top of page

The Accidental Passport 

Kaisen Yang
Aug 26
8 min read

 


In today's digital societies, a nine-digit string of numbers has evolved past a luxury into a national identity system. Since the mid-2000s, mobile phone numbers, verified once at the point of Subscriber Identity Module (SIM) registration, have served as the de facto authentication layer for services that formal identity infrastructure across much of the Global South could not yet support, including banking, election voting, and basic participation in the digital economy. 


This arrangement was never advertised as an identity system. It emerged as a byproduct of convenience, then was rebranded for a different purpose. Today more than 135 countries mandate SIM registration to anchor both anti-fraud enforcement and financial inclusion, asking a single, surface-verified credential to perform two structurally opposed functions at once: first, to be permissive enough to onboard hundreds of millions of previously unbanked users, and second, restrictive enough to keep fraud out. The result, playing out simultaneously in Nairobi, Manila, and dozens of other regions, is not a story of policy success or failure, but of an accidental identity mechanism reaching the limits of what it was ever built to do. 


The Convenience That Evolved 


The logic of phone-based identity took root in East Africa, where the absence of a stable banking sector made mobile networks the fastest available substitute for financial infrastructure. When Safaricom launched M-Pesa in Kenya in 2007, the service was conceived narrowly, as a way to move money between phones. Because a SIM card was already tied to a registered phone number, and creating an M-Pesa account required almost nothing beyond that same registration, the SIM became the identity document underpinning a person's access to legal finance. Within a decade, M-Pesa and comparable services had extended banking-like functionality to hundreds of millions of previously unbanked people across Sub-Saharan Africa. Regulators, watching a private telecom succeed where formal banking had not, largely deferred to this arrangement rather than reengineer it: the Central Bank of Kenya took a cautious approach toward M-Pesa in its early years, effectively treating SIM-linked identity as adequate proof of a customer's identity. The deference was reasonable at the time, since the only alternative was continued exclusion for 

a population no bank was equipped to serve. It also meant, however, that the verification standard for an entire national financial system was set by convenience, not design. 


A Broader Perspective 


That accidental verification standard has since become the primary attack surface for a form of fraud that has progressed far faster than the response to it. The mechanics are simple: SIM cards are registered in bulk, often using fraudulent identity documents, and loaded into rack-mounted devices known as SIM boxes or SIM farms, which allow a single operator to control thousands of numbers at once. Where earlier fraud required stealing a specific person's identity, the SIM farm model does not need to impersonate anyone in particular; it only needs enough loosely verified numbers to pass a verification test. The fraud, in other words, is not exploiting a flaw in identity verification—it is exploiting the absence of any credential test at all. 

What began as a simple exploit has since become a commercial service industry, with platforms renting SIM-box access and phone numbers to anyone willing to pay. Law enforcement's response has been substantial but reactive. In October 2025, a single Europol-coordinated operation code-named SIMCARTEL dismantled a SIM-farm-for-hire network that had rented phone numbers registered in more than 80 countries and that investigators linked to over 1,700 fraud cases in Austria alone. The scale of the seizure is itself instructive: this is not a marginal criminal niche but global infrastructure for fraud. 


The Real Weakness 


If bulk SIM registration exploits the absence of identity verification, SIM-swap fraud exploits its presence, turning the credential's own strength against it. A fraudster, armed with enough personal information to convince a telecom agent or automated system, requests that a victim's phone number be transferred to a new SIM under the scammer's control. Because that phone number is simultaneously the login credential for a mobile money account, the fraudster inherits not just a number but the victim's entire financial identity, including their balance and their ability to take out further loans. In Kenya, the consequences have scaled sharply: mobile banking fraud losses rose 344 percent in a single year, from roughly 182 million Kenyan shillings (US$1.4 million) to over 810 million Kenyan shillings (US$6.3 million), even as SIM registration requirements tightened over the same period. This is where the policy logic breaks down. Stricter identity verification at the point of registration does not close the vulnerability, because the fraud does not occur at registration; it happens afterward, at the much weaker point where a telecom decides whether to honor a request to move a number from one SIM to another. A financial system that treats a phone number as proof of identity depends on that swap process working correctly, yet most users never see it, and most regulators treat it as routine customer service rather than a financial security control. 


