Why security decisions made before launch can determine the long-term success of an MVNO or IoT business.
When a new Mobile Virtual Network Operator (MVNO) prepares to launch, early conversations usually focus on commercial opportunities. There are network agreements to negotiate, systems to integrate, subscribers to acquire, and revenue targets to meet.
Security is often part of these discussions, but I believe it deserves greater attention.
Having worked on MVNO and telecommunications infrastructure projects across Africa and Europe, I have come to appreciate something important. Launching a mobile service is not just about connecting systems and completing technical tests. It is also about understanding how those systems will be protected and managed once customers start using them.
An MVNO may have a strong business model, a reliable network partner, and competitive pricing. Yet, weaknesses in subscriber identity management, system access, fraud detection, or operational processes can create serious business problems.
The concern is not simply whether someone can attack the network. It is whether the business understands its security responsibilities and has the capability to manage them.
The Security Responsibility Does Not End With the Network Provider
One advantage of the MVNO model is that operators can enter the market without building an entire mobile network.
Depending on the operating model, an MVNO may rely on a Mobile Network Operator (MNO), Mobile Virtual Network Enabler (MVNE), or other technology partners.
This arrangement reduces infrastructure requirements and can accelerate market entry. However, it also creates an important question: who takes responsibility when something goes wrong?
Consider a situation where subscribers begin reporting unauthorised SIM replacements. The MVNO manages the customer relationship, but another provider operates part of the provisioning infrastructure.
Who investigates the incident? Who can access the relevant logs? Who has authority to suspend the affected service? More importantly, how quickly can the organisations coordinate?
These questions are much easier to resolve during project planning than during an active security incident.
In my experience, MVNO projects involving several technology partners require clear ownership of technical interfaces, operational responsibilities, and acceptance criteria. Security should follow the same approach.
Before launching, an MVNO should understand which party manages customer information, network access, provisioning, fraud monitoring, and incident response.
These responsibilities should be documented, tested, and reflected in operational agreements.
A network partnership may reduce infrastructure costs, but it does not remove the MVNO's responsibility to protect its customers and business interests.
Subscriber Identity Is Now a Financial Security Issue
A mobile number is no longer used only for calls and messages.
Today, people use their numbers to access banking applications, recover passwords, receive authentication codes, and conduct financial transactions.
This makes subscriber identity particularly attractive to criminals.
SIM swap fraud is a good example.
A criminal may impersonate a legitimate subscriber and fraudulently obtain control of that person's mobile number. Once successful, the attacker may intercept SMS authentication codes or attempt to access accounts linked to the number.
The consequences can extend beyond the telecommunications service.
In its 2024 report, Mobile Money Fraud Typologies and Mitigation Strategies, the GSMA identifies impersonation as the most prevalent fraud method examined. The research also highlights identity fraud, social engineering, and SIM swap attacks.
This is particularly relevant to African markets, where mobile connectivity supports a growing range of financial services.
However, the risk is not limited to Africa. European operators also face identity-related fraud and account takeover attempts.
For an MVNO, the lesson is that subscriber onboarding and SIM replacement are security-sensitive activities.
Customer verification should not become weaker simply because the business wants faster activation or fewer customer service delays.
There should be clear procedures for identity verification, suspicious account changes, and access to subscriber records.
Where appropriate, operators should also consider additional verification for high-risk transactions.
A convenient customer experience is important. However, convenience should not make it easier for someone else to take control of a subscriber's identity.
Fraud Can Affect Revenue Before Anyone Notices
Another security concern that deserves management attention is telecommunications fraud.
Fraudulent activities may include artificial traffic generation, international revenue share fraud, subscription fraud, and unauthorised use of services.
These activities can create financial losses, particularly where an MVNO pays wholesale charges based on network consumption.
For example, imagine an MVNO experiencing an unexpected increase in international call traffic.
At first, the increase may look like normal subscriber activity. However, if the traffic is fraudulent, the business could continue accumulating wholesale charges before detecting the problem.
The MVNO may then face a difficult situation. It must investigate the activity while managing billing obligations, customer complaints, and possible disputes with its network partner.
This illustrates why fraud prevention cannot be separated from financial management.
For a business operating with narrow margins, unexpected network charges can quickly affect profitability.
The controls needed are not necessarily complicated.
Operators should establish traffic monitoring, usage thresholds, fraud alerts, and escalation procedures. They should also understand how quickly suspicious traffic can be restricted.
Equally important, commercial and technical teams should agree on how fraud-related financial exposure will be managed.
A business should not wait for its first major fraud incident before deciding who has authority to act.
The Risks That Appear After Go-Live
One area I pay particular attention to during telecom projects is the transition from implementation to operations.
Before launch, technical teams are focused on integration, configuration, testing, and resolving outstanding issues.
Vendors and engineers may require temporary access to systems. Changes may happen frequently, especially when teams are working towards a fixed launch date.
These activities are normal during implementation.
