SIM Swap Fraud in Pakistan: How It Works & How to Stop It

It's mid-afternoon and your phone suddenly shows no signal. You assume it's the network, the weather or the building. You put it down and get on with your day. Meanwhile, somewhere else, another SIM carrying your number has just come to life, and the OTP for your bank account is landing on a phone that isn't yours. That's a SIM swap. It isn't a rare, exotic attack any more. In 2026, officials told a National Assembly committee that the biometric checks meant to protect SIM issuance were being bypassed, and NCCIA has arrested suspects accused of using fake and duplicate SIMs to empty bank accounts. This guide explains how the fraud works in Pakistan, what officials have actually said, how to spot it early, what to do in the first hour, and how to make yourself a much harder target.

To understand how to stop it, it helps to see the whole chain the criminals rely on. This is the sequence investigators have described, with a note on where each link can be broken.

1. 1

   Your identity data is collected

   CNIC details taken from leaks, phishing, or careless copies.

   Break it: guard your CNIC and never share OTPs
2. 2

   A fingerprint is obtained

   Reported sources include stolen records from government facilities, or prints captured in the wrong place.

   Break it: fingerprints only on scanners, at authorised outlets
3. 3

   A duplicate SIM is issued

   The number is activated on a new SIM the owner never requested.

   Break it: notice sudden loss of signal fast
4. 4

   The criminals receive your OTPs

   Bank and wallet codes now go to their phone.

   Break it: app-based approvals where your bank offers them
5. 5

   Accounts are taken over

   Passwords are reset and money moves in minutes.

   Break it: transaction alerts and sensible limits
6. 6

   The money vanishes through "mule" accounts

   Rented or fake bank accounts move funds faster than victims can report.

   Break it: report within the first hour

What a SIM Swap Actually Is

Your phone number is, in practice, a key. Banks send one-time codes to it. Wallets recover accounts through it. Messaging and email services reset passwords by texting it. A SIM swap is what happens when someone else gets a working SIM with your number on it, so all those codes and resets start arriving on their phone.

In Pakistan, reports describe two main routes to a swapped SIM.

• The biometric-bypass route. Criminals obtain a person's identity data and fingerprints, then use them, sometimes with an illegal multi-fingerprint biometric setup, to issue fake or duplicate SIMs. This is the pattern described in an NCCIA Lahore case in May 2026.
• The social-engineering route. Some guides describe scammers impersonating the customer, claiming a lost SIM and persuading an operator to issue a replacement. I couldn't find an official account of this specific route in Pakistan, so I'd treat it as plausible rather than proven.

What both routes share is the aim: get control of the number, then use it to reach money. And both depend on an identity check being fooled, which is why our guide to biometric verification and its two-random-finger design matters so much here.

What Officials Have Actually Said

It's worth separating what officials and investigators have stated from what guide sites claim. Here's what I could trace.

• A May 2026 arrest. NCCIA Lahore arrested three people, including a banker described as a facilitator, for allegedly running a gang that used stolen identity data and an illegal multi-fingerprint biometric system to issue fake and duplicate SIMs. Police reports say the SIMs were then used to break into victims' online banking and move millions of rupees. A case was registered under PECA 2016 as amended in 2025, and under the Pakistan Penal Code, and officers recovered two phones and 11 SIMs.
• A National Assembly committee briefing, in early September 2026. PTA's chairman told the committee that scammers were obtaining fingerprints from places such as airports, driving licence centres, passport offices and possibly even NADRA, and acknowledged that the biometric system used for SIM issuance was being bypassed. He also cited a specific case: a woman in Rajanpur whose thumbprint was taken on the pretext of giving her a ration allocation, and which was later used in connection with terrorism, as an example of how leaked biometric data gets misused.
• The Faisalabad case. NCCIA's director told the same committee that a single raid in Faisalabad recovered 195 active SIM cards, 16 smartphones and 81 ATM cards belonging to different banks from one person, and that the recovered biometric data covered around 600,000 citizens. I couldn't find a source tying a specific rupee amount to this particular arrest, so I'm not repeating one here.
• The bigger numbers. PTA told the committee that around 18.2 million SIMs had been blocked over the preceding two and a half years, and that cellular operators had been fined a combined Rs. 4.5 billion for regulatory violations. Separately, PTA and NCCIA joint raids were reported to have hit 110 to 125 facilities (outlets differ slightly on the exact count), blocked 25,000 to 29,000 illegal SIMs, and led to 171 arrests.
• The direction of travel. Proposals raised at the briefing included routing SIM issuance through NADRA's Pak ID system, moving toward facial or iris verification, restricting each SIM to one device IMEI, and sending an automatic SMS whenever more than one SIM is issued against a citizen's CNIC. These were proposals and not new rules.

These are reports of statements made at briefings and arrests, not court findings, so treat the individuals named as accused and not convicted. What they show is a system under real strain, and a fraud chain that runs from stolen fingerprints to fake SIMs to rented bank accounts.

The Warning Signs

• Your phone suddenly loses signal and won't get it back, especially when other people nearby have service.
• Calls and SMS stop while Wi-Fi still works.
• Messages about a SIM change, replacement or activation that you didn't request.
• Password-reset or login-code messages you didn't ask for, or bank and wallet alerts you don't recognise.
• Being logged out of apps tied to your number.

Any one of these can have an innocent cause, but the combination of a dead SIM and unexpected account activity should be treated as an emergency. A useful test: if the signal is gone and you haven't received a "welcome back" from your operator within a few minutes, assume the worst and act.

The Golden Hour

Speed decides how much damage is done, because criminals move money within minutes. Slide to how long it's been since you noticed. The guide below is general, and your operator and bank always have the final word. It runs in your browser, and nothing you choose is stored or sent.

Who to Call, in Order

The order matters, because each call limits what the criminals can do next.

1. Your operator. Ask to block the SIM, using another phone. Jazz's FAQ lists *8822# or 111 for blocking a stolen number, and Ufone's Code of Commercial Practice says temporary blocking can be arranged through its call centre or a service centre, with verification of any three account details. Our guides to Jazz and Ufone cover those channels, and Zong has its own guide.
2. Your bank and any wallet. Ask them to freeze access, block cards linked to your number and note the exact times of any transactions. Use a number printed on your card or on the bank's official site.
3. PTA, if the operator can't or won't act, on 0800-55055 or through its complaint portal.
4. NCCIA, for cybercrime and financial fraud, on 1799 or through its complaint portal.
5. The police, for an FIR if money has been taken, since banks and investigators often ask for one.

Keep a written log of everything: times, reference numbers and the names of people you spoke to. It helps every later conversation. If you'd like to understand the legal side, our guide to PECA 2016 explains the offences involved, including unauthorised use of identity information and unauthorised SIM issuing.

Rabia's Missing Signal

Rabia is at her desk when her signal drops. She restarts the phone, then assumes it's a network fault. Twenty minutes later, a friend asks why she hasn't replied to a message, and she remembers her signal hasn't come back. She borrows a colleague's phone and calls her operