Duplicate SIM Fraud Exposes Banking Security Risks as PTA Fines Telecom Company Over Rs1.55 Billion

ISLAMABAD: A major fraud involving the alleged misuse of duplicate mobile phone SIMs and biometric data has exposed vulnerabilities in Pakistan’s banking and telecommunications systems, with millions of rupees stolen from the accounts of two members of the National Assembly and a Karachi-based businessman.

According to an investigative report by Geo News journalist Umar Cheema, fraudsters allegedly obtained duplicate SIM cards in the victims’ names, deactivated their original SIMs and used access to online banking services to transfer funds to other accounts. Investigations into one case also revealed that a bank employee had shared customers’ confidential information with another person.

The Pakistan Telecommunication Authority (PTA) has imposed separate fines of Rs77.8 million on the telecom operator involved in two cases, bringing the total penalty to Rs155.6 million.

MNA loses Rs1.5 million after mobile service is disconnected

According to the report, Muttahida Qaumi Movement (MQM) MNA Farhan Chishti arrived at Islamabad Airport on January 12 and discovered that his mobile phone had no network service.

After the service remained unavailable for several hours, he contacted the relevant telecom company’s service centre. He was informed that a duplicate SIM had been issued against his number in Karachi’s Malir area, despite his claim that he had not requested one.

During this period, the person using the duplicate SIM allegedly activated online banking facilities on Chishti’s bank account, increased the transaction limit and transferred a total of Rs1.5 million to other accounts.

One of the receiving accounts belonged to a woman identified as Sakina Bibi. The report said she was also a victim, as an account had allegedly been opened in her name without her knowledge.

Chishti subsequently lodged a complaint with the National Cyber Crime Investigation Agency (NCCIA).

Questions raised over biometric verification

During the investigation, authorities questioned a SIM retailer in Karachi’s Khokhrapar area.

According to the retailer, a man had approached him seeking a duplicate SIM for his mother, claiming that she was too weak to leave a vehicle. He reportedly asked the retailer to bring the biometric verification device to the car.

However, investigators have yet to establish how Chishti’s fingerprint was obtained or used in the process.

The report said investigators suspect that fraudsters may be exploiting leaked personal information or gaining access to biometric records collected at different locations.

موبائل فون نیٹ ورک اچانک بند ، اور بینک اکاؤنٹ سے لاکھوں روپے غائب! ڈوپلیکیٹ سم اور بائیومیٹرک فراڈ کے ذریعے دو اراکین قومی اسمبلی سمیت متعدد افراد کو نشانہ بنایا گیا۔ بینک کے ملازم کا ڈیٹا شیئر کرنے کا اعتراف ۔شہریوں کا پیسہ کتنا محفوظ ہے؟تفصیلات دیکھیے https://t.co/RLpqQE3Rhd

— Shahzeb Khanzada (@shazbkhanzdaGEO) October 19, 2026

Another MNA loses Rs2 million, businessman loses Rs8.5 million

In a separate incident of a similar nature, MNA Shehryar Mahar reportedly lost Rs2 million from his bank account.

Karachi-based businessman Sunny Kumar was also targeted. According to the report, a duplicate SIM was issued in his name from Dhabeji, Thatta, on September 29, 2025, after which Rs8.5 million was withdrawn from his bank account.

Farhan Chishti and Sunny Kumar were customers of the same telecom operator.

Bank employee admits sharing customer information

The investigation into Kumar’s case uncovered the alleged involvement of an employee at a bank branch in Mardan.

According to the report, the employee had accessed Kumar’s account information before the duplicate SIM was issued. He had also accessed information relating to approximately 30 other bank accounts, with suspicious financial activity involving around Rs25 million identified in connection with those accounts.

The employee initially claimed that he had checked an account balance at the request of a friend. However, he later admitted sharing customers’ information with that friend, saying he had acted under pressure.

Phone records reportedly showed that the employee had also attempted to obtain customer data from an employee of another bank. In addition, an employee of the National Database and Registration Authority (NADRA) was allegedly offered money in exchange for providing information, but refused the offer.

PTA imposes penalties exceeding Rs155 million

The PTA imposed separate fines of Rs77.8 million on the telecom operator in the cases involving Chishti and Kumar. The combined penalties amount to Rs155.6 million.

The telecom company argued that its retailer had been deceived by a third party. However, the PTA rejected the explanation, maintaining that the operator was responsible for the SIM issued through its network.

The report said Kumar recovered his money from the bank, while action against the banks was limited to orders concerning the return of funds.

Citing an informed source, the report further stated that possible involvement of bank insiders had been suspected in two other cases. However, further investigations did not proceed after the victims prioritised recovering their money.

The incidents have raised concerns over the security of mobile-based banking, the integrity of biometric verification and the protection of customers’ confidential financial information. They also highlight the risks posed when access to mobile numbers and banking data is allegedly exploited to bypass security controls.