18.2 Million Fake SIMs Blocked as Pakistan Confronts Biometric Data Leaks

A single fraud suspect walked into a PTA SIM fraud crackdown raid in Multan carrying 195 active SIM cards, 16 mobile phones, and 81 bank ATM cards. That detail, shared with the National Assembly’s Standing Committee on Interior and Narcotics Control this week, sums up the scale of a problem lawmakers say has outgrown Pakistan’s telecom oversight.

The committee, chaired by Raja Khurram Shahzad Nawaz, met at Parliament House to review cyber fraud, illegal SIM issuance, and the misuse of citizens’ biometric data. Briefings came from the National Cyber Crime Investigation Agency (NCCIA), the Pakistan Telecommunication Authority (PTA), cellular operators, and bank representatives.

What emerged was not a one-off scam but a supply chain: stolen fingerprints feed fraudulent SIMs, fraudulent SIMs feed fake bank accounts, and fake accounts move stolen money faster than victims can report it.

A Single Raid, 195 SIMs, and 81 ATM Cards

NCCIA Director Irfanullah Khan told the committee that gaps in the current verification system are driving the surge in crime. Citing the Multan operation, he said investigators recovered 195 active SIMs and 81 ATM cards that scammers were actively using to move funds.

The accused reportedly withdrew roughly Rs3.3 million from a woman’s bank account before being arrested. Sixteen mobile phones were also seized from his possession, according to details of the case shared during the session.

Committee members asked the obvious question: how does one individual end up holding nearly 200 active SIM connections registered in his name or in the names of people who never applied for them? PTA and telecom operators were pressed to explain.

18.2 Million Fake SIMs Blocked, Rs4.2 Billion in Fines

PTA Chairman Major General (retd) Hafeezur Rehman told the panel that the authority has blocked 18.2 million SIMs over the past two-and-a-half years, all of them issued fraudulently in other people’s names. Telecom operators have collectively been fined Rs4.2 billion for regulatory violations tied to the issue.

He acknowledged that the biometric verification system built to secure SIM issuance is being routinely bypassed. Franchise-level activation, once loosely regulated, has since been brought under tighter requirements, and PTA has restricted biometric verification machines to operate only within a 10-metre radius of their registered locations.

Separately, PTA said it has carried out 125 joint raids with the NCCIA over the past year and a half, recovering roughly 25,000 SIMs and leading to 171 arrests.

The chairman proposed that SIM issuance be routed exclusively through NADRA’s Pak ID system going forward, cutting franchises out of the verification chain entirely. A State Bank of Pakistan official separately recommended restricting each SIM to a single device IMEI, making it harder to swap fraudulent connections between phones.

Biometric Data Leaking From the Inside

The more uncomfortable admission came when the PTA chief conceded that biometric records have been leaking from the very facilities meant to secure them. The NCCIA has recovered biometric data belonging to roughly 600,000 people during its raids so far, fingerprints, and verification records that should never have left government custody.

Talal Chaudhry, Minister of State for Interior, said employees at telecom companies and other institutions with access to citizens’ data are among those implicated, feeding personal information to fraud networks for a price. He called for tighter security controls around where and how biometric data is stored.

This is not a peripheral issue. Biometric verification underpins NADRA’s identity system, SIM registration, airport security, prison records, and Islamabad’s now-paperless driving license process. A leak at any single point compromises trust in all of them.

The ‘Rent-a-Bank-Account’ Racket

Chaudhry also disclosed that a “rent-a-bank-account” business is operating in parts of Pakistan, where account holders knowingly let fraudsters use accounts opened in their own names for a cut of the proceeds. Officials described this alongside so-called mule accounts as one of the harder problems to police, since the account holder is often a willing participant rather than a victim.

The committee flagged unauthorized withdrawals and the slow pace of freezing or recovering fraudulently moved funds as a related weak point, one that leaves banks reacting after money has already left the system.

What the Committee Wants Fixed

Beyond the disclosures, the committee issued concrete directions. It wants PTA to move toward facial and iris recognition for SIM verification, instant customer alerts whenever a new SIM is issued in their name, and closer coordination between PTA, NADRA, banks, law enforcement, and cellular operators.

Interior Secretary Ahmad Raza Sarwar was directed to convene all stakeholders, PTA, NCCIA, State Bank of Pakistan, and telecom operators, to chart a joint response and report back to the panel. The committee also called for public awareness campaigns around illegal foreign SIMs and asked that social media platforms be monitored for their promotion.

The Bigger Picture

Pakistan has run SIM re-verification drives before, most notably the 2015 exercise tied to the National Action Plan. What this session makes clear is that biometric enrolment alone was never the fix regulators treated it as; it simply moved the vulnerability from SIM registration desks to the databases storing the fingerprints themselves.

The next test isn’t whether PTA can block more fraudulent SIMs after the fact; 18.2 million blocked connections show it can. It’s whether the government can close the insider leak that keeps refilling the fraud pipeline in the first place. Until biometric data stops leaking from official custody, blocking SIMs will remain a cleanup operation rather than a cure.