MTN puts 90 million prepaid SIM cards into the South African market every year, and estimates the industry as a whole pushes between 200 million and 300 million into a country of roughly 65 million people, adults and children included.

MTN South Africa chief executive Ferdi Moolman gave the figures at Tuesday's post-results media conference and said they simply do not make sense. The volumes drive revenue, but not revenue MTN regards as sustainable.

Two admissions sit inside those numbers. Group chief executive Ralph Mupita described a market where customers hold three SIMs at once and move between networks recharge by recharge, chasing whichever offer is cheapest, and noted the position has inverted: nine years ago Nigeria was the multi-SIM market, and South Africa was not.

He also described the customer value management engines each operator runs, which register when a subscriber has not recharged for a fortnight and fire off another offer to pull them back. The churn the industry complains about is partly manufactured by its own retention tooling.

The second admission is that RICA cannot cope. Moolman said registration quality does not hold up at that rate of churn, and drew a direct line from weak KYC to the syndicates hijacking WhatsApp, Facebook and X accounts. South Africa, unlike some other MTN markets, sets no legal limit on how many SIMs one person may hold.

TechCentral reported the figures and Moolman's argument that lifting KYC to where it should be would cut that fraud substantially. Its earlier reporting covered the new registration framework agreed through the Association of Comms & Technology in consultation with the Department of Justice, which carries responsibility for RICA, with implementation timing still being negotiated between operators. TechCentral also reported MTN's decision to cap registrations at 10 SIMs and require re-registration when a SIM stays dormant for 30 days, aimed at pre-registered SIMs sold on the street.

Set this against what we reported on Friday. Malware circulating locally reads the one-time PIN your bank sends by SMS. Now the country's largest operator says the SIM base those messages travel across is churning so fast that RICA registrations cannot reliably identify who holds a number, and it is MTN drawing the line from that to account hijacking syndicates.

SMS is failing as an identity anchor from both ends at once. If your product treats a phone number as proof of identity, whether for OTPs, password resets or a WhatsApp Business line, that assumption is now being contested by the operator selling you the number.

Move to app-based authentication and passkeys, and treat the number as a contact detail rather than a credential.

You might also like our piece on the SA banking trojan campaign reading OTPs off Android phones, why MTN cut 1.5 million prepaid customers on purpose, and what the Lego South Africa data breach showed about who carries the risk.

Get more SA tech and business news and subscribe to The Open Letter.