This SIM swap crap is so stupid. How is SIM second factor authentication if you can reset your password with just your phone number? Why can't phones be yubikeys, or just allow only software OTP?
If you lose your SIM card and don’t have the hardware key you need to go to your bank and identify yourself with a valid ID.
Using regular old SMS as 2FA these days seem highly irresponsible for a company. Regular people might not know better.
This article itself is journalistic malpractice. The crime is fraud, not theft. Optus is not the party responsible for making this right, the banks that improperly debited his accounts are. By failing to explain the actual legal situation and directing focus towards a minor party, this article will cause other victims to fail at pressing the matter with their banks within the time windows for disputing fraudulent transactions.
And what really are the telcos supposed to do here? Banks are attempting to use them to provide security properties they never offered, and most likely can't offer due to their group-project technical architecture. Even if telcos completely secure the SIM reissuing process, then criminal gangs just buy someone who has access to a phone switch.
Banks could very well just not implement snake oil "2FA". For example, they could ship each customer a hardware security token, and require password resets be done in person at a branch. Or they can just keep shouldering the current level of fraud as they seem perfectly content to do. The entire problem has been created by the banks, and this narrative attempting to shift blame onto telcos is counterproductive.