An investigation by the Australian Communications and Media Authority found Telstra did not carry out required identity verification checks in 15 unauthorised SIM card swaps.
SIM swaps occur when someone requests a replacement SIM card or eSIM from their existing telco, such as when they lose or damage their existing SIM.
Authority member Samantha Yorke said it can leave customers vulnerable to mobile number fraud often carried out by criminal syndicates if telcos don't have protective systems in place.
"In this case, Telstra's frontline staff did not follow the provider's own processes," Ms Yorke said.
"These failures exposed Telstra's customers to real harm, with customers reporting combined financial losses of at least $39,500 after falling victim to fraud."
It follows a previous investigation by the authority in 2024 into around 168,000 high-risk customer interactions which resulted in a $1.5 million fine.
The telco has also come under scrutiny following a number of high profile outages.
A report released on Wednesday into the most recent outage found Telstra did not prioritise systems that caused a major nationwide network failure and lacked the technical expertise to properly maintain them.
The July 8 incident sparked chaos with triple-zero calls and businesses affected, along with failures across train networks and electronic payment services.
Greens communications spokeswoman Sarah Hanson-Young said the government must step in and legislate basic service requirements.
"There has to be legal requirements and standards for reliability and service," she told reporters on Wednesday.
"There also must be proper protections for consumers in the form of compensation... the only thing that will force them to clean up their act is by ensuring that they are legally required to do so."
9°C