Shaw, Videotron say up to half of legit porting requests were denied
By Greg O’Brien
GATINEAU – Last month, the wireless industry launched new measures to try to stem the rising tide of wireless number porting fraud. It lasted only a week.
Complaints from Videotron and Shaw Communications filed with the CRTC on August 20th said the Canadian wireless industry’s new enhanced process to identify phone numbers which criminals were attempting to steal were far too often rejecting legitimate number porting when customers were attempting to switch from Rogers to Freedom, for example.
Wireless number porting fraud, or SIM-swapping fraud, or port-out scams, is a global problem and happens when a criminal attempts to steal a phone number by contacting a customer’s wireless carrier and lies to them to try to convince the carrier employee that they are, in fact, that user, and port the number over to a new SIM card. If it works, that can give the crook, which already has and uses personal data to lie to the employee to make them think they are someone they are not, access to personal apps such as banking, contacts, social media – literally anything on the victim’s phone.
Even when a user recognizes the theft and has two-factor authentication installed on certain apps, new codes for those apps would now be sent to the new SIM. The most direct remedy to the situation, when it happens, is for the user to contact the carrier immediately, along with their bank and any other app containing personal data on their phone.
In the interests of competition, porting numbers is supposed to be seamless and easy, so Canadians can switch carriers when they want and keep their phone numbers. Increasingly, however, criminals are finding ways around the carriers’ protections, which now include required account PIN codes and SMS messages sent to subscribers when a phone number port is requested.
In January, the CRTC asked the Canadian Wireless Telecommunications Association to tell it what members are doing about it and there has been much back-and-forth between the industry and the Commission on this all year.
Through the CWTA’s wireless number portability council the industry agreed in early 2020 to an enhanced wireless number portability process, which it informed the CRTC about on February 14, and it was collectively set it in motion on August 5th (while letters and requests for more information continued to move back and forth over the months). What these enhanced processes actually are, have remained confidential. Only the companies and the CRTC know what they are, for obvious reasons.
By August 12th, however, the new processes were suspended by the carriers and it remains that way. Both Shaw and Videotron complained to the Big Three carriers, who stopped the new practices on the 12th, and then to the Commission, saying the new procedures were preventing customers from being able to switch their wireless business to their brands.
In response, a letter was sent on August 24 from the CRTC to list of participants in the proceeding. The Regulator said both companies “requested that the Commission take immediate action directing the members of the CWTA Wireless Number Portability (WNP) Council to refrain from introducing or reintroducing any measures to block fraudulent mobile number porting until the Commission has had the opportunity to review the efficacy of such measures.”
“They noted that data collected during the week in which the Enhanced Process was in effect reveal that, for certain carriers, 40-50% of attempted mobile number ports resulted in failure. Videotron and Shaw argued that this rate of failure for legitimate number ports is unacceptable.” – CRTC
“Videotron and Shaw submitted that if any member of the WNP Council is permitted to proceed with the relaunch of the Enhanced Process on 26 August 2020, the harm to Canadian consumers will be substantial. They noted that data collected during the week in which the Enhanced Process was in effect reveal that, for certain carriers, 40-50% of attempted mobile number ports resulted in failure. Videotron and Shaw argued that this rate of failure for legitimate number ports is unacceptable.”
While Bell and Telus, says the CRTC letter, have indicated the new process simply requires more time “and the co-operation of all WNP Council members,” Rogers told the CRTC the council remains at an impasse and it believes the enhanced protections are a solution that works and need to be restarted as soon as possible.
According to Rogers the issues which remain unresolved, says the CRTC’s August 24 letter, are:
- appropriate training and awareness of frontline teams to make porting customers aware of what is required of them to authorize the port as legitimate is required (Ed note: It is up to the new service provider to verify everything is on the level when porting over a new customer.)
- consensus must be reached about who is authorized to confirm a port i.e., the Account Holder who is responsible for the Account or the Device Holder who is NOT responsible for the Account; and
- the best way of ensuring that the method by which the confirmation activity is addressed to the customer also acts to minimize or eliminate the ability of a fraudster to spoof the authorization is minimized or eliminated.
Rogers wanted to relaunch the enhanced protection process on August 26th, however Shaw claimed in an August 25 response that technical difficulties on the part of Rogers are part of the ongoing snafus, but redacted from the public filing most of the explanation of what those issues were.
Shaw’s letter did say “The category ‘customer did not respond’ captures most of the problems associated with the new porting process,” meaning when the porting request from a legitimate customer was made from Freedom/Shaw, the system was told the new customer did not respond, so the port request was denied.
“Shaw experienced a substantial increase in the number of failed port-ins from Bell, Rogers, and Telus starting on August 5, when they deployed the enhanced porting process,” reads the company’s August 25 letter.
The CWTA also provided the Commission with a list of the problems encountered, but that, too, was redacted.
The most recent response on this file, posted September 2nd, comes from Rogers, which reports to the Commission it experienced no technical malfunctions.
“Shaw’s response stated that customers porting-out from Rogers encountered several issues during the process of logging into Rogers’ web portals, and that their prospective customers had difficulty calling Rogers to manually process their port-out requests,” explains the Rogers letter.
“During the period when the Enhanced Porting Process was in operation, between August 5-12, there were no escalations via email or telephone between Shaw and Rogers indicating that there was a technical issue that caused ports-outs from Rogers to Shaw to fail.
“Despite the claims by Shaw that Rogers’ customers had difficulty logging into Rogers’ web portal in order to authorize the port request, the solution implemented by Rogers does not require a customer to log into any portal. Rogers’ customers porting to another carrier were simply sent a secure URL via SMS, which connected to an internet page requiring the customer to confirm or cancel the port request. No credentials or log-in were required to complete this task,” continues the Rogers response.
“Shaw has failed to provide any evidence of a technical problem with Rogers solution that can be substantiated, despite requests from Rogers to do so.”
The ball is now in the Commission’s court to decide next steps.
UPDATE: After reading this piece, Telus had this to say, through a spokesperson: “Like many of our peers, we asked the Wireless Number Portability Council (WNP) members to refrain from prematurely reintroducing the enhanced mobile number porting process that requires customers to send an SMS confirmation before porting occurs (2-way validation). Protecting our customers against fraudulent activities is a vital part of our privacy commitment. Our enhanced process has successfully reduced fraud by 99 percent during the period it was in place and has also received support from the majority of the other carriers. However, we firmly believe that the new porting process should not be reintroduced before the industry resolves the associated issues, including an excessive failure rate which prevents customers from changing service providers. We have therefore also asked the CRTC to prevent any wireless carriers from implementing 2-way validation and we are actively working to find a solution that is in the best interests of our customers and to agree on a new implementation date.
“In the interim, and in keeping with our ongoing efforts to put customers first, we have recently introduced port protection upon request, which is a free feature that prevents a customer’s number from being ported until the customer decides to cancel it. We are continuing to offer the 1-way SMS notification which advises our customer if someone is trying to port their number away. We continue to actively participate in the CWTA’s (Canadian Wireless and Telecommunications Association) review of the industry-wide wireless number portability guidelines to increase customer protections. “
