What the Philippine regulator ordered
The Philippines' National Telecommunications Commission (NTC) announced on 28 October 2026 that telcos have 15 days to verify every subscriber holding more than 100 mobile numbers under one name. The Daily Tribune reports that the 15-day clock starts when the operator receives the memorandum order. Operators must run stricter know-your-customer checks to confirm the subscriber still possesses and controls each SIM and uses it legitimately. SIMs that fail are deactivated. According to NTC Deputy Commissioner Alvin Blanco, deactivation is permanent unless the person can prove with proper identification that the SIM is registered personally in their name. The NTC says it is aiming at organised scam operations, fraudulent financial transactions and illegal SMS blasting, not lawful subscribers.
One caveat on sourcing. I could not retrieve the memorandum order itself; the NTC site refused automated access. Tribune describes it as an issued directive, while a search snippet from Unbox.ph described it as a proposal. I rely on the Tribune account here, and readers should check the order text.
The strongest case for the order
The regulator's case deserves a fair hearing. A person with 100 or more SIMs is very unlikely to be an ordinary consumer. Bulk SIM holdings are the raw material of SMS blasters and scam call centres, and a numeric threshold is a cheap and targeted screen. Republic Act No. 11934, the SIM Registration Act signed on 10 October 2022, also makes it an offence to sell or transfer a registered SIM without the required registration. That offence carries six months to six years in prison and a fine of P100,000 to P300,000, according to the statute text on Lawphil. The order is a way to enforce rules that already exist. It does not create a new power. Targeting outliers is also more proportionate than re-verifying all subscribers.
Why this is also an admission
The order sits awkwardly with the case made for the law in 2022. If registration had made SIMs traceable to real people, there should be few cases of a single identity holding 100 or more. The Tribune notes that the Act does not cap the number of SIMs one person may register. Four years in, the regulator is cleaning up an outcome the law allowed.
That fits earlier criticism. In June 2024 the Junk SIM Registration Network, an alliance of digital experts, privacy advocates and consumer groups, protested outside the NTC and called for repeal. Its media officer said the law "actually strengthens scammers" and that raids on scam operations had found bulks of falsely registered SIMs. Those are advocates' claims, reported by The Philippine Star, not official data. The group also said that no scammer had been arrested for violating the law. I could not find official statistics showing how far scams have fallen since registration began, and a mandate with unmeasured results is hard to defend as evidence-based.
The costs fall on people who did nothing wrong
The Tribune itself flags the collateral risk. Legitimate users of SIMs registered in someone else's name, especially SIMs tied to banking, digital wallet and payment apps, could lose service. A 15-day window is short for a large operator to contact, verify and adjudicate holders, and "permanent" deactivation with a burden on the holder to prove ownership reverses the usual presumption. A small business that bought numbers in bulk for delivery riders, field staff or two-factor authentication could be treated as a scam ring until it proves otherwise. The order says nothing, in the reporting I could verify, about an appeal route, a human review step or a grace period for financial accounts that depend on a number.
The data question matters too. The Act says registration data is "absolutely confidential" and may be disclosed only in limited cases: where another law requires it, under a court order or legal process on probable cause, on a subpoena in a fraud investigation, or with consent. Section 6 limits the register to processing, activating or deactivating SIMs. It keeps the data for ten years. Any new KYC layer that makes telcos collect more documents extends that retention pool and raises the stakes of a breach. The advocates' warning in 2024 was that a stored database "may be hacked or illegally accessed". A larger database makes that warning more pressing.
What US policymakers should take from it
The lesson for US debate is about method more than geography. SIM registration is often proposed as a tidy fix for robocalls, smishing and anonymous burner phones. The Philippine experience suggests identity at activation is weak once registrations can be faked, bought or farmed, and enforcement then shifts to retroactive purges that hit innocent users.
The better model starts with measurement. The FTC's July 2024 orders to eight companies on surveillance pricing, voted 5-0, used its study authority to gather facts before any rule. Telecom fraud deserves the same approach: publish how many scam numbers were traced to registered identities, how many registrations proved false, and how many legitimate users were wrongly cut off. Where intervention is warranted, it should hold carriers accountable for abnormal traffic patterns. SMS blasting, mass number rotation and bulk activation are all visible to operators without demanding more identity documents from everyone.
There is a wider pattern. Governments facing fraud reach for expanded identity and data-access powers, as in Canada's Bill C-22, which EFF says would require metadata retention of up to a year and broaden data sharing with foreign law enforcement. The justification is always fraud or crime, and the evidence of effect is rarely published.
Bottom line
The NTC is right that someone holding more than 100 SIMs warrants a look. But the order exposes a gap in the original promise of registration, and its design puts the burden of proof on the holder under a very short deadline. A proportionate version would publish its results, offer a real appeal, protect financial-account numbers during review, and cap the data it collects. Without those, it is another enforcement sweep whose success is claimed and not measured.