Biometric SIM fraud drains millions from two Pakistani lawmakers

ISLAMABAD: A biometric fraud scheme involving unauthorised replacement SIMs allegedly enabled criminals to take millions of rupees from the bank accounts of two Pakistani lawmakers and a Karachi businessman. The cases reveal how control of a victim’s mobile number can be used to activate digital banking and authorise financial transactions.

MQM-P lawmaker Farhan Chishti discovered the fraud after his phone abruptly stopped working when he arrived at Islamabad airport on January 12. A cellular service centre informed him that someone had obtained a duplicate SIM against his number from a retail outlet in Karachi’s Malir area, automatically disabling his genuine connection.

During the disruption, the person controlling Chishti’s number reportedly registered him for online banking, increased the account’s withdrawal limit and transferred Rs1.5 million. Some of the money was routed through accounts opened in the names of people who were themselves believed to be victims of identity misuse.

Chishti took the matter to the National Cyber Crime Investigation Agency. Investigators questioned the retailer responsible for issuing the replacement SIM, but the central question of how the perpetrators obtained or reproduced the lawmaker’s fingerprint remained unresolved. Investigators suspect criminals may collect biometric records from leaked databases or services where fingerprints are taken unnecessarily.

The Pakistan Telecommunication Authority subsequently imposed a Rs77.8 million fine on the cellular operator. The company argued that its retailer had been deceived by a third party, but the regulator rejected that defence and held the operator responsible for SIMs distributed through its sales network. The authority also cited inadequate monitoring and recurring violations despite earlier directions.

A second lawmaker, Shaharyar Mahar, reportedly lost Rs2 million in another incident. Karachi businessman Sunny Kumar lost Rs8.5 million after a duplicate SIM was issued against his identity from an outlet in Dhabeji, Thatta, in September 2025. The telecom operator was also fined Rs77.8 million in Kumar’s case, while his bank returned the stolen money.

The inquiry into Kumar’s case uncovered suspected assistance from inside the banking system. A branch service officer in Mardan had accessed his account before the duplicate SIM was activated and had viewed about 30 other accounts that were later subjected to withdrawals or restrictions. Investigators estimated the suspected fraud connected with those accounts at approximately Rs25 million.

Official cybercrime guidance identifies the collection of fingerprints under false pretences and the distribution of improperly verified SIMs as serious risks. It states that providing a SIM without the required subscriber verification is an offence under Section 17 of the Prevention of Electronic Crimes Act, carrying possible imprisonment, a fine or both.

The cases expose weaknesses spanning biometric verification, telecom retail networks and banking controls. They also show that a suddenly inactive phone number can be an early warning of SIM takeover rather than an ordinary network fault, making immediate contact with both the mobile operator and bank critical to limiting financial loss.