- October 21, 2026
- Posted by: administrator
- Category: Banks, Blog, Pakistan
Online financial fraud is becoming an increasingly serious concern as criminals find new ways to exploit weaknesses in digital banking, mobile telecommunications, and identity verification systems.
A recent investigative report from Pakistan has highlighted a disturbing case involving two Members of the National Assembly (MNAs) and a Karachi-based businessman who reportedly lost millions of rupees through fraudulent banking transactions. The investigation also revealed the alleged involvement of a bank employee who admitted sharing confidential customer information with another person.
The reported incidents raise important questions about the security of banking information, the reliability of biometric verification, and the responsibility of organizations that handle sensitive personal data.
This case demonstrates why customer data protection and cybersecurity must be priorities for banks, telecommunications companies, businesses, and individuals.
What Happened in the Online Fraud Cases?
According to an investigative report published by Geo News journalist Umar Cheema on October 19, 2026, the fraud involved duplicate SIM cards, unauthorized access to banking services, and the suspected misuse of confidential customer information.
The reported victims included MQM MNA Farhan Chishti, MNA Shaharyar Mahar, and Karachi businessman Sunny Kumar.
The cases involved different amounts of financial loss, but the reported methods highlighted similar weaknesses in customer identity verification and account security.
Investigators also examined whether insiders had helped criminals obtain customer information that could be used to facilitate fraudulent activities.
1. MNA Farhan Chishti Reportedly Loses Rs. 1.5 Million
The investigation reported that MQM MNA Farhan Chishti discovered a problem with his mobile connection after arriving at Islamabad Airport on January 12.
His phone could not make or receive calls. When he contacted his mobile operator, he reportedly learned that a duplicate SIM had been issued against his number without his authorization.
The replacement SIM had reportedly been issued in Karachi’s Malir area.
According to the investigation, the person controlling the duplicate SIM subsequently registered online banking services in Chishti’s name, increased the withdrawal limit, and transferred Rs. 1.5 million from his account.
The funds were reportedly transferred to accounts belonging to other individuals, including a woman whose bank account had allegedly been opened without her knowledge.
The case raised serious concerns about how a duplicate SIM could be issued without the account holder’s consent and how the compromised number could subsequently be used to access banking services.
The investigation also examined possible weaknesses in the biometric verification process used to issue replacement SIM cards.
2. Another MNA Reportedly Loses Rs. 2 Million
A second incident involved MNA Shaharyar Mahar, who reportedly lost Rs. 2 million through a similar fraud.
The case added to concerns about the security of mobile-based banking authentication and the potential consequences of unauthorized SIM replacement.
When criminals gain control of a victim’s registered mobile number, they may attempt to exploit account recovery procedures or authentication methods that rely on SMS verification.
However, a compromised SIM alone does not necessarily provide access to a bank account. Additional weaknesses in authentication and fraud detection may also need to be exploited.
These incidents demonstrate the importance of securing both mobile identity and financial accounts.
3. Karachi Businessman Sunny Kumar Reportedly Loses Rs. 8.5 Million
Karachi businessman Sunny Kumar was another reported victim.
According to the investigation, a duplicate SIM was issued in his name from a retail outlet in Dhabeji, Thatta, on September 29, 2025.
Following the issuance of the duplicate SIM, approximately Rs. 8.5 million was reportedly withdrawn from his bank account.
Investigators examining this case discovered information suggesting that a bank employee may have helped facilitate the fraud by accessing confidential customer records.
This development shifted attention beyond telecommunications security to the protection of customer information inside financial institutions.
Bank Employee Admits Sharing Customer Information
One of the most concerning aspects of the investigation was the reported involvement of a bank employee working at a branch in Mardan.
According to the investigative report, the employee had accessed Sunny Kumar’s account information before the duplicate SIM was issued.
Investigators also reportedly found that the employee had accessed information relating to approximately 30 other bank accounts. The suspected fraudulent activity associated with these accounts was estimated at around Rs. 25 million.
Initially, the employee reportedly claimed that he had checked an account balance for a friend. During the investigation, he subsequently admitted sharing customer information with that individual.
The report also stated that telephone records indicated attempts to obtain customer information from an employee at another bank. An employee of the National Database and Registration Authority (NADRA) was reportedly offered money for information but refused to provide it.
These findings raised concerns about possible insider threats and the misuse of legitimate access to confidential financial records.
Important distinction: The reported admission and investigative findings relate to the case described in the reporting. They should not be interpreted as proof that every suspected transaction or alleged participant’s role has been established by a court.
How Customer Data Can Be Used to Commit Financial Fraud
Customer data is valuable to criminals because it may help them impersonate legitimate account holders or exploit weaknesses in identity verification.
