The National Telecommunications Agency (Anatel) has made the use of biometric validation mandatory both for activating and maintaining mobile phone lines. This new regulation was approved by the Superintendence of Planning and Regulation and released this Wednesday, October 28th. The rule applies to individuals and individual microentrepreneurs (MEI) and will be implemented progressively until the end of 2028.
According to official documentation, facial recognition will be required in several situations, such as new activations, portability processes, SIM card replacement, and any cadastral or contractual modification requested by the consumer themselves. Those who already have a line will also need to comply with this procedure by December 31, 2028. However, legal entities that are not classified as MEI are exempt from this requirement.
The main purpose of this measure is to make it more difficult to open or transfer lines using false information or information belonging to third parties. One of the most well-known scams mentioned is SIM swap, where criminals manage to redirect the victim's number to a different chip, allowing them to receive calls and authentication codes via SMS.
Biometrics serves as an additional layer of security in this process. Previously, Anatel had already made SMS confirmation mandatory in cases of portability and launched the Anatel Protege tool, aimed at blocking the opening of lines linked to the user's CPF. It is important to note that the use of biometrics in the sector is not new; since 2021, operators have been using what is called Digital ID to validate registrations on certain prepaid lines, by sending a selfie along with a document.
The Anatel technical standard specifies that the verification must include CPF validation, face capture, and proof of life, ensuring that there is a real person in front of the camera. Subsequently, this image will be compared with a biometric database, which can be public or private. If the recognition fails, alternatives are available, such as another attempt, in-person service, or comparing the selfie with the photo contained in an official document.
Vivo, as an example, already employs a similar method in certain services. When requests are made via phone or WhatsApp, the operator may send an SMS containing a link to confirm identity. The customer must display their face and wait a few seconds for validation before any plan change can be effected.
Although the initiative aims to curb fraud, it also introduces a new circumstance in which consumers will need to provide biometric data to access a service. Service providers will also have the prerogative to add other checks to identify fraudulent activities.
The regulation mandates that data collection be restricted to what is strictly necessary, requires compliance with the General Data Protection Law (LGPD), and prohibits undue sharing with third parties. Furthermore, systems must maintain auditable records of all verifications performed.
