SIM Swap Fraud in Pakistan: How Scammers Steal Your Number

What is SIM swap fraud?

SIM swap fraud happens when a criminal gets a replacement SIM issued for your mobile number — without your knowledge or permission. The moment the new SIM is activated, your own SIM dies. All your calls, SMS messages and one-time passwords (OTPs) start going to the criminal’s phone instead.

Your passwords did not leak. Your phone was not hacked. Your number was taken.

In Pakistan this is especially dangerous because your mobile number is the key to almost everything: your bank app, Easypaisa, JazzCash, WhatsApp, and your email recovery. Once the criminal controls your number, they can register for your digital banking, reset your passwords, and approve transfers — all before you realise anything is wrong.

Real cases in Pakistan

In October 2026, The News investigated how biometric fraud and duplicate SIMs drained millions from bank accounts in Pakistan — including two members of the National Assembly (reporting also covered by Geo, TechJuice, Dialogue Pakistan and ProPakistani).

• MNA Farhan Chishti discovered on January 12 that his phone had suddenly stopped working after he landed at Islamabad airport. His operator’s service centre told him a duplicate SIM had been issued against his number from a retail outlet in Karachi’s Malir area. While his phone was dead, the criminal registered him for online banking (he had never used it), raised his withdrawal limit, and transferred Rs1.5 million into other accounts.
• MNA Shaharyar Mahar lost Rs2 million in a separate, similar incident.
• Karachi businessman Sunny Kumar had a duplicate SIM issued in his name on September 29, 2025, at a retail outlet in Dhabeji, Thatta. Criminals stole Rs8.5 million from his account. Investigators found a bank insider — a branch services officer in Mardan — had accessed around 30 customer accounts before the SIM swaps, with suspected fraud totalling about Rs25 million. He reportedly admitted sharing customer details with an acquaintance.

The Pakistan Telecommunication Authority (PTA) fined the telecom operator Rs77.8 million per case, citing Regulation 4(4) of the Subscribers Regulations — the rule that makes operators solely responsible for every SIM they sell. The banks were only ordered to return the victims’ money.

This is not a one-off pattern. In June 2026, a Lahore court reviewed a SIM swap case in which at least six United Bank Limited (UBL) customers lost over Rs10 million after duplicate SIMs were issued against their CNICs and used to take over their mobile banking accounts.

How criminals pull it off in Pakistan

A replacement SIM in Pakistan requires biometric (fingerprint) verification — so how do criminals beat it? Investigators say they do it in a few ways:

1. Leaked or stolen biometric data. Investigators believe criminals harvest fingerprints in bulk from leaked databases, or from places where fingerprints are taken for routine services. The PTA Chairman has confirmed that fraudsters bypass the biometric safeguards for identity checks. (TechJuice notes the PTA has blocked some 18.2 million illegal SIMs over roughly two and a half years.)
2. Retailer trickery or bribery. In the Chishti case, the retailer said a man requested biometric verification outside the outlet, claiming his mother could not leave the car — and how the lawmaker’s fingerprints were actually reproduced was never established.
3. Insiders. Some cases involve bank employees leaking customer data before the SIM is swapped, as investigators found in the Sunny Kumar case.
4. Social engineering. Criminals call you pretending to do “SIM re-verification” and talk you through steps that hand over control of your number. The same pressure-and-trust tactics show up in fake BISP 8171 SMS messages — if it worked there, it works here.

The red flag: your phone goes dead

The single most important warning sign is this: your phone suddenly shows “No Service” and stops receiving calls and SMS for no reason.

It is the moment your number moves to the criminal’s SIM. Every hour after that is an hour of OTPs going to them. Treat a dead phone as a possible SIM swap — not a network glitch — until proven otherwise.

What to do if it happens to you

1. Call your operator immediately from another phone and report a suspected unauthorised SIM replacement. Ask them to block the number right away.
2. Call your bank and wallet helplines (your bank, Easypaisa, JazzCash) and freeze digital banking before the fraudster uses your OTPs.
3. Visit your operator’s service centre in person with your CNIC to reclaim your number.
4. Report it. File a complaint with the FIA/NCCIA cybercrime complaint portal (complaint.fia.gov.pk, helpline 1991) and through the PTA’s complaint system. These cases move fastest when reported immediately — and, as the Chishti case showed, the operator can be held responsible for issuing the SIM.
5. Check your accounts. Once your number is back, review bank statements, wallet transactions, and your email recovery settings for anything you did not do.

How to protect yourself

• Treat a dead phone as an emergency. If your SIM stops working unexpectedly, act within minutes: operator first, banks second.
• Do not share OTPs, CNIC copies, or fingerprints casually. OTPs are the last wall — the same rule applies to the fake courier SMS scam, where criminals call posing as courier representatives just to collect your OTP.
• Keep bank alerts on. SMS and email transaction alerts are how you find out something moved — but remember that after a SIM swap, SMS alerts go to the criminal too. App notifications and email alerts are your backup. Check your bank statement regularly, not just when alerts arrive.
• Set withdrawal and transfer limits low on your bank app and wallets, and turn on biometric/login alerts. Lower limits buy you time.
• Be careful where your fingerprints go. Avoid giving thumb impressions to unverified agents, forms, or “free SIM” stalls — as investigators found, your biometrics can be the raw material for this fraud.
• Separate money and OTPs where possible. Avoid keeping large balances in the same wallet or account tied to your daily-use number. And never send money to strangers who contact you on WhatsApp — see our guide on fake Easypaisa and JazzCash payment screenshots and illegal loan apps for the tactics that usually follow.