Orange Spain Fined €230K for Weak Identity Verification Leading to SIM Swap Fraud

Orange Spain suffered a security breach where attackers exploited weak identity verification controls to fraudulently obtain a duplicate eSIM card and conduct unauthorized transactions. Despite the company's systems detecting potential identity theft and issuing internal warnings, employees still proceeded to issue the duplicate SIM card, demonstrating systemic failures in access controls and incident response procedures. This case highlights how inadequate security measures and poor response to fraud indicators can lead to significant regulatory penalties and customer harm.

Tactical Insight

Immediate actions

Implement multi-factor authentication for all SIM card duplication requests
Establish mandatory fraud prevention training for customer service representatives
Create hard stops in systems that prevent SIM issuance when fraud alerts are active

Long-term improvements

Deploy automated identity verification systems with biometric or document validation
Establish clear escalation procedures for suspected identity theft cases
Implement real-time monitoring of SIM swap requests with behavioral analytics

Governance measures

Conduct regular audits of customer authentication processes
Create incident response playbooks specifically for SIM swap fraud attempts
Establish clear accountability measures for employees who override security warnings