JOHAN VAN GRAAN | SIM card registration loophole hinders police investigations into violent crime - TimesLIVE
As a nation, we are grieving the grisly discoveries of 11 women’s bodies in Ekurhuleni over the course of a few weeks. Each was a person with a name, a family and a life that ended violently and anonymously beside a road carrying thousands of cars every day.
In a functional criminal justice system, the South African Police Service (SAPS) would have solid leads to pursue after discoveries of this scale. Instead, diligent investigative work is being undermined, at least in part, by a familiar obstacle: an unknown suspect operating behind unregistered or falsely registered SIM cards.
Without the ability to link cellphones to an actual identity, this kind of investigation can become the equivalent of searching for the proverbial needle in a haystack. However, the technology to narrow that search has existed for years.
Investigators should be able to pull records from the nearest cellphone tower, with every phone that connected during the relevant window leaving a signal. Somewhere in that data may be the killer’s number. In a suspected serial case, repeating the process across many crime scenes should help narrow the field to the small number of devices appearing repeatedly, within the relevant timeframes, near each body.
However, because so many SIM cards are registered against false identities, it is often impossible to tie a number to a real person. Not everyone is Rica-compliant, though the law requires it. This means when police pull 5,000 numbers from a tower dump, they are likely to be left with ghost names, fabricated identity numbers and addresses that turn out to be abandoned shops or vacant lots.
South Africa is not wrestling with a novel problem, and it does not have to invent the solution. India links SIM registration to biometric verification. South Korea requires real-time facial verification for new activations. Nigeria has deactivated more than 70-million non-compliant SIMs, and Kenya suspends service when registration deadlines are missed.
Biometric registration of SIM cards would help stop rampant SIM-swap fraud and protect consumers’ bank accounts from billions in theft in the country.
Parliament could change the Regulation of Interception of Communications and Provision of Communication-Related Information Act (Rica) to enforce biometric SIM card registration.
Telecommunications fraud costs the country more than R5.3bn a year, according to the Communications Risk Information Centre’s 2025 Telecommunications Sector Report, with close to 60% of mobile banking fraud linked to SIM-swap attacks.
South Africa is still debating how to close a loophole that industry participants already acknowledge is being exploited at scale.
That loophole has a name: section 40 of Rica. It was written with the best of intentions, but one person can register many SIM cards in their name and then sell them, providing anonymity to the eventual user. This remains the pre-Rica practice.
Amending section 40 does not require rewriting Rica from scratch. It requires closing the specific provision that allows registration ahead of sale to be exploited at industrial scale, and pairing that closure with tamperproof packaging: sealing a SIM’s unique identifying numbers the way a bank card seals its chip so nobody can pre-register what they cannot yet see. Distributors who profit from bulk fake registration should carry the same liability as the fraudsters who buy from them, not a regulatory pass because the fake registration happened one step removed from the crime scene.
None of this is complicated law. It is one section, one packaging standard, and enforcement against the distributors who have built a business out of the gap between them. Every month it stays open is another month in which police pull thousands of numbers from a tower dump in all manner of investigations and get nothing back but fictitious names.
Making facial recognition possible as part of Rica would be a giant leap forward.
The government recognises what is at stake, with officials having described the state of SIM registration as a national security threat. The minister brought Rica’s existing penalties into force on July 1: fines of up to R5m and prison terms of up to 10 years. A voluntary industry framework has been signed and a draft legislative proposal promised. Neither is law, and neither yet carries a real penalty for the operators and distributors who have often looked the other way.
There is a temptation, after every fresh horror discovery, to speak only in the language of grief. While grief is due, it is not enough on its own. One of the best ways to honour the victims of such violence is to make sure we do not allow the criminals responsible to get away with it — not through sympathy, not through silence, and not through a system too permissive to hold anyone to account.
That means fixing section 40, closing the SIM registration loophole, and giving investigators the tools the law already promises them. Anything less turns 11 names into 11 unsolved files and leaves the next set of families waiting for answers that never come.