Information that may be targeted includes:
- Customer names and contact details
- Registered mobile numbers
- Bank account information
- National identity details
- Personal information used during verification
- Account activity and other confidential financial records
When criminals obtain such information, they may combine it with social engineering, SIM-swap fraud, identity theft, or unauthorized account recovery attempts.
For example, knowing a customer’s registered mobile number and other personal details may help a fraudster make a fraudulent request appear legitimate.
However, data exposure does not automatically result in a successful attack. The outcome also depends on authentication requirements, access controls, transaction monitoring, and the organization’s ability to identify suspicious behavior.
This is why protecting customer information is essential to financial security.
What Is Duplicate SIM Fraud?
Duplicate SIM fraud, commonly associated with SIM swapping, occurs when someone fraudulently obtains control of another person’s mobile number through an unauthorized SIM replacement or transfer.
The legitimate user’s original SIM may stop working because the mobile number has been activated on another SIM.
Criminals may then attempt to exploit services that use the mobile number for account verification or recovery.
A typical attack may involve several stages:
Step 1: Obtaining personal information
Criminals collect information that may help them impersonate the victim.
Step 2: Unauthorized SIM replacement
A duplicate SIM is fraudulently issued or activated against the victim’s number.
Step 3: Taking control of mobile-based verification
The criminal may receive calls or SMS messages intended for the legitimate account holder.
Step 4: Attempting to access financial services
The attacker may try to register for online banking, reset credentials, or exploit weaknesses in account authentication.
Step 5: Unauthorized transactions
If additional security controls are bypassed, money may be transferred to other accounts.
The reported Pakistani cases highlight why telecom operators must maintain strong SIM registration procedures and why banks should not rely exclusively on SMS-based authentication for high-risk transactions.
Biometric Security: Why Verification Controls Matter
Biometric verification is widely used to establish identity in telecommunications, financial services, and other digital processes.
Fingerprints can provide an additional layer of identity verification, but biometric systems are not immune to misuse.
Potential risks include compromised biometric records, inadequate verification procedures, unauthorized access to identity data, and failures in the systems responsible for validating a person’s identity.
In the reported cases, investigators suspected that biometric information may have been obtained improperly or misused. However, the exact origin of the biometric information involved in every incident was not established in the cited report.
Organizations should therefore avoid treating biometric verification as a complete security solution.
Effective protection requires multiple safeguards, including:
- Secure biometric data storage and processing
- Strong verification procedures for SIM replacement
- Strict controls over access to identity records
- Monitoring for unusual account activity
- Independent security audits
- Investigation of suspicious identity verification requests
Combining these measures can reduce the risk of identity fraud.
PTA Imposes Fines Over SIM Issuance Irregularities
The investigation also reported regulatory action by the Pakistan Telecommunication Authority (PTA).
According to the published report, the telecom operator involved was fined Rs. 77.8 million in the case involving Farhan Chishti and another Rs. 77.8 million in the case involving Sunny Kumar.
The combined reported fines amounted to Rs. 155.6 million.
The regulatory action highlighted the importance of maintaining appropriate controls over SIM issuance and ensuring that replacement SIM cards are not activated without proper authorization.
The investigation also raised questions about accountability when security failures occur across multiple organizations.
Effective fraud prevention requires cooperation between telecom operators, financial institutions, regulators, and law enforcement agencies.
Why Insider Threats Are a Major Cybersecurity Risk
Traditional cybersecurity strategies often focus on external attackers, malicious software, phishing, and network intrusions.
However, organizations must also consider the risk posed by individuals who already have legitimate access to confidential information.
An insider threat occurs when an employee, contractor, or another authorized individual misuses access in a way that compromises organizational security.
Insider threats may involve unauthorized disclosure of customer records, misuse of administrative privileges, or transferring confidential information to people who have no legitimate reason to receive it.
The reported bank employee case illustrates why organizations need to monitor how sensitive information is accessed and used.
Ways Organizations Can Reduce Insider Threats
1. Role-Based Access Control
Employees should only be permitted to access information necessary for their responsibilities.
2. Privileged Access Management
Accounts with elevated permissions should receive additional security controls, monitoring, and regular reviews.
3. Audit Logs and Activity Monitoring
Organizations should maintain appropriate records of access to sensitive customer information and investigate suspicious patterns.
4. Data Loss Prevention
Data loss prevention tools can help detect or restrict unauthorized transfers of confidential information.
5. Employee Security Training
Employees should understand their responsibilities regarding confidentiality, customer privacy, and secure data handling.
6. Separation of Duties
High-risk activities should require appropriate checks and, where necessary, approval from more than one authorized person.
7. Regular Security Audits
Independent assessments can help identify weaknesses in access management, data protection, and internal security procedures.
Together, these measures can help reduce insider risks and improve accountability.
How Banks Can Prevent Similar Fraud in the Future
Financial institutions must adopt a layered security strategy that protects customers throughout the banking process.
Stronger Identity Verification
Banks should use reliable identity verification procedures when customers register for digital banking, recover accounts, or request changes to sensitive account settings.
Risk-Based Authentication
High-risk activities, including new-device registration and unusual changes to transaction limits, should trigger appropriate additional verification.
Real-Time Fraud Monitoring
Automated monitoring can identify unusual transactions, unexpected account changes, and suspicious activity patterns.
Secure Customer Data
Sensitive customer information should be protected through encryption, access restrictions, appropriate retention policies, and secure data-handling procedures.
Insider Activity Monitoring
Banks should review access to confidential records and investigate activity that does not appear consistent with an employee’s legitimate responsibilities.
Incident Response and Customer Support
Banks should maintain clear procedures for responding to suspected fraud, securing compromised accounts, investigating incidents, and helping affected customers.
These measures can reduce the likelihood of fraud and improve the ability to detect suspicious activity before it results in significant losses.
How Individuals Can Protect Their Bank Accounts
Customers also have an important role to play in preventing online fraud.
Consider the following precautions:
- Never share your banking PIN, password, or one-time password (OTP).
- Use strong and unique passwords for important accounts.
- Enable multifactor authentication wherever available.
- Contact your mobile operator immediately if your SIM unexpectedly stops working.
- Enable banking transaction alerts and review account statements regularly.
- Never approve unfamiliar authentication requests.
- Avoid suspicious links and messages asking for personal or financial information.
- Contact your bank immediately if you notice unauthorized transactions.
- Use official banking applications and verified websites.
- Ask your bank about additional security options for high-risk transactions.
If you suspect that someone has taken control of your mobile number or bank account, contact your mobile operator and bank through their official channels as soon as possible.
Request that the affected services be secured, preserve relevant transaction notifications, and report suspected criminal activity to the appropriate authorities.
What This Case Teaches Businesses About Cybersecurity
Although the reported incidents involved banking and telecommunications, the lessons apply to businesses across many industries.
Organizations that collect customer information must understand that data security is not limited to preventing external cyberattacks.
A comprehensive security strategy should address:
- Unauthorized access to confidential records
- Employee misuse of information
- Identity verification weaknesses
- Phishing and social engineering
- Endpoint and network vulnerabilities
- Data loss and unauthorized disclosure
- Incident detection and response
Companies should periodically assess their security posture and determine whether their current controls adequately protect their data, systems, employees, and customers.
Investing in appropriate cybersecurity measures can help businesses reduce operational risks, improve customer confidence, and strengthen their ability to respond to security incidents.
How ITBrands.pk Can Help Strengthen Cybersecurity
The reported incidents highlight the importance of adopting effective cybersecurity practices to protect sensitive business and customer information.
ITBrands.pk provides IT and cybersecurity solutions designed to help organizations strengthen their security infrastructure and address technology-related risks.
Depending on an organization’s requirements, relevant security measures may include:
Data Security: Protecting confidential information through appropriate security technologies and access controls.
Email Security: Reducing exposure to phishing, malicious attachments, impersonation, and email-based attacks.
Endpoint Security: Helping protect computers and other devices against malware and suspicious activity.
Network Security: Strengthening network defenses and controlling access to critical systems.
Cybersecurity Solutions: Supporting a broader security strategy based on organizational risks and infrastructure requirements.
Businesses should evaluate their security needs before selecting technologies and implementing new controls.
To explore available IT and cybersecurity solutions, visit ITBrands.pk.
Conclusion
The reported online fraud cases involving two Pakistani lawmakers and a Karachi businessman have highlighted serious concerns about duplicate SIM issuance, the potential misuse of biometric information, and unauthorized access to confidential banking records.
The reported admission by a bank employee that customer information had been shared with another person further emphasizes the importance of addressing insider threats.
These incidents demonstrate that financial security depends on more than passwords and basic authentication. It requires strong identity verification, responsible data handling, restricted employee access, continuous monitoring, and effective incident response.
Banks and telecommunications companies must strengthen their security controls, while individuals and businesses should remain alert to signs of identity theft and unauthorized account activity.
For organizations, protecting sensitive information is not merely a technical responsibility. It is essential for maintaining customer trust, business continuity, and financial security.
Looking to strengthen your organization’s IT security? Visit ITBrands.pk to explore IT and cybersecurity solutions.