Biometrics at mobile operators: new subscriber protection rules and what they mean for companies

Kazakhstan has approved new rules for mobile operators: significant operations with a subscriber number — SIM reissue, ownership change, re-registration — will require biometric confirmation, and subscriber protection against fraud is being strengthened at the level of operator regulations.

The reason is familiar to anyone who has dealt with account hijacking: SIM reissue via a forged power of attorney is the classic scheme through which attackers intercept SMS codes for a victim's banks and messengers. Biometrics closes that door almost completely.

Two practical points for companies. First, check who your corporate numbers are registered to — the ones tied to banking, eGov and work services. Numbers registered to long-departed employees or "whoever was available" will become a problem at the first re-registration under the new rules. Second, the very logic of "critical operation — biometrics only" is worth importing into your company for actions involving money and access.