While typically faced with SIM swap fraud and network infrastructure vandalism, South Africa’s telecoms sector is now grappling with complex, layered threats that include cyber crime targeting mobile and data infrastructure.
These threats were calculated at an estimated cost of R5.3 billion annually in 2024, based on insights from the Communications Risk Information Centre (COMRiC).
COMRiC further notes that SIM swap fraud accounts for 60% of mobile banking breaches. In addition, the telecoms industry must contend with subscription fraud and SIM box fraud, which accounts for 40% of the crimes affecting the sector, it states.
COMRiC is a non-profit organisation (NPO) focused on leading crime and risk intelligence within the telecoms industry. It counts Cell C, Vodacom, MTN SA, Telkom and Liquid Intelligent Technologies as its founding members.
Released yesterday, the latest insights into telecoms fraud provide an overview of emerging threats, systemic vulnerabilities and strategic responses shaping sector-wide resilience.
Unpacking the NPO’s inaugural 2025 Telecommunications Sector Report, Thokozani Mvelase, CEO of COMRiC, said technology evolution, geopolitical tensions and economic issues impact the sector, because sector players operate in SA and also trade internationally.
“The 2025 report shows that while the threat landscape is escalating, so too is the sector’s capacity to respond. South Africa must now move beyond reactive measures and build a resilient, collaborative defence framework that spans the public and private sectors.”
Cyber worries
Cyber security threats have evolved from phishing and malware into more targeted, AI-powered impersonation and manipulation campaigns, says the NPO’s report.
Unlike 2024 where incidents were primarily external, the first quarter of 2025 saw a rise in employees falling for scams, or misusing access that compromises user credentials, it notes.
Furthermore, fraud in South African telecoms-linked transactions rose by 78% from 2022 to 2023, as indicated by COMRiC.
Ranked among the top three global risks, cyber security threats have escalated to the point where one wonders if it shouldn’t be ranked higher, said Mvelase.
“There is a lot that is interconnected in the world of cyber security, cyber threats. The issues of misinformation and AI-based threats also link to cyber security and bring discomfort to the sector.
“Misinformation and disinformation threats have intensified in volume and speed. While 2024 saw isolated incidents, 2025 has introduced automated disinformation campaigns that exploit national narratives and create panic to the society.”
Theft of lithium batteries and copper cables and vandalism of infrastructure, which have historically been major issues, continue to inflict billions in economic damage, destabilising network uptime, emergency services and national connectivity, according to the report.
The CEO added that infrastructure sabotage continues to operate on a “bumpy” road. “It fluctuates – gets stable, goes up and gets stable again. It’s never a consistent reduction and that’s one of the challenges that we have.”
On white-collar crime, he revealed the sector’s infrastructure is sometimes a conduit to the many crimes that take place. “For example, extortion happens over a mobile network, scams are also mostly over the mobile networks and SIM swap fraud as well.
“White-collar crime is made up of a basket of issues. In as much as we do our bit to arrest the situation, we as the industry can’t do it on our own. We need cross-sectional collaboration with sectors like financial services.”
From a business resilience perspective, Mvelase stated that network infrastructure is critical and essential to drive economic growth.
He noted that the digital economy contributes 2% to 19% of SA’s gross domestic product, with the telecoms sector adding 5% to 8% within that ecosystem.
“Without connectivity, a lot will not happen. We believe keeping this sector resilient is imperative and collaboration efforts must not be for the benefit of the individual or a few entities, but about making sure the country thrives in difficult periods.
“The telecommunications industry needs to make sure the economy grows and that we play our role to keep the sector resilient.
“As government looks to grow connectivity, we need to make sure we are there as partners in supporting the state.”
Mvelase said COMRiC members also reveal that over 1 000 incidents impact their base stations on average, monthly. “When you have over 1 000 incidents happening every month, you can’t invest in new infrastructure and need to resuscitate it.
“Most people don’t know when these incidents happen and all they experience is instability with their connection. For us, this is unacceptable and we would like to see these numbers halved or eliminated.”
Emerging tactics
The report highlights subscription fraud and SIM box crimes as further concerns for the telecoms industry.
Subscription fraud is where synthetic identities are used to gain unlawful access to telco customers, acquire devices and exploit gaps in enforcement. It is not just a telecoms issue, but a national economic concern, according to COMRiC.
It notes that Johannesburg, Cape Town and Durban have seen high rates of SIM swap fraud, subscription fraud and digital banking scams.
“The time has come to navigate the constraints of POPIA and competition law to allow targeted fraud data sharing across sectors, including banking and retail,” stated Mvelase.
The report shows SIM box crime remains a major global challenge, costing telecoms providers billions annually and compromising network integrity.
“While regions like Europe and Asia have successfully reduced fraud through AI-driven detection, biometric verification and rapid response systems, South Africa faces enforcement gaps that allow fraudsters to exploit weak regulations.
“Globally, SIM box fraud prevention has seen significant progress, with law enforcement and telecoms providers adopting advanced technologies and stricter regulations.
“South Africa’s response to SIM box fraud has been slower compared to global efforts, but recent crackdowns show progress.”
Mvelase concluded: “We are also urging ICASA to enforce a ban on SIM box modems, many of which are smuggled in without regulatory approval. These devices threaten network security, intercept messages and bypass lawful surveillance systems. Their continued use undermines national efforts to protect digital infrastructure.”
Share