On January 12, when Farhan Chishti landed at Islamabad airport in the afternoon, the MQM MNA's phone was dead. He could neither call nor receive a message.
He thought there might be a network failure, but when it did not restore for many hours, he went to a service centre of the cellular company to report the problem. There he learnt that a duplicate SIM, which he had never requested, had been issued against his number, disabling his original connection.
Staff told him it had been issued in Karachi's Malir area. Disabling it was possible only from the company's headquarters, which was closed for the day and would reopen in the morning, he was told.
By then, the damage was already underway. The person holding his number had registered Chishti for online banking, although he had never used electronic channels.
The same person raised his withdrawal limit, set the password 'Saeen Sarkar', and moved Rs1.5 million out of his account to that of one Sakina Bibi, herself a victim whose account had been opened without her knowledge, and to other accounts opened in the names of women in South Punjab and Sindh.
Chishti complained to the National Cyber Crime Investigation Agency (NCCIA). Investigators questioned the owner of the point of sale in Khokhrapar (Malir), who said a man had approached him claiming his mother, who needed a duplicate SIM, was too weak to leave the car, and asked for the biometric device to take her thumbprint there.
How Chishti's thumbprint was obtained remains unexplained. The man who used the duplicate SIM was from Nawabshah.
Investigators believe bad actors harvest biometrics in bulk from leaked data or from places where fingerprints are not mandatory for routine services, then load them onto software and misuse them. The case went to the Pakistan Telecommunication Authority (PTA), which fined the cellular company Rs77.8 million.
The company argued that a third party had deceived the retailer. The PTA rejected this, citing Regulation 4(4) of the Subscribers Regulations, under which any SIM sold by any means is the operator's sole responsibility.
It found failures in monitoring, said the company's later remedial steps did not cure the initial lapse, and noted that similar violations keep surfacing despite repeated instructions. Chishti is not alone.
Another MNA, Shaharyar Mahar, lost Rs2 million in another episode. Karachi businessman Sunny Kumar also fell victim.
A duplicate SIM was issued in his name on September 29, 2025, at a retail outlet in Dhabeji, Thatta. Incidentally, Kumar and Chishti are customers of the same cellular company.
As much as Rs8.5 million was taken from Kumar's account. The investigation into the case revealed an insider at the bank.
A branch service officer in Mardan had viewed Kumar's account before the SIM was issued. The same officer had accessed around 30 accounts, after which funds were withdrawn or restrictions applied, with suspected fraud of about Rs25 million.
He first said he was helping a friend with a balance inquiry, then admitted sharing customers' details with that friend, saying he was under pressure. Phone records showed him also seeking customer data from an employee of another bank, and offering payment to a Nadra employee, who later refused to provide the information.
A PTA order in this case imposed the same Rs77.8 million fine in Kumar's case. Kumar recovered his money from the bank.
Security experts have repeatedly warned about the vulnerabilities in the digital onboarding process and the illegal issuance of duplicate subscriber identity module cards through compromised biometric systems. The authorities are now stepping up audits of retail franchises and agent networks across the country to curb identity theft.
Financial institutions have also been urged to implement stricter anomaly detection algorithms to flag unusual account modifications, immediate limit increases, and unauthorized online banking registrations before fraudulent transfers can be executed successfully.