Every active cellphone number can be traced back to the person or persona (if not an actual person) to whom the SIM card was registered. Every SIM card that is in use on our mobile networks must be registered in terms of the RICA Act or it would not be able to make use of the cellular network at all (except to call 112 emergency services and possibly the network operator's customer care number). "Illegal SIM cards", or ones that are not registered to anyone at all, are a fallacy. They cannot be used on our networks. All SIM cards will be registered to someone. That isn't to say that all SIM cards are registered using the bona fides of the person that is actually using that SIM card. "Already registered" SIM cards can be borrowed, stolen, found or otherwise obtained from people that we have access to; or they can be bought for less then R100 from many street vendors and cell phone shops. Times are tough and strangers could even be approached with a reasonable cash offer to either sell their SIM card or to register one in their name. Then there's the RICA terminals themselves and the people who have access to them. I've registered a number of SIM cards and on a few occasions I wasn't even asked for documentation - I was simply asked for my name, ID number and address - all of which I gave verbally despite having had the required documents with me. Criminals would probably make approaches to people with access to those terminals and could have SIM cards registered using bogus or stolen identities that would be virtually (but not entirely) untraceable. You can check phone number ownership using various databases here: https://www.intertel.co.za/trace - the price is between R100 and R350 depending on the source, and you'd get at least the person's name, an identifier (like passport number, date of birth or ID number) and an address. If that info turns out to be outdated or false then one could look at tracking the location of the number or linking other handsets, SIM cards and numbers with the one in question to find a point of entry for an investigation. There's much that can be done, but tracing ownership is the first (and cheapest) step.

That's a very comprehensive answer. Nice.