The concern is what happens after the service becomes operational.
Are temporary accounts removed? Have administrative privileges been reviewed? Are production changes properly controlled? Who manages vulnerabilities and security patches?
These questions matter because systems that were secure during testing may become exposed through poor operational practices.
For instance, a vendor account created for troubleshooting may remain active long after the work is completed.
Similarly, a vulnerability identified during testing may be accepted temporarily because it does not prevent the service from launching.
Without proper follow-up, temporary decisions can become permanent weaknesses.
I have found that operational readiness requires the same attention as technical readiness.
An MVNO should have clear procedures for privileged access, vulnerability management, incident escalation, system changes, and security monitoring.
These controls should also cover cloud infrastructure, application platforms, and integrations managed by third parties.
A successful go-live is important, but it is only the beginning of the operational responsibility.
IoT Connectivity Introduces Another Security Challenge
The growth of Internet of Things (IoT) services creates additional opportunities for MVNOs.
Businesses increasingly use connected devices for fleet tracking, smart metering, industrial monitoring, logistics, and remote equipment management.
However, connecting thousands of devices introduces security challenges that differ from traditional mobile subscriptions.
Unlike a mobile phone, an IoT device may operate unattended for several years.
Some devices have limited processing capabilities. Others may be installed in locations where physical maintenance is difficult.
This makes device identity, remote access, software updates, and lifecycle management particularly important.
The US National Institute of Standards and Technology (NIST), through NISTIR 8259A: IoT Device Cybersecurity Capability Core Baseline, identifies important security capabilities for connected devices.
These include device identification, secure configuration, data protection, access control, and software updates.
These principles are useful when assessing an IoT connectivity business.
For example, an operator providing connectivity to industrial equipment should understand how devices are authenticated and how compromised connections can be isolated.
The business should also establish who is responsible for security updates and incident investigation.
Not every responsibility belongs to the connectivity provider. Device manufacturers, application providers, and customers may control different parts of the environment.
However, these boundaries must be understood.
For companies expanding from traditional MVNO services into IoT, security requirements should be reviewed before large-scale deployment.
Otherwise, the business may inherit risks that are difficult and expensive to address later.
Why Security Should Matter to MVNO Investors
Investors often evaluate MVNO opportunities using subscriber projections, average revenue per user, acquisition costs, and expected profitability.
These indicators are important, but they do not provide a complete picture of business resilience.
A security incident can introduce costs that were not considered in the original financial model.
These may include incident investigation, service disruption, fraud losses, regulatory penalties where applicable, legal expenses, and customer compensation.
There may also be indirect consequences.
Customers can lose confidence in the service. Partners may request additional assurances. Management may need to divert resources from expansion into remediation.
For these reasons, security deserves attention during investment due diligence.
An investor does not need to become a cybersecurity engineer. However, there are important questions worth asking.
Does the business understand its major security risks? Are responsibilities clearly defined between partners? Is there a working fraud management process? Has the production environment undergone appropriate security testing?
It is also worth asking whether security spending has been included in operating costs.
An MVNO that budgets for subscriber acquisition but overlooks monitoring, vulnerability management, and incident response may be underestimating its future expenses.
Security investment should therefore be viewed as part of protecting the business model, not merely satisfying technical requirements.
What I Would Prioritise Before Launch
If I were reviewing the security readiness of a new MVNO, I would concentrate on a few practical areas.
- First, establish clear security ownership. Every critical system and operational process should have an accountable owner. This includes responsibilities shared with network and technology partners.
- Second, protect subscriber identity. Onboarding, SIM replacement, account recovery, and customer data access should have appropriate verification and monitoring controls.
- Third, connect fraud management with financial operations. Suspicious activity should be detected early, with clear procedures for investigation and traffic restriction.
- Fourth, secure production access. Administrative privileges, vendor connections, system changes, and vulnerability remediation should be properly managed.
- Finally, test operational readiness. Security testing should go beyond identifying vulnerabilities. Teams should also demonstrate how they will detect, escalate, investigate, and recover from incidents.
None of these activities should be treated as an exercise completed once before launch.
As subscriber numbers increase and services expand, the risks will change.
The security model must therefore grow with the business.
Final Thoughts
Managing MVNO projects across different markets has reinforced one important lesson for me: technical readiness and business readiness are closely connected.
It is possible to complete an integration successfully and still leave important operational questions unanswered.
That is why I believe security discussions should begin during architecture and commercial planning, rather than shortly before launch.
For established MVNOs, the same principle applies when introducing new services, changing network partners, or expanding into IoT.
Growth creates opportunities, but it also increases operational dependencies and potential exposure.
A strong MVNO business is not simply one that can attract subscribers or introduce competitive pricing.
It is one that can protect customer identities, manage fraud exposure, maintain reliable operations, and respond effectively when something goes wrong.
For me, a successful MVNO launch is not just about getting the network to work. It is about making sure the business is ready to operate and protect that network long after launch day.
