SINGAPORE – An authorised dealer in mobile phones has been fined a record $48,000 for exploiting customers’ personal data to register SIM cards without their knowledge or consent, before selling them.

The Personal Data Protection Commission said on Jan 17 that Koh Wei Ming, also known as Muhammad Amin Koh, was found to have illegally sold more than 1,000 of such SIM cards to anonymous buyers over four years. He made an estimated profit of about $35,000.

His acts came to light when the commission received nearly 1,400 complaints from the public between February 2020 and September 2021.

The complaints involved people receiving marketing messages despite registering with the Do Not Call Registry to block such messages, according to the commission’s findings released on Jan 17.

The authority then traced these messages to 95 prepaid SIM cards bought from Koh, who ran Mobile Chat, a shop in Geylang that sold mobile phones and prepaid SIM cards.

It found that Koh had exploited the SIM card registration process to register additional prepaid SIM cards through two ways.

First, he would scan identification documents, like identity cards and passports, twice to register two SIM cards without the customer’s knowledge. Koh would then hand over only one card to the customer and keep the other to sell to unauthorised buyers.

Second, if a customer completed the registration process, but decided not to buy a SIM card, Koh would keep the card instead of cancelling or reversing the registration. He would then activate the card without the customer’s knowledge and sell it to other buyers.

The 95 SIM cards sold by Koh were registered using the details of 73 people, who had their names, addresses and NRIC numbers, foreign identification numbers or passport numbers used without their consent.

However, the commission found it was likely that more people’s personal data were affected, as Koh admitted that he had sold an average of 250 prepaid SIM cards annually over four years.

In deciding the fine for Koh, the commission noted that his breaches of the Personal Data Protection Act were difficult to detect as they went unnoticed until the customers’ information had been misused to send marketing messages.

As prepaid SIM cards are frequently used to further criminal activities, a supplier of prepaid SIM cards who breaches the Act must be dealt with severely to deter others, said the commission.

It also considered the fact that his actions were intentional and took place over a long period of time, had caused inconvenience to innocent parties, and that he had made a profit of about $35,000.

The commission said Koh had asked for no financial penalty to be imposed because of personal and financial hardship. According to Koh, he was the breadwinner of his family and had been seeking treatment at the Institute of Mental Health.

These reasons were not accepted as he did not substantiate his claims.

In September 2023, Koh was sentenced to 16 months’ jail for illegally modifying the contents of telecommunications company M1’s computer system to register prepaid SIM cards. He registered the SIM cards with a terminal device provided by M1, which was used for the registration of such cards before December 2021.

The commission said Koh’s case is the second one involving egregious misuse of individuals’ personal data for illicit activities.

In 2022, mobile retailer Yoshi Mobile was fined $21,000 for selling illicit SIM cards that were also used to send unsolicited messages.