The communications watchdog found Telstra failed to authenticate customer IDs during 168,000 high-risk interactions such as password resets or SIM card swaps.