ISLAMABAD: A series of fraud cases involving duplicate SIM cards has exposed serious gaps in Pakistan’s telecom and banking security systems, with victims losing millions of rupees through unauthorised access to their mobile numbers and bank accounts.
One case involved Muttahida Qaumi Movement (MQM) MNA Farhan Chishti, whose mobile connection stopped working after a duplicate SIM was issued against his number without his knowledge.
How the Fraud Against Farhan Chishti Unfolded
On January 12, Chishti landed at Islamabad airport in the afternoon and found that his phone was not working. He could neither make calls nor receive messages.
Initially, he suspected a network problem. However, when the connection remained inactive for several hours, he visited the cellular company’s service centre to report the issue.
There, he discovered that someone had obtained a duplicate SIM against his number, disabling his original connection. Staff told him the replacement SIM had been issued in Karachi’s Malir area.
They also informed him that only the company’s headquarters could deactivate the duplicate SIM. However, the office had closed for the day and would reopen the following morning.
By that time, the fraud had already taken place.
The person using the duplicate SIM had registered Chishti for online banking, although he had never used electronic banking services. The fraudster then increased his withdrawal limit, set the password “Saeen Sarkar” and transferred Rs1.5 million from his account.
The money went to an account belonging to Sakina Bibi and other accounts held in the names of women in South Punjab and Sindh. Sakina Bibi was also a victim whose bank account had reportedly been opened without her knowledge.
Investigators Trace the Duplicate SIM
Chishti lodged a complaint with the National Cyber Crime Investigation Agency (NCCIA).
Investigators questioned the owner of a point-of-sale outlet in Khokhrapar, Malir. The retailer said a man had approached him, claiming that his mother needed a duplicate SIM but was too weak to leave the car.
The man allegedly asked to use the biometric device outside the vehicle to capture her thumbprint.
However, investigators have yet to establish how the fraudsters obtained Chishti’s fingerprint. The individual who used the duplicate SIM was reportedly from Nawabshah.
Investigators suspect that fraudsters collect biometric data in bulk from leaked databases or locations where fingerprints are not routinely required for services. They believe criminals may then load the data into software and misuse it to bypass identity verification systems.
PTA Imposes Rs77.8 Million Fine
The case was referred to the Pakistan Telecommunication Authority (PTA), which imposed a fine of Rs77.8 million on the cellular company.
The company argued that a third party had deceived the retailer into issuing the duplicate SIM. However, the PTA rejected this defence.
The regulator cited Regulation 4(4) of the Subscribers Regulations, which makes telecom operators responsible for SIMs issued through their services, regardless of the method of sale.
The PTA found shortcomings in the company’s monitoring system. It also ruled that remedial measures taken after the incident did not erase the original violation.
The authority further noted that similar violations continued to emerge despite repeated instructions to prevent them.
Other Victims Lose Millions
Chishti was not the only public figure affected by this type of fraud. Another MNA, Shaharyar Mahar, reportedly lost Rs2 million in a separate incident.
Karachi businessman Sunny Kumar also fell victim to a similar scheme. On September 29, 2025, someone obtained a duplicate SIM in his name from a retail outlet in Dhabeji, Thatta.
Kumar and Chishti were both customers of the same cellular company. In Kumar’s case, fraudsters withdrew as much as Rs8.5 million from his bank account.
The investigation uncovered the suspected involvement of a bank employee.
A branch service officer in Mardan had accessed Kumar’s account before the duplicate SIM was issued. Investigators also found that the officer had accessed around 30 other accounts. Subsequent activity in those accounts included withdrawals or the imposition of restrictions, with suspected fraud totalling about Rs25 million.
Initially, the officer claimed he had checked a balance on behalf of a friend. He later admitted sharing customers’ information with that person, saying he had been under pressure.
Phone records also showed the officer seeking customer information from an employee of another bank. He allegedly offered payment to a National Database and Registration Authority (NADRA) employee, who later refused to provide the information.
Different Consequences for Telecom and Banking Sectors
The PTA imposed another Rs77.8 million fine in connection with Kumar’s case. Kumar, meanwhile, recovered his money from the bank.
A source familiar with the cases said investigators had observed a similar pattern, including suspected involvement by bank insiders, in the incidents involving the two lawmakers.
However, the investigations did not progress further because the complainants were primarily interested in recovering their stolen funds, the source said.
The problem is not confined to these three incidents. Similar cases have also been reported in other provinces.
Although the telecom company faced financial penalties in both cases, the action against the banks was limited to orders requiring them to return the victims’ money.
The cases highlight concerns about SIM issuance procedures, the protection of biometric information and the handling of confidential banking data. They also raise questions about whether existing safeguards adequately prevent telecom and banking insiders from enabling financial fraud.
