Why telecoms are different

Every organisation has insiders, but few concentrate as much sensitive capability in the hands of ordinary employees as a mobile or fixed-line operator. A customer care agent can see subscriber details. A retail or dealer employee can issue a replacement SIM. A network engineer can see traffic patterns, location data and call records. Staff working on lawful interception systems handle some of the most sensitive data a state produces. And much of this work is outsourced to contractors, managed service providers and third-party shops.

Over the years I have investigated insider cases for operators in several markets, including a tier-1 mobile operator. The details of those cases stay confidential, but the patterns are consistent enough to share. This article sets out what I have learned about how insider threats actually manifest in telecoms, and what works in preventing and detecting them.

The insider is rarely a mastermind

The popular image of the insider threat is a disgruntled engineer planning sabotage. That happens, but it is not what I see most often. In telecoms, the majority of cases I have dealt with fall into a few recognisable categories:

• The recruited insider. Criminal groups approach frontline staff, often through social media or personal networks, and pay them per transaction: a SIM swap, a subscriber lookup, a call record. Each individual act looks small; the cumulative damage can be severe, particularly when it enables account takeover at banks or crypto platforms.

• The curious or careless insider. An employee looks up a celebrity, an ex-partner or a neighbour because the system lets them. No money changes hands, but the privacy breach is real and, under the GDPR, the operator carries the consequences.

• The privileged insider. Administrators and engineers with broad access to core network, billing or OSS/BSS systems. Their misuse is rarer but harder to detect, because their normal activity already looks powerful.

• The third-party insider. Contractors, outsourced support staff and dealer networks who have access to operator systems but sit outside the operator's culture, vetting and monitoring.

Understanding which of these you are facing matters, because the controls that deter one category do little against another.

SIM swap fraud is an insider problem as much as a technical one

Much of the public discussion about SIM swap fraud focuses on social engineering of call centre staff. That is real, but in several investigations I have led, the swap was not the result of an agent being deceived. It was the result of an agent, or a dealer employee, being paid. The fraudster did not need to sound convincing; they needed a cooperative person with the right access.

The lesson for operators is that strengthening customer authentication scripts alone will not close the gap. You also need to know which employees and which points of sale are performing swaps, how often, at what times and for which subscriber profiles, and to treat statistical outliers as leads worth investigating.

Access is usually broader than anyone realises

In almost every telecom insider investigation I have conducted, the first uncomfortable finding was the same: far more people had access to sensitive functions than the business believed. Roles had accumulated permissions over years of reorganisations. Generic or shared accounts existed in legacy systems. Leavers' accounts remained active. Contractors had been given administrator rights "temporarily" for a project that ended long ago.

The principle of least privilege is easy to state and hard to sustain in an environment with dozens of legacy platforms, mergers and constant change. But it remains the single most effective structural control. If a customer care agent does not need to see full call detail records to do the job, the system should not show them.

Logging exists, but nobody is reading it

Most operators I work with log access to subscriber data and network systems, often because regulators require it. The problem is that the logs are collected for compliance, not for detection. They sit in a repository, retained for the mandated period, and are only examined after a complaint or a law enforcement request.

What works better is turning those logs into behavioural signals. Practical indicators that have repeatedly surfaced real cases include:

• Lookups of subscribers with no associated customer interaction or ticket.

• Access to high-profile or VIP accounts outside a defined, justified process.

• Unusual volumes of SIM replacements or porting requests at a specific store, dealer or agent.

• Activity at odd hours, from unusual locations, or immediately before a resignation.

• Repeated queries for the same subscriber across different employees, which can indicate an organised request being distributed.

None of these signals is proof of wrongdoing on its own. They are starting points for a careful, proportionate review.

Investigations must be lawful, proportionate and discreet

An insider investigation in a European operator sits at the intersection of employment law, data protection law and, sometimes, criminal procedure. Monitoring employees must have a lawful basis, be proportionate and be transparent to the extent the law requires. Evidence must be collected in a forensically sound manner if it is ever to support disciplinary action or prosecution. And the investigation itself must be handled on a strict need-to-know basis, because a premature leak can alert the subject, contaminate evidence and expose innocent colleagues to suspicion.

I always recommend involving legal counsel, HR and, where applicable, the data protection officer at the outset, and agreeing a written investigation plan before anyone pulls a log or images a device.

Culture is a control

Technical controls are necessary but not sufficient. In the organisations where insider risk is lowest, three cultural elements stand out. First, staff understand clearly that access to subscriber data is monitored and that misuse has consequences. Second, there is a credible, safe channel for employees to report approaches from outsiders or concerns about colleagues, and those reports are taken seriously. Third, frontline staff are not left to feel underpaid and invisible while handling extremely valuable data; resentment is a vulnerability that recruiters exploit.

Awareness programmes that explain how criminals approach employees, with realistic, anonymised examples, are far more effective than generic annual compliance training.

Do not forget the supply chain

Outsourcing is pervasive in telecoms: call centres, field engineering, network operations, IT support and retail distribution. Each third party with access to operator systems is effectively part of your insider population. Contracts should specify vetting standards, access restrictions, logging obligations and audit rights, and those rights should be exercised. Under NIS2, supply chain security is one of the explicit risk-management measures, and operators of electronic communications networks and services are within its scope.

What I would prioritise

If I were advising an operator starting from scratch, I would focus on five actions: map who can access subscriber data, SIM management and core network functions, and cut that back hard; turn existing access logs into monitored behavioural alerts for the highest-risk functions; build a confidential reporting channel and a clear, lawful investigation procedure; extend vetting, logging and audit obligations to contractors and dealers; and brief frontline staff honestly about how they may be approached and what to do. None of this is glamorous. All of it works.