Telecom Data Privacy at Risk from Fraudulent Third Parties

A serious concern was raised in the National Assembly on Tuesday regarding fraudulent elements posing as third-party service providers, allegedly operating in collaboration with cellular mobile operators, and leaking citizens’ personal and financial data for fraudulent purposes.

The matter was brought forward by Member National Assembly (MNA) Syed Rafiullah, who asked whether the Ministry in charge of the Cabinet Division and the Pakistan Telecommunication Authority (PTA) had taken notice of these alarming practices. He specifically highlighted the risks of citizens’ sensitive information, including financial credentials, being misused by fraudulent operators.

Will the Minister In-charge of the Cabinet Division be pleased to state whether the Ministry and the PTA have taken notice of fraudulent elements posing as third-party service providers offering services through or in collaboration with cellular mobile operators, resulting in the leakage of citizen’s personal and sensitive data, including financial credentials, used for fraudulent purposes?

Government’s Response

In reply, the Minister In-charge of the Cabinet Division emphasized that strict safeguards already exist within Pakistan’s telecom regulatory framework to prevent unauthorized data sharing.

According to the minister, mobile operators are prohibited from disclosing customer information to any third party, including their own affiliates, unless specific legal or regulatory conditions are met. He cited Clauses 7.7.1 and 7.7.2 of the Long Distance & International (LDI) and Local Loop licenses, which outline that data can only be shared for:

• Debt recovery

• Service provisioning between operators (with confidentiality)

• Auditing requirements

• Crime prevention or legal obligations

• With explicit customer consent after disclosure of purpose, recipients, and nature of information.

The minister also pointed to Regulation 16 of the Telecom Consumers Protection Regulations, 2009, and Clause 10.1 of the Third Party Service Provider License, both of which mandate data confidentiality and consumer protection against fraud.

He stressed that no operator can legally share personal data with third parties unless it falls under permitted exceptions or customers have provided clear, informed consent.

PTA’s Measures Against Fraud

The minister detailed steps taken by PTA to curb fraudulent communication, including:

1. Public Awareness Campaigns – Dissemination of over 1.065 billion SMS alerts warning consumers about fraudulent calls and messages.

2. Awareness Ringback Tones – Special tones from the State Bank of Pakistan (SBP) and the Securities and Exchange Commission of Pakistan (SECP) activated on subscribers’ phones to warn against scams.

3. Blocking Fraudulent Numbers – Masked UAN numbers misused by third parties, especially those linked to financial scams, were blocked at international gateways.

4. Complaint Management System (CMS) – PTA’s online platform allows consumers to report fraudulent activity directly and efficiently.

The minister further highlighted Clause 7.8.1 of the LDI and Local Loop licenses, which obligates operators to trace and block the source of fraudulent, harassing, or unlawful communications, including suspending or terminating such services.

The parliamentary debate highlights the growing concerns over the safety of citizens’ personal and financial data in Pakistan’s digital ecosystem. With the rise in mobile banking, e-commerce, and digital payments, vulnerabilities in data handling could leave millions of users exposed to scams and identity theft.

While PTA has taken visible steps through awareness campaigns and blocking fraudulent numbers, critics argue that data protection laws remain weak and enforcement inconsistent. Pakistan still lacks a fully functional data protection authority, despite repeated commitments to safeguard digital privacy.

The issue raised in parliament also highlights the urgent need for stricter oversight of third-party service providers who often operate under the radar, exploiting loopholes in collaboration with telecom operators.

Looking Ahead

Cybersecurity experts say that without robust enforcement, fraudsters could continue exploiting citizens’ trust in mobile operators and financial institutions.

The debate in parliament is likely to spark calls for:

• A comprehensive data protection law with stronger enforcement mechanisms.

• Greater accountability from telecom operators in monitoring third-party collaborations.

• Independent audits of telecom operators’ data handling practices.

• Stronger penalties for fraudulent service providers misusing consumer information.

As Pakistan pushes toward greater digitalization, the government will face mounting pressure to ensure that citizens’ sensitive data, especially financial credentials, remains protected from misuse.

ALSO READ: Pakistan’s NCERT Warns of Alarming Rise in Data Breaches, Orders Urgent Protection of Citizens’ Information