Dead phone, drained account: How biometric fraud caught two MNAs

On January 12, when Farhan Chishti landed at Islamabad airport in the afternoon, the MQM MNA’s phone was dead. He could neither call nor receive a message. He thought there might be a network failure, but when it did not restore for many hours, he went to a service centre of the cellular company to report the problem.

There he learnt that a duplicate SIM, which he had never requested, had been issued against his number, disabling his original connection. Staff told him it had been issued in Karachi’s Malir area. Disabling it was possible only from the company’s headquarters, which was closed for the day and would reopen in the morning, he was told.

By then, the damage was already underway. The person holding his number had registered Chishti for online banking, although he had never used electronic channels. The same person raised his withdrawal limit, set the password “Saeen Sarkar,” and moved Rs1.5 million out of his account to that of one Sakina Bibi, herself a victim whose account had been opened without her knowledge, and to other accounts opened in the names of women in South Punjab and Sindh.

Chishti complained to the National Cyber Crime Investigation Agency (NCCIA). Investigators questioned the owner of the point of sale in Khokhrapar (Malir), who said a man had approached him claiming his mother, who needed a duplicate SIM, was too weak to leave the car, and asked for the biometric device to take her thumbprint there. How they obtained Chishti’s thumbprint remains unexplained. The man who used the duplicate SIM was from Nawabshah.

Investigators believe bad actors harvest biometrics in bulk from leaked data or from places where fingerprints are not mandatory for routine services, then load them onto software and misuse them.

The case went to the Pakistan Telecommunication Authority (PTA), which fined the cellular company Rs77.8 million. The company argued that a third party had deceived the retailer. The PTA rejected this, citing Regulation 4(4) of the Subscribers Regulations, under which any SIM sold by any means is the operator’s sole responsibility. It found failures in monitoring, said the company’s later remedial steps did not cure the initial lapse, and noted that similar violations keep surfacing despite repeated instructions.

Chishti is not alone. Another MNA, Shaharyar Mahar, lost Rs2 million in another episode. Karachi businessman Sunny Kumar also fell victim. A duplicate SIM was issued in his name on September 29, 2025, at a retail outlet in Dhabeji, Thatta. Incidentally, Kumar and Chishti are customers of the same cellular company. As much as Rs8.5 million was taken from Kumar’s account.

The investigation into the case revealed an insider at the bank. A branch service officer in Mardan had viewed Kumar’s account before the SIM was issued. The same officer had accessed around 30 accounts, after which funds were withdrawn or restrictions applied, with suspected fraud of about Rs25 million. 

He first said he was helping a friend with a balance inquiry, then admitted sharing customers’ details with that friend, saying he was under pressure. Phone records showed him also seeking customer data from an employee of another bank, and offering payment to a Nadra employee, who later refused to provide the information.

A PTA order in this case imposed the same Rs77.8 million fine in Kumar’s case. Kumar recovered his money from the bank. A source privy to the details said a similar pattern, including the involvement of bank insiders, was observed in the other two cases, but the investigation did not proceed because the complainants were keen only on recovering their stolen funds. This is not limited to these three cases. Such incidents have also occurred in other provinces as well.

While the telecom company was penalised in both cases, the only action against the banks was an order to return the victims’ money.

Originally published in The News