White Paper · Regulatory Guidance
Ghost Subscribers, and the limits of operator-level dedup.
Why a subscriber blocked at one operator can register cleanly at the next, what biometric 1:N deduplication actually does about it at national scale, and what a regulator should put in a tender.
In short
A ghost subscriber is an active subscription with no accountable person behind it. Operators cannot eliminate them alone, because an operator can only search its own subscriber base — a person blocked at one network simply registers at the next. Biometric 1:N deduplication closes that gap only when it runs above the operator layer, at a national registry.
Ghost subscribers are usually discussed as a security problem. They are more accurately an accountability problem: the subscription works exactly as intended, and what is missing is the ability to attribute it to someone. That distinction matters, because it determines where the control has to sit. A control that lives inside one operator cannot answer a question that spans all of them.
This paper sets out where the gap comes from, what biometric deduplication does and does not solve, the reconciliation problem created by offline enrolment, and the specific commitments worth writing into a tender. It is written for regulators and operator compliance teams, and it assumes no prior biometrics background.
What a ghost subscriber actually is
A ghost subscriber is an active mobile subscription that cannot be attributed to a real, verified person. The SIM is provisioned, the subscription bills, the traffic flows — the registration record behind it simply does not correspond to anyone who can be held responsible for how the line is used.
Most are not the product of sophisticated attacks. They are the product of ordinary process failures at scale, and they arrive by four main routes:
Registration under a fabricated identity
A SIM registered against an identity document that was never issued, or that belongs to nobody. Where document checks are visual rather than cryptographic, a plausible forgery passes.
Registration under a borrowed identity
A real, valid identity used without the holder’s knowledge — often harvested in bulk from photocopied documents collected for an unrelated purpose.
Bulk pre-registration by agents
SIMs activated in volume against a small pool of real identities to meet sales targets, then sold on already registered. Commission structures, not criminal intent, usually drive this one.
Re-registration after a block
A subscriber barred by one operator simply registers again — at another operator, or at the same one under a different identity. Without a check above the operator layer, nothing stops them.
The fourth route is the one that matters most. The first three can be attacked with better verification at the point of sale. The fourth — re-registration after a block — is immune to better verification, because each individual registration is entirely legitimate on its own terms. Only a check that spans operators can see it.
Why operator-level deduplication cannot close the gap
Every serious operator already deduplicates. The limitation is not diligence or technology — it is scope. An operator’s deduplication check runs against an operator’s database, so it answers a narrower question than the one the regulator is actually asking.
This is why a national registry is a different architecture, not a bigger one. The change is not scale; it is where the check sits relative to the commercial boundary.
| Dimension | Operator-level dedup | National registry dedup |
|---|---|---|
| Question it can answer | “Has this person registered with us before?” | “Has this person registered anywhere in the country before?” |
| Blind spot | Every subscriber of every other operator | Subscribers of operators not yet integrated |
| Response to a block | Subscriber moves to another operator and re-registers | Subscriber is recognised at the next attempt, whoever they approach |
| Who holds the biometric | Each operator, in its own silo, under its own policy | The registry, under a single published policy and audit regime |
| Commercial incentive | Registration volume is a growth metric — dedup reduces it | Registry is not measured on subscriber growth |
The last row is the one most often left out of technical evaluations, and it is arguably the decisive one. Registration volume is a growth metric for an operator and a risk metric for a regulator. Asking the party measured on growth to enforce the control that suppresses it is a governance design problem, not a software one.
How biometric deduplication works — and where it strains
Biometric deduplication runs a 1:N search: one captured biometric compared against every identity already enrolled. This is a different operation from the 1:1 check that confirms a selfie matches the photo in a presented document. A complete registration usually runs both — 1:1 to verify the document, 1:N to detect duplication.
Five stages, each with a failure mode worth specifying against:
01
Capture
A face, fingerprints, or both, taken at the point of registration.
Capture quality sets the ceiling for everything downstream. Quality gating at the point of capture is cheaper than adjudicating bad matches later.
02
Template extraction
The image is converted to a mathematical template. Standards such as ISO/IEC 19794 govern the record format.
