVILES failed to implement adequate identity verification controls before issuing a duplicate SIM card, allowing a fraudster with a forged document to take over a customer's mobile identity. This SIM-swap attack is a well-known vector for account takeover, enabling downstream fraud such as bypassing SMS-based multi-factor authentication. The AEPD ruled that a contractual basis for data processing cannot be claimed when the request itself is fraudulent, meaning weak verification processes directly invalidate legal justification under GDPR Article 6(1). Telecoms and any organization handling sensitive customer requests must treat identity verification as a critical security control, not a formality. This case underscores that GDPR liability extends beyond data breaches to improper processing triggered by inadequate procedural safeguards.","**Immediate actions:**\n- Implement multi-factor identity verification for all SIM swap and duplicate SIM requests, including cross-referencing government-issued ID against authoritative databases.\n- Require in-store or notarized identity confirmation for high-risk account changes such as SIM replacements, rather than relying solely on presented documents.\n\n**Long-term improvements:**\n- Deploy document authenticity verification technology (e.g., optical and digital forgery detection) at all customer-facing touchpoints.\n- Establish a formal data processing legitimacy review process to ensure the legal basis under GDPR Article 6 is validated before any sensitive account action is completed.\n- Train all customer service and retail staff on SIM swap fraud indicators and mandatory escalation procedures for suspicious requests.\n\n**Detection & monitoring measures:**\n- Send real-time alerts to the registered customer (via email and app notification) whenever a SIM swap or duplicate SIM request is initiated on their account.\n- Log and audit all SIM change requests centrally, with anomaly detection rules to flag unusual patterns such as repeat requests or mismatched customer data.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 6(1) — Lawfulness of processing","GDPR Article 5(1)(f) — Integrity and confidentiality","GDPR Article 24 — Responsibility of the controller","NIST SP 800-63-3 — Digital Identity Guidelines (IAL2\u002FIAL3)","NIST AC-2 — Account Management","NIST AC-17 — Remote Access","CIS Control 6 — Access Control Management","CIS Control 14 — Security Awareness and Skills Training","ENISA Telecom Security Guidelines — Customer Authentication","ISO\u002FIEC 27001:2022 — A.5.17 Authentication information",{},"published","2026-08-13T14:20:40.850503+00:00","2026-08-13T14:20:40.541+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=AEPD_(Spain)_-_ps-00148-2025&diff=52691&oldid=52688","aepd-spain-ps-00148-2025-ba1efb","AEPD (Spain) - ps-00148-2025",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[51,55],{"slug":52,"name":53,"problem":54},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":56,"name":57,"problem":58},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date."]