The POPI Act isn’t really helping us, as consumers. So, I have a solution.

We’re now waking up to numerous unsolicited phone calls, a blend of calls from telemarketers and spam callers. And now, even AI calls have entered the fray.

A typical call we’re all acclimatised to receive follow a similar script:

Caller: Hello! Could I speak to <X>?
X: This is X!
Caller: My name is <Y>. I'm calling on behalf of <Z business>, a financial service provider. For security purposes and in accordance to the POPI Act, I need to do some verification to see if I'm speaking to the actual X.
Could you confirm your ID number?

Let’s pause here and play this game. What should be the next response from X? Which of these 3 options do you automatically reply with?

Either, 1.:

X: My ID number is [spells out his ID number over the phone].

OR. 2.:

X: No, thank you. I prefer to validate other information seeing that my ID number is a sensitive information.

OR , 3.:

X: First of all, how can I validate that you are indeed who you say you are and that you work in the company you say you're working for or on behalf of?

For many ordinary citizens, the first response they provide is the option 1, and it’s obvious. We are socially conditioned to provide sensitive information because our brains are wired to social cues. When we hear the name of a “trusted” institution, a government agency, or any person or entity who have power or higher authority that is not normally provided to ordinary citizens our brain are conditioned to obey and cooperate with authority figures without questioning them.
There’s a term for this: it’s called authority bias.

Very few responders rarely reply using option 3, marketers and scammers knows this, so they use social engineering to get crucial sensitive information out of us.

What protection does the POPI Act provide to consumers?

The Protection of Personal Information Act (POPIA) aims to protect consumers by giving them legal control over how businesses collect, use, store, and share their personal data.

Essentially, your personal data IS your personal data and the right to privacy is recognized as a fundamental human right in the Bill of Rights of the Constitution of the Republic of South Africa and is protected in terms of the Constitution and the common law.

When you explicitly (with consent) provide your personal data to any public or private bodies, POPIA enforces these bodies the constitutional rights to safeguard your personal information.

Although you cannot arbitrarily dictate or control what an organisation does with your personal information, POPIA still gives you specific, legally defined rights to manage and protect your rights, such as accessing, provide correction, update and deletion of your personal data as well as withdraw consent (at any time) of processing of your personal data.

Under POPIA, sending unsolicited electronic communications - including emails, SMSs, automated calling machines, faxes, and phone calls (as classified by the Information Regulator) - is prohibited unless specific conditions are met. This can be found in Section 69 Direct marketing by means of unsolicited electronic communications.
In the act, marketers must obtain explicit, pre-existing permission (opt-in) from a consumer before contacting them electronically.
Also, buying contact lists from third-party brokers to send electronic marketing is illegal under POPIA unless every single person on that list has provided fresh, explicit opt-in consent to the buyer

For traditional, non-electronic channels - such as postal mail, hand-delivered flyers, or in-person visits - POPIA operates under legitimate interest (Section 11). You, as a consumer or data user (that’s what POPIA calls us) have an unconditional right to object to non-electronic marketing at any time (e.g., via Form 1), and the marketer must stop immediately.

With all these laws and regulations in place, South Africa faces a massive surge in unsolicited communication recently, ranking ninth globally for spam call intensity.

As mentioned on the Business Day:

“For millions of Africans, this is a daily experience. The phone rings
during a meeting, at the dinner table, while you are waiting for a
call from a hospital or your child’s school. You answer and it is a
sales pitch for insurance, a phone contract, a loan on a funeral
policy. You say no. The next day, a different number calls with the
same offer.

Clearly something is adding up (or as they say in these streets “the math isn’t mathing.”). Our personal data is circulating at an alarming pace and it’s a gold mine to marketers and data brokers. After all, we’re all getting spam calls. And with AI getting better and better every day, automated spam calls are now on the rise too.

Now, let’s return back to our game. There is a fundamental problem when we answer a call (or any communication from any source for that matter): how do know that the call that we’ve received is legitimate? How do spot the legit from the scam? Nearly 30% of calls that we receive from unknown numbers are flagged as spam or fraudulent.

South African government has a solution

To push back against aggressive telemarketing, the National Consumer Commission (NCC) launched the National Opt-Out Registry under Section 11 of the Consumer Protection Act (CPA).

• How it works: The National Opt-out Registry is a free, government-administered platform where consumers can register to block unwanted direct marketing calls, SMSes, and electronic messages.
• Business obligations: Direct marketers are legally mandated to scrub their contact lists against the registry monthly.
• Penalties: Companies that violate the regulations face severe fines of up to 10% of their annual turnover or R1 million, whichever is higher (with some statutory penalties reaching up to R10 million).
• Where to access: You can check updates or register via official channels like the Government News Portal.