Templates from different vendors are not interchangeable. Specify the interchange format if you ever intend to change supplier.
03
Search
The template is compared against every enrolled identity in the registry — a 1:N search, as distinct from the 1:1 check that confirms a selfie matches a document.
Search cost grows with the database. Response-time obligations should be written against the registry at full projected size, not at go-live.
04
Candidate list
The engine returns ranked candidates above a configured threshold, not a yes or no.
At national scale even a very low false-match rate produces real collisions. A threshold is a policy decision about the balance of risk, not a technical default.
05
Adjudication
A trained examiner resolves candidates the system cannot resolve alone.
Adjudication capacity is the constraint that sinks deployments. Model the expected referral rate and staff for it before go-live.
Independent benchmarking — NIST FRVT being the reference programme for face recognition — establishes how an algorithm performs under controlled test conditions. It is a floor, not a guarantee: production accuracy also depends on capture quality, the demographic composition of the enrolled population, and the operating threshold chosen. Treat a benchmark result as evidence that an algorithm is credible, not as a prediction of what your registry will experience.
The offline reconciliation window
Field enrolment in low-connectivity areas is the norm across much of the world, not the exception. Capture works offline without difficulty. Deduplication does not — a 1:N search needs the whole registry, which is server-side by definition.
This produces a gap that is rarely written down: an offline enrolment is deduplicated later than it is captured. Between those two moments the subscriber may already be active. That is not a flaw to be engineered away — it is a structural consequence of doing registration where the network is not — but it is a window that has to be governed rather than ignored.
How long may it stay open?
Set a maximum interval between capture and completed deduplication, and require reporting against it. An unbounded window is an unbounded exposure.
What service applies meanwhile?
Decide whether the subscriber receives full service, restricted service, or none until the check clears. This is a policy trade-off between fraud exposure and access, and it belongs to the regulator.
What happens on a late hit?
Define the remediation path when a duplicate surfaces after activation — who is notified, what evidence is preserved, how the subscriber appeals, and on what timeline the line is suspended.
A programme that specifies this window explicitly will outperform one that assumes real-time deduplication and quietly discovers otherwise during rollout.
What to specify in a tender
Deduplication programmes rarely fail on algorithm accuracy. They fail on the commitments nobody wrote down — adjudication staffing, threshold governance, the offline window, and the date by which the last operator is integrated. These six are written to be lifted into a requirements document.
State the matching threshold as policy, not a setting
Require the supplier to state false-match and false-non-match rates at the operating threshold, measured at the registry’s projected full size. Require that changing the threshold is a governed action with an audit record.
Size the adjudication workload
Require a projected referral volume at expected registration rates, and agree who staffs adjudication, to what turnaround, and what the subscriber experiences while a case is open.
Define the offline reconciliation window
Require a stated maximum interval between an offline enrolment and its deduplication check, what provisional service the subscriber receives in the meantime, and the remediation path when a duplicate is confirmed after activation.
Require multi-operator coverage from day one
A registry integrated with some operators leaves an open door at the others. Specify the integration sequence, the interim controls, and the date by which coverage is complete.
Separate presentation-attack detection from matching
Matching answers whether two biometrics belong to the same person. It does not answer whether the sample was live. Specify liveness detection against ISO/IEC 30107-3 as a distinct requirement with its own acceptance criteria.
Specify the audit trail before the accuracy target
Every match, threshold change, adjudication decision and override should be attributable and immutable. A registry that cannot explain a decision cannot defend one.
Frequently asked questions
What is a ghost subscriber?
Why can’t operators solve this individually?
What is the difference between 1:1 and 1:N in SIM registration?
Does biometric deduplication replace identity document checks?
Can deduplication work when field agents have no connectivity?
How accurate is biometric deduplication at national scale?
What should a regulator specify in a deduplication tender?
Further reading
Planning a registry?
We have built this in 15+ countries.
Axon has delivered SIM registration and subscriber identity infrastructure for regulators and tier-1 operators, with over 350M SIMs registered to date. Talk to us about deduplication design, adjudication modelling or a registry architecture review.
Talk to Our Team