A News investigation published today has exposed how criminals drained millions of rupees from the bank accounts of two members of the National Assembly and a Karachi businessman, using duplicate SIMs obtained with stolen or faked fingerprints. The PTA has fined the cellular operator Rs77.8 million in each of two cases, ruling every SIM sold is the operator’s sole responsibility. Below is a decode of the fraud playbook: four steps from a dead phone to a drained account, the bank insider found, and the questions still open.
Step one: the phone goes dead
On the afternoon of January 12, MQM lawmaker Farhan Chishti landed at Islamabad airport to find his phone dead. Hours later a service centre told him a duplicate SIM had been issued against his number in Karachi’s Malir area. Only the company’s headquarters could disable the duplicate, and it was closed for the day; by morning, the money was moving.
Step two: the bank account he never opened online
Controlling Chishti’s number, the criminals registered him for online banking, a channel he had never used. They raised his withdrawal limit, set the password to “Saeen Sarkar”, and moved Rs1.5 million out: part to an account in the name of one Sakina Bibi, herself a victim whose account had been opened without her knowledge, the rest to accounts in the names of women in South Punjab and Sindh. Chishti took the case to the National Cyber Crime Investigation Agency.
Step three: the fingerprint nobody can explain
The Khokhrapar, Malir point-of-sale owner told investigators a man claimed his mother was too weak to leave the car and asked to take the biometric device outside for her thumbprint. How the criminals obtained Chishti’s own thumbprint remains unexplained; the man who used the duplicate SIM was traced to Nawabshah. Investigators believe criminals harvest biometrics in bulk from leaked databases and from places where fingerprints are taken routinely, such as airports, passport offices and driving licence centres, then misuse them through software. PTA Chairman Hafeezur Rehman has confirmed fraudsters are bypassing the biometric safeguards in the identity-check system. Readers can check which numbers are issued on their identity through the legal SIM Owner Details process in Pakistan.
Step four: the insider at the bank
A duplicate SIM was issued in Karachi businessman Sunny Kumar’s name on September 29, 2025, at a Dhabeji, Thatta outlet; criminals took Rs8.5 million from his account. Kumar and Chishti used the same cellular company. Investigators found the bank insider: a Mardan branch officer had viewed Kumar’s account before the SIM was issued and accessed around 30 accounts, with suspected fraud of about Rs25 million. He first claimed he was helping a friend with a balance inquiry, then admitted sharing customer details under pressure. Phone records showed him seeking data from another bank’s employee and offering a Nadra employee payment, which was refused. A source said a similar pattern, including bank insiders, appeared in the other two cases, but the probe stalled because the complainants only wanted their money back. The report adds such incidents are not limited to these cases and have hit other provinces. A third victim, MNA Shaharyar Mahar, lost Rs2 million separately.
The regulator’s answer: Rs77.8 million per case
The PTA fined the cellular company Rs77.8 million each in the Chishti and Kumar cases, about Rs155 million combined. The company argued a third party had deceived its retailer; the regulator rejected that under Regulation 4(4) of its Subscribers Regulations, which makes any SIM sold the operator’s sole responsibility. It found monitoring failures, said later remedial steps did not cure the initial lapse, and noted similar violations keep surfacing despite repeated instructions. The banks faced no action beyond being ordered to return the victims’ money.
The scale behind the three cases
Authorities have blocked 18.2 million illegal SIMs over roughly two and a half years. Between January 2024 and August 2026, enforcement teams ran 90 raids in 40 cities, seizing 29,346 SIMs, 234 biometric devices and over 602,000 paper-based digital fingerprints, arresting 134 people. The PTA has since restricted SIM-sale devices to approved locations, upgraded live fingerprint checks against fakes made of paper, silicone and nylon, limited each device to two users, banned SIM sales between midnight and 6am, and extended the SIM disowning period from 60 to 365 days.
What the investigation leaves open
Three questions remain: how a sitting lawmaker’s thumbprint was obtained and how many ordinary prints sit in the same leaked pools; why the banks faced no penalty beyond refunds when an insider touched accounts holding tens of millions; and who else has been hit, when the report says similar incidents have hit other provinces. Until those are answered, the playbook still works.
PakMirror will keep tracking the PTA’s enforcement drive in technology news from Pakistan and national news.