The Scale Behind the Case Studies

 

Kenya and the Philippines are not outliers, but samples of a continental pattern. Mobile money moved US$1.432 trillion through African accounts in 2025 alone, and a GSMA provider survey found that identity fraud had reached 90 percent of the continent's mobile money operators that same year. SIM swapping alone was responsible for roughly 43 percent of that fraud. The dollar figures move just as fast as the transaction volumes, with one industry estimate putting Africa's annual mobile money fraud losses at more than US$4 billion. Seen against that backdrop, Kenya's 344 percent spike and the Philippines' post-registration crime wave stop looking like isolated policy failures and start looking like the visible edge of a much larger, continent-wide design flaw. 


Manila's Cautionary Tale 


The Philippines shows the opposite failure. In 2022, President Ferdinand Marcos Jr. signed the SIM Registration Act, requiring every subscriber to register using a government ID and photo. As an administrative exercise, it worked: within seven months, nearly 114 million SIMs were registered, exceeding the government's own target. But the fraud the law was meant to stop did not fall. Cybercrime complaints rose 21.8 percent in the first quarter of 2024 compared to the same period the year before, and raids on offshore gaming operations later turned up caches of fraudulently registered SIMs still being used for scams. The National Telecommunications Commission (NTC) itself acknowledged that the law is not, in its own words, a "silver bullet" against messaging scams, and lawmakers pressed the agency over its failure to curb text scams despite full implementation. Fraud rings adapted by paying individuals to register SIMs under their own names, then handing the cards over, satisfying the law while defeating its purpose. Marcos's government had done exactly what fraud-prevention orthodoxy recommends, and the orthodoxy itself proved insufficient. 


A System Built Upside Down 


Not every country anchors identity to a telecom's customer file. Estonia issues a state-backed digital identity first, then lets a SIM card serve as one of several ways to access it. Estonia's Mobile-ID uses a special SIM to carry cryptographic keys tied to a person's government-issued eID, but the identity itself lives with the state's public key infrastructure. Losing the SIM does not mean losing the identity, since residents can fall back on a physical ID card or a SIM-free app called Smart-ID that requires no telecom involvement at all. The lesson is not that every country can afford Estonia's infrastructure. It is that the vulnerability running through the Global South is not mobile identity itself, but the decision to let a single, telecom-controlled credential double as the entire root of trust. 


The Cost of Closing the Door 


Stricter verification carries a cost rarely discussed alongside it: it locks out the people the system was built to include. At least 135 countries now require identification to activate a SIM, an assumption not everyone can meet. Bangladesh barred the sale of SIMs to Rohingya refugees entirely, citing security. Rights groups have documented refugees cut off from family contact and from the internet itself for lacking recognized identification. The same requirement defended as fraud prevention becomes, for the undocumented, a total barrier to the system built on top of it. 


Who Gets Left Out Twice 


The exclusion problem is also not evenly distributed. Across Sub-Saharan Africa, roughly 37 percent of unbanked adults cite a lack of identification as the reason they have no financial account, and women are consistently more likely than men to fall into that gap. The GSMA has found that women in the region are five percent more likely than men to be both unbanked and undocumented, a gap that widens to 13 percent in countries such as Benin and

Liberia. Because SIM registration treats a national ID as the baseline proof of personhood, it does not just exclude the undocumented as a category. It reproduces an existing gender gap in whose documents a state recognizes in the first place, layering a second barrier on top of the first. 


Patching Around the Flaw 


Financial institutions have not waited for governments to fix this. Because SMS-based verification is trivially defeated by a SIM swap, banks and mobile money providers have begun layering device fingerprinting and behavioral biometrics—how a person types, interacts, and navigates an app—on top of phone-based identity, using the logic that a stolen number does not come with a stolen set of habits. Deployments combining these signals have reported fraud reductions of more than 80 percent in some markets. That is a genuine improvement, but it also shows that the industry's own fraud teams no longer trust the SIM as a credential and are quietly building a second, unofficial identity layer around it. 


The Other Argument 

None of this is to say the security argument is false. Governments that mandate SIM registration argue that anonymity itself is the enabling condition for scam networks, and that a traceable number gives investigators a valuable lead. That case has real intuitive force in places like Nigeria, where officials have pointed to registration as the only tool that lets them subpoena call records tied to a suspect. The issue is that the record does not bear the theory out. A 2016 GSMA study found no evidence that mandatory registration directly reduces crime, and Mexico's own registration law was repealed after three years because prosecutions did not improve. Scammers, in fact, adapt at least as fast as regulators, rendering the policy more effective at screening honest people than at screening criminals. 