While this approach can work (it’s still early stage, as of the time of writing), we can thank the government for taking an approach to tackle this unsurmountable annoyance.

But, I believe we can do more. So, here goes my IT engineering solution to it all.

My proposed solution.

If you work in Information Technology (IT), or in tech, you are very familiar about IT security, Information security (InfoSec), and cybersecurity. In essence, everybody in IT has implemented some form of security.

Here’s a brief definition:

• IT security: The collective strategies, methods, and technical safeguards that protect an organization’s digital infrastructure - including hardware, software, networks, and data - from unauthorized access, (malicious) damage, attacks and disruption.
• Information Security (InfoSec): The broad practice of protecting all information assets - whether physical or digital - from unauthorized access, use, disclosure, disruption, modification, or destruction.
• Cybersecurity: Focuses exclusively on protecting digital systems, networks, hardware, software, and electronic data from cyberattacks and malicious actors in cyberspace.

And with any IT infrastructures, it always faces constant threats and vulnerabilities (from internal and external actors) that IT engineers have to always have to proactively ensure that its infrastructures are always safe and resilient to attacks.
Experience has taught us that the weakest link in the security chain is us mere mortals, and since we cannot screen all 8 billion people constantly at real-time, a different approach is required.

One such security implementation strategy of IT systems used by enterprises is Zero Trust Architecture (ZTA), and Zero Trust Network Access (ZTNA), in cybersecurity.
ZTA works on only one fundamental principle: Never trust, always verify.
Essentially, you trust nobody at all, even when they are in the building as a verified employee. Every time a person needs to access a resources, the security system checks:

• Who are you?
• Is your device safe?
• Does this make sense right now?

It’s like having a security guard at every door who re-checks your ID and reason for being there, every single time. So, businesses adopt this framework to ensure only authorized users and devices can enter their networks, access business resources, and view sensitive data.

Let’s get back to our phone call we had earlier. A marketer, a service provider representative, a call centre or AI agent or any employee working in an organisation who called you uses the same principle. As part of POPIA they need to verify that the person that they’ve just called is the actual person they’re interacting with, i.e., are you the legitimate interest?

The problem, however, is that we, the consumer - the data user - have no way of verifying who the caller are, while businesses have to verify its consumers/customers, by law. Scammers are taking advantage of this on-sided affair.

ZTA advocate for mutual authentication, aka, a 2-way authentication. For those that are not IT/tech savvy, it means that the client and the server/host don’t trust each other at all. Each one must show some form of trusted “ID” to each other, you both verify each other’s ID and if it’s valid, verify that you are both legalised to have this conversation. If both verification and authorisation are valid only then do you start talking business.

Businesses can do this for their client, but a client cannot do this for businesses. We know that we urgently need some form of some call verification because Truecaller has 1.7 million daily active users in South Africa, and the app is active on 20% to 45% of connected smartphones in the country.

So, what do we want? In my “solution”, we need a public system that we can:

1. A public tool where we can verify who called us (some identity of who we had conversation with on the call), verify the source of the phone number (even if it’s a private number, as long as they operated as a business or provided a business service) and verify the entity/organisation from which the call came from is legitimate (maybe to link it to CIPC if it’s a business)?
2. Make it mandatory that every user receive a call reference number and a platform to retrieve both the full, unedited audio and a fully unedited text transcript of the recording. This recording and transcript must exist for a minimum of 6 months to 5 years (based on the nature of the business)

So, before we continue to do business, a customer must first validate a business since they initiated the call, the same way business validates their customer when the customer initiate the call, and vice versa. This is the same as when businesses apply a 2 factor authentication mechanism on their IT systems.
After the business has been concluded (in favour, or otherwise), both parties should have access to the recordings, for their security and protection purposes.

Then, this should be added under some form of regulation, maybe an addendum to POPIA? 🤷🏾‍♂️

I believe that adding an additional layer of security on telecommunications will not only frustrate potential scammers but ensure people have peace of mind to protect consumers from potential scam attacks or telemarketing.

If you’re reached this far, let me know what you think. Will this work? What adjustments or modification would you make to my proposed solution?

Finally, if you receive a phone call from an unknow/unrecognised number, do not start with a “hello”. Some automated calls are now AI powered and are triggered to respond to the word “hello”. Also, some AI powered calls are programmed to just listen to your voice so that it can be used by nefarious actors to clone your voice and use it for nefarious purposes.
Only respond when someone on the other side of the call speaks first and you can, somehow, determine that it’s not an AI communicating to you. that way, you are dodging some bullet frombeing a victim in some form.

Let’s hope that government’s solution will make all this issue go away.