This mobile provider is failing to implement Rica law

When we uncovered fraudulent applications for the Sassa Social Relief of Distress (SRD) grant, we realised that creating an application was only one piece of the puzzle. The fraudsters needed phone numbers to apply and to receive a One-Time Password (OTP), but how were they getting these phone numbers?

We started asking questions.

We then found a relatively new network carrier – me&you mobile – whose processes can be abused in order to obtain a phone number in two minutes without being properly Rica’d. (Note that GroundUp did not establish any connection between this network carrier and the SASSA fraud)

Me&you mobile launched in South Africa as a mobile virtual network operator (MVNO) in May 2015. Its eSIM offering launched in late 2023.

Most cellphones still use a SIM card, but increasingly, phones are offering an electronic SIM or eSIM, which is much more convenient. In theory one can have an almost unlimited number of eSIMs on a single phone while there are usually only slots for one or two physical sim cards.

Why Rica?

The Regulation of Interception of Communications and Provision of Communication Related Information Act 70 of 2002, better known as Rica, started coming into effect in 2005. By July 2009 all cellphone users had to register personal details with their networks for every SIM card they used.

The Act states that any customer who receives a SIM card must provide the relevant electronic communication service provider with their full name, identity number and proof of address.

The purpose of this part of Rica is to prevent illegal activity with mobilephones, such as making a fraudulent application for a social grant. By having the details on record of all SIM card users, illegal activity using a cellphone can be traced back to a particular person. Law enforcement can also obtain a warrant to monitor communications from a particular mobilephone.

There is international pressure for countries to implement laws like Rica to meet anti-money laundering requirements (see here and here). There are also important criticisms of Rica. Intelwatch argues that in its current form the law’s “lack of safeguards and outdated approach have enabled surveillance abuses, undermined public oversight and failed to protect constitutional rights”. But Intelwatch calls for more safeguards, not for the law to be thrown out.

How me&you mobile allows RICA to be ignored

Traditionally, getting a phone number without going through Rica means going to a dodgy cell phone store and purchasing a fake-Rica’d physical SIM card. Alternatively, you would have to know an insider at a network carrier who would be able to get you a SIM card registered to someone else. But thanks to me&you mobile, you can get a free fake-Rica’d eSIM from the comfort of your home.

The company’s website fails to verify your first name, last name, address or ID number. You can upload irrelevant documents as your proof of address and ID; we uploaded a mathematics assignment for the address, and a picture of the company’s logo for the ID. No problem; we activated a free eSIM immediately.

The entire process is astonishingly easy, and you are able to generate as many phone numbers as you want using any ID number, with any name, surname, address and documentation, all for free. We recorded the entire process. 

The following video shows how we activated an eSIM using nonsense information in two minutes. We’ve blurred some of the fields.

https://www.youtube.com/watch?v=vKNJmQ4B5e0&t=9s

We reported this issue to me&you mobile via their website contact form, which is the only contact mechanism the company offers. We received no reply. We subsequently sent them questions for this article but received no response. We emphasise that we have used these eSIMs solely for the purpose of exposing the problem described in this article.

We also notified the Department of Communications and Digital Technologies (DCDT) in mid-October. Many of the phone numbers on its website went unanswered but eventually we got through to the Minister’s Office and were given an email address to report the problem. We did this, but other than confirmation of receipt there has been no response. Questions sent for this article also went unanswered.

Gumtree connection

A company search shows that the directors of me&you mobile are Sean and Donovan Bergsma, two brothers who between them are the directors of several dozen companies, including the online classified ads platform Gumtree.

A GroundUp journalist contacted Donovan by phone. He was evasive when we asked him to explain the Rica verification process for me&you mobile, but he did get an official to call the journalist back. The journalist explained that we obtained an eSIM by typing nonsense in the application fields and uploading irrelevant documents. The official told the journalist that applications are manually checked within 24 hours and if the information doesn’t stand up to scrutiny, the number is deactivated.

There are three problems with this. First, this is not what the law demands; Rica has to be properly carried out in order to get a SIM card.

Second, 24 hours is more than enough time to carry out fraud with a cell number. For example, someone wishing to make multiple fraudulent SRD grant applications could obtain a number of eSIMs from me&you mobile within a short period of time and use these to make fraudulent applications.

Third, in our experience, it’s simply not true that the numbers are being deactivated within 24 hours. On 8 November we checked two eSIMs that had been activated using nonsense Rica information on 15 and 28 October. Both were still active. DM

Cedras and Gosai are first-year computer science students at Stellenbosch University.

Calls to me&you mobile were made by GroundUp journalist Steve Kretzmann. 

First published by GroundUp.