"Budget Phone Security to Match Financial Sector Level"...Mandatory ISMS Certification for All Operators

Damage from Mobile Phone Activation Under Another Person's Name
Government Announces 'Measures to Prevent Fraudulent Subscriptions'
Security Strengthened to Financial Sector Level

The Ministry of Science and ICT has decided to mandate Information Security Management System (ISMS) certification for all MVNO operators to prevent fraudulent activations. Additionally, companies will be required to appoint a Chief Information Security Officer (CISO) to enhance their own information security levels.

On the 27th, the Ministry of Science and ICT announced a comprehensive plan to prevent fraudulent non-face-to-face subscriptions for MVNOs. MVNOs, which offer cheaper plans than traditional mobile carriers, allow online non-face-to-face subscriptions; however, due to security vulnerabilities in some MVNO companies, there have been cases of mobile phones being activated under another person's name. In response, since March, the Ministry has formed a dedicated task force involving related departments and specialized agencies to devise countermeasures.

As a result, a plan was established to strengthen the security level of the MVNO industry to that of the financial sector. The system will be improved so that all MVNO operators must obtain ISMS certification and designate and report a CISO. To ensure implementation and effectiveness, MVNO operators will be required to submit ISMS certification plans and CISO reporting plans when registering new MVNO businesses. The Ministry plans to develop ISMS items specialized for MVNOs and amend related laws to prepare for strengthening security in the MVNO industry.

Currently, ISMS in the information and communication industry applies when annual sales exceed 10 billion KRW or the number of lines exceeds 1 million, but the mandate will be enforced even if these criteria are not met.

The three major mobile carriers have also joined efforts to improve systems to prevent fraudulent MVNO activations. By linking MVNO systems with carrier systems, carriers will perform an additional verification of subscriber applications through a "cross-check" method. This blocks the possibility of fraudulent mobile phone activations under another person's name by bypassing identity verification.

Ryu Jae-myung, Director of the Network Policy Office at the Ministry of Science and ICT, said, "We expect the overall security level of the MVNO industry to improve significantly through this measure," and added, "We will continue to make every effort to prevent harm to the public caused by fraudulent non-face-to-face MVNO activations."