Vodacom’s Negligence in Preventing Unauthorized SIM Swaps – Security & Privacy Breach

have been a loyal Vodacom customer for nearly 17 years, yet on 24 February 2024, I was shocked to receive an SMS notification informing me that an unauthorized SIM swap attempt had been made on my number without my consent.

When I immediately tried to contact Vodacom’s customer service (082135) to stop the *****ulent SIM swap, I was unable to reach a human agent as all options routed me to TOBi (Vodacom’s automated bot), which was completely incapable of resolving my urgent issue.

With time running out before my number was permanently compromised, I had no choice but to physically visit the Vodacom store at the V&A Waterfront, where a consultant managed to reverse the unauthorized SIM swap with only 8 minutes left.

I was further shocked to learn from Vodacom’s store consultants that the SIM swap request was processed and approved by TOBi with no human verification. Vodacom failed to implement proper security measures, making customers with prepaid SIMs older than 10 years particularly vulnerable. This issue had been raised internally at Vodacom multiple times, yet no corrective action was taken to prevent ongoing *****.

Since posting about this incident on LinkedIn, I have received numerous messages from other Vodacom customers who have also fallen victim to unauthorized SIM swaps due to Vodacom’s failure to protect customer accounts.

Vodacom has failed to verify customer identity before processing a SIM swap, as required under Section 40 of RICA. There has been a failure to safeguard personal data from unauthorized access, as required under Section 19 of POPIA, and Vodacom has failed to notify me and the Information Regulator of this security breach, as required under Section 22 of POPIA. This is a major security and privacy violation, and Vodacom’s negligence has put me at risk of financial *****, identity theft, and loss of personal data.

I demand a full written explanation from Vodacom detailing how TOBi was able to authorize a SIM swap without human verification, why Vodacom has failed to enforce proper security protocols to prevent unauthorized SIM swaps, and what corrective actions Vodacom is implementing to protect customers moving forward. I require confirmation that Vodacom has placed a "***** Flag" on my account, ensuring that no further SIM swaps can occur unless I personally visit a Vodacom store with my ID.

I request a complete investigation report, including the identity verification details provided by the *****ster and Vodacom’s internal logs showing who processed the request. I also expect an official response from Vodacom’s Data Protection Officer confirming whether this breach has been reported to the Information Regulator as required by law.

If Vodacom fails to provide a response and corrective action, I will be escalating this matter to the Information Regulator, ICASA, and pursuing legal action for Vodacom’s negligence. I expect an urgent response within 5 business days. Failure to respond will only confirm that Vodacom does not take its customers' security seriously. Vodacom, rectify this issue immediately before more customers fall victim to your weak security practices.