Telstra has copped a formal warning after using a privacy-preserving identity checking service to vet prepaid users, before regulations permitted it.
The telco used the identity service – Australian Payments Plus’ ConnectID – for its know your customer (KYC) obligations when activating 18,388 prepaid SIMs in the three months to mid-February 2025.
The identity service, which relies on identity checks undertaken by banks, is accredited under the Digital ID Act, but at the time was not specifically approved for use for prepaid identity checks.
This has now changed, with the Australian Communications and Media Authority (ACMA) formally allowing telcos to make use of it.
The name of the identity service is redacted from the ACMA investigation report [pdf]; however, it is identified as ConnectID in a formal warning [pdf].
Telstra publicly announced at the start of this year that it had been using ConnectID for select identity verification checking since late 2024.
Such trusted identity services are viewed favourably since they prevent organisations from having to collect and retain copies of identity documents themselves.
Many large Australian organisations want to move away from holding copies of identity documents, since it creates data security headaches as the repositories are often targeted by threat actors.
ACMA said in a statement that while Telstra utilised ConnectID before it should have, the usage “did not result in any consumer harm”.
“Telstra has since sought and received the dispensation required which applied until the commencement of these new rules,” the authority said.
“Following the investigation, ACMA proposed a change to the rules and undertook a public consultation. Stakeholders were broadly supportive of the change.”
ACMA said the consultation had led to a broader discussion of the authority’s prepaid determination, which covers rules around identity verification but also other aspects of selling prepaid services.
A “holistic review and update” of the determination will be progressed “as a priority in 2026”, ACMA said.