No Easy Fix 

None of this points to an obvious solution. Biometric SIM-binding has been introduced as the next step in several countries, but it only repeats the trade-off in a stricter form. The Philippines, Kenya, and the refugees locked out all share not a policy failure but a design limit: an accidental identity system asked to do the work of a bank and a border guard at once.


Works Cited 

“Africa’s Mobile Fraud: SIM Swap, AI Deepfakes, $4B Lost.” AlgeriaTech, 15 May 2026, 

“Africa’s Mobile Money Hits $1.4 Trillion, Most Accounts Idle.” Mindcron, mindcron.com/africa-mobile-money-boom-dormant-accounts/. Accessed 27 Aug. 2026. 

“Amount Lost through Cyber Fraud (Sh m).” The Star, 10 July 2026, www.the-star.co.ke/news/infographics/2026-07-10-amount-lost-through-cyber-fra ud-sh-m. 

“Bangladesh: Internet Ban Risks Rohingya Lives.” Human Rights Watch, 26 Mar. 2020, www.hrw.org/news/2020/03/26/bangladesh-internet-ban-risks-rohingya-lives. 

“Bridging the Economic Gender Equity Gap: Strategies for Operators and Policymakers.” GSMA Mobile for Development, 29 Mar. 2023, 

www.gsma.com/mobilefordevelopment/blog/bridging-the-economic-gender-equit y-gap-strategies-for-operators-and-policymakers/. 

“Cybercrime Cases Continue to Rise, up 21.84 Percent in Q1.” Philstar.com, 10 Apr. 2024, 

“Detecting Fraud with Device Fingerprinting.” Callsign, 

“Digital Gap Deepens Marginalization of Rohingya Refugees in Bangladesh.” The Contrapuntal, 16 Dec. 2024,

“Europol Dismantles SIM Farm Operation Linked to International Cybercrime Network in 80 Countries.” CPO Magazine, 24 Oct. 2025, 

www.cpomagazine.com/cyber-security/europol-dismantles-sim-farm-operation-li nked-to-international-cybercrime-network-in-80-countries/. 

“114 Million SIM Cards Registered as Mandatory Listup Ends.” Philippine Daily Inquirer, 

“The Implications of Mandatory SIM Registration for Refugees, Stateless and Forcibly Displaced Persons.” ID2020, Medium, 1 June 2018, 

“Liberty vs Security: The Battle Over SIM Registration.” TeleGeography, resources.telegeography.com/liberty-vs-security-the-battle-over-sim-registration? hs_amp=true. Accessed 27 Aug. 2026. 

“Loopholes in SIM Registration Law Lead to Rise in Cybercrimes – IT Experts.” Philstar.com, 2 Sept. 2024, 

“Mobile Currency in Kenya: The M-Pesa.” Centre for Public Impact, centreforpublicimpact.org/public-impact-fundamentals/mobile-currency-in-kenya the-m-pesa/. Accessed 27 Aug. 2026. 

“Mobile-ID.” e-Estonia, e-estonia.com/solutions/estonian-e-identity/mobile-id/. Accessed 27 Aug. 2026.

“M-Pesa.” Wikipedia, Wikimedia Foundation, en.wikipedia.org/wiki/M-Pesa. Accessed 27 Aug. 2026. 

“M-Pesa: A Mobile Money Success Story from Kenya.” Technology and Operations Management, Harvard Business School Digital Initiative, 10 Dec. 2015, d3.harvard.edu/platform-rctom/submission/m-pesa-a-mobile-money-success-story -from-kenya/. 

“SIM Card Registration.” Privacy International, 

Toulas, Bill. “SIM Farm Dismantled in Europe, Seven Arrested.” SecurityWeek, 20 Oct. 2025, www.securityweek.com/sim-farm-dismantled-in-europe-seven-arrested/. 

“SIM Registration Act.” Wikipedia, Wikimedia Foundation, 

“Smart-ID.” e-Estonia, e-estonia.com/service/estonian-e-identity/smart-id/. Accessed 27 Aug. 2026. 

“When Criminals Change the SIM, What Happens to the Trail?” Tribune Online, tribuneonlineng.com/when-criminals-change-the-sim-what-happens-to-the-trail/. Accessed 27 Aug. 2026.

Comments

bottom of page