An MQM member of the National Assembly, Farhan Chishti, discovered that his mobile phone had stopped working when he landed at Islamabad airport on January 12. He could not make calls or receive messages, and the problem did not clear for many hours. When he visited a service centre of his cellular company, staff told him that a duplicate SIM he had never requested had been issued against his number, which cut off his original connection.
The case has since become a broader story about how criminals used stolen identity data and insiders to empty bank accounts. Another MNA, Shaharyar Mahar, lost Rs2 million in a separate episode, and a Karachi businessman, Sunny Kumar, also became a victim.
How a duplicate SIM emptied Chishti’s account
Staff told Chishti the replacement SIM had been issued in Karachi’s Malir area, and that only the company’s headquarters could disable it. The office was closed for the day, so the damage continued overnight. The person controlling his number had already registered him for online banking, a service he had never used, and then raised his withdrawal limit.
That person set the password “Saeen Sarkar” and transferred Rs1.5 million from Chishti’s account. Part of the money went to the account of Sakina Bibi, who was herself a victim whose account had been opened without her knowledge. Other funds moved to accounts opened in the names of women in South Punjab and Sindh. Chishti filed a complaint with the National Cyber Crime Investigation Agency (NCCIA).
Investigators questioned the owner of the point of sale in Khokhrapar, Malir. He said a man had come to him claiming that his mother needed a duplicate SIM but was too weak to leave the car, and asked to use the biometric device to take her thumbprint there. Investigators have not explained how the suspect obtained Chishti’s thumbprint. The man who used the duplicate SIM was identified as being from Nawabshah. Investigators believe criminals gather biometric data in bulk from leaked records or from places where fingerprints are not required for routine services, then load it into software to misuse it.
PTA fine and the telecom company’s defence
The case was taken to the Pakistan Telecommunication Authority (PTA), which fined the cellular company Rs77.8 million. The company argued that a third party had deceived the retailer. The regulator rejected that argument, citing Regulation 4(4) of the Subscribers Regulations, which holds the operator solely responsible for any SIM sold by any means.
The PTA said the company had failed in its monitoring duties and that its later remedial steps did not undo the original lapse. It also noted that similar violations keep appearing despite repeated instructions to operators.
Bank insider and wider pattern of fraud
Sunny Kumar’s case followed a similar route. A duplicate SIM was issued in his name on September 29, 2025, at a retail outlet in Dhabeji, Thatta, and as much as Rs8.5 million was taken from his account. Kumar and Chishti are customers of the same cellular company. The investigation found that a branch service officer at a bank in Mardan had viewed Kumar’s account before the SIM was issued.
The same officer had accessed around 30 accounts, after which funds were withdrawn or restrictions were applied, with suspected fraud of about Rs25 million. He first said he was helping a friend with a balance inquiry, but later admitted sharing customers’ details with that friend, saying he had been under pressure. Phone records also showed him seeking customer data from an employee of another bank and offering payment to a Nadra employee, who later refused to provide the information.
A PTA order in Kumar’s case imposed the same Rs77.8 million fine, and Kumar recovered his money from the bank. A source familiar with the details said a similar pattern, including the involvement of bank insiders, was seen in the other two cases. However, the investigation did not proceed there because the complainants were focused only on recovering their stolen funds.
Such incidents have also been reported in other provinces. While the telecom company was penalised in both cases, the only action against the banks was an order to return the victims’ money.
