Shop owner fined S$48,000 for illicit SIM card sales and customer data exploitation

SINGAPORE: The owner of a mobile phone shop, Koh Wei Ming, also known as Muhammad Amin Koh, has been fined S$48,000 (US$35,700) for engaging in illicit activities related to prepaid SIM cards.

The illicit activities revolved around the unauthorized use of customers’ data, done without their consent, for the registration of these SIM cards.

These cards, thus obtained, were then sold to unapproved purchasers, constituting a breach of privacy and trust.

The Personal Data Protection Commission (PDPC) revealed in a media release on Wednesday (17 Jan) that these errant practices persisted over a span of four years and over 1,000 illicit SIM cards were sold.

Phone shop owner fined for exploiting customer data to illicitly sell SIM card

In a recent judgment dated 17 October 2023, the Personal Data Protection Commission (PDPC) reported receiving 1,391 complaints between February 2020 and September 2021.

The complaints were from individuals who, despite being registered with the Do Not Call Registry, continued to receive marketing messages.

These messages were traced back to 95 prepaid SIM cards purchased from Koh, the owner of Mobile Chat.

Investigations revealed that Koh exploited the SIM card registration process, using customers’ personal data without consent to register additional prepaid M1 SIM cards.

Koh employed various methods, including duplicate scanning of customers’ identity documents during the SIM card registration process.

He would then sell the additional, unregistered SIM cards to unauthorized buyers.

Another method involved Koh keeping unwanted SIM cards or activating them without customers’ knowledge and subsequently offering them for sale to unauthorized buyers.

During the investigation, Koh admitted to wanting extra income from selling pre-registered SIM cards.

Over a four-year period, he estimated a profit of around S$35,000 (US$26,000), selling approximately 250 illicit SIM cards annually.

Koh used the personal data of 73 individuals to register the 95 SIM cards linked to complaints, but the commission suspects the involvement of around 1,000 individuals in the case.

Koh had previously received a 16-month jail sentence in September 2023 under the Computer Misuse Act for unauthorized modification of M1’s computer system to register prepaid SIM cards.

PDPC highlighted this case as the second involving the egregious misuse of personal data for illicit activities, following a previous case involving Yoshi Mobile, a mobile retailer fined S$21,000 (US$15,600) for selling illicit SIM cards used for unsolicited messages.