Have you ever received a message or phone call from a stranger wanting to get in touch with someone with the exact same number as yours? While this might seem like a simple misunderstanding, it actually showcases the fragility of all the data that is attached to a particular phone number. With the advent of smartphones, as well as websites and apps requiring data to connect, this becomes an increasingly worrying issue.

Communications and Information Ministerial Regulation No.14/2018 states that a phone number can be reactivated as a new number 60 days after the expiration date - a short time frame to delete all or any of the data attached to a certain phone number.

Damages

Problems caused by recycled numbers include identity theft and email hacking.

Aulia Meidiska, who currently works as a writer, found out that her phone number had been recycled in October.

“I noticed that my number had been recycled and sold to other people after I was logged out from WhatsApp and my email was hacked. The provider simply told me that my number had been resold and they could not do anything about it,” Aulia said.

Aulia suspected that she had been a victim of identity theft. But the provider was not able to help Aulia, as the application in which her account had been hacked was an e-commerce website, which is considered a third party. She was advised to solve the problem independently.

Like most websites that require registration, e-commerce sites often require users to register both their data and their phone number, linking the two.

For many, the process of untangling the number-data connection with the many websites they’ve registered on — at least the ones they can remember — is a near-impossible task.

“The new owner still also uses my picture and my status on their WhatsApp profile. I also noticed that someone purchased something from an e-commerce site using my number,” Aulia said.

She filed a complaint with the Communications and Information Technology Ministry but has yet to receive a response.

Nimelenia Prabenkkary, 21, a university student, shared her mother’s experience in September.

“My mother accidentally uninstalled her WhatsApp application on her phone, and after two days, someone with her number was online [on WhatsApp]. The person was selling medical supplies, which scared my mother as she also works as a midwife and is not too tech-savvy,” Nimelenia said.

She and her mother saw how easy it would be for that person to pretend they were Nimelenia’s mother and begin selling those medical supplies under the mother’s name to the contacts in her phone's contact list.

Sometimes, people accidentally buy recycled numbers without knowing it.

Ida, 27, did not know that her number used to be someone else’s.

“Once, I had just bought a new number, but after a few days, I began getting calls from debt collectors. They told me that I must find the previous owner of the phone. So, I ended up buying a new number,” she said.

Understanding: Miftah Fadhli, a researcher from a non-government organisation, ELSAM said that there must be a clear understanding between the provider and the customer regarding phone numbers. (Courtesy of Miftah Fadhli) (Personal collection/Miftah Fadhli)

For those looking to buy a new number, there is no way to check whether the number you're getting has issues tied to it or if it is truly clean. Miftah Fadhli, an NGO researcher from the Institute for Policy Research and Advocacy (ELSAM), explained that other countries like the United States have a one-call policy.

“In America, they have a one-call policy to check if your number is problematic or if it’s not. They also check whether your number is still connected to any other digital platform that belonged to the previous owner,” Fadhli said.

Regulation flaws

Victims of recycled phone numbers will find no help within Indonesia’s consumer law or the Electronic Information and Transactions (ITE) Law. In it, a fatal flaw can be discovered, practically making it impossible to file an official complaint about issues related to recycled numbers.

 

“The victim’s position is actually weak because they can no longer file a complaint, or in most cases, their complaints are ignored because they were officially ‘no longer a customer',” Damar Juniarto, SAFEnet’s executive director, explained.

Weak position: Damar Juniarto, Executive Director at SAFEnet stated that the position of the victims are weak because there is no a clear regulation or law that would protect them. (Courtesy of Damar Juniarto) (Personal collection/Damar Juniarto)

Had the victim still been a consumer, Damar said, “They could be protected under No. 8/1999 on consumer protection, which states that consumers are entitled to express their grievances and to feel satisfied while using products or services.”

 

Faizin Sulistio, a telematics law lecturer from Brawijaya University, said Communications and Information Technology Ministerial Regulation No. 5/2021, Article 168 (1) reduces the meaning of consumers to only those who are still actively using the number.

"In the ITE Law, the right to delete data has been introduced in the context of the right to be forgotten, but the rules are so vague that they cannot be implemented in the field," Fadhli said.

 

"Referring to Government Regulation No. 71/2019 on the new regulations for the operation of electronic systems and transactions [PSTE], there is an obligation for electronic system operators to destroy personal data if the data is no longer relevant, including if a customer is no longer using the number. But the supervision is still lacking in this area, and who could ensure that this is carried out by the provider?” 

Measures needed

Indonesia in general needs to pay more attention to digital privacy. It is not only the government that is responsible for regulations regarding this matter; both providers and customers also need to implement digital privacy policies.

“There must be an evaluation from the Communications and Information Technology Ministry regarding the problem of recycling phone numbers, especially the 60 days reactivation policy. Furthermore, a strict security standard needs to be implemented into the PSTE, which includes electronic system feasibility testing with proper step-by-step procedures,” Fadhli said.

He points to the lack of discussions on data literacy between the provider and their customers, especially regarding what to do in cases of data leaks related to recycled numbers.

"It is also important for the consumer to understand [these issues]. Because when I bought a new phone number, I was never told about this recycled phone number issue. Communication is very important because it seems that it is left to the customer to take care of their own problem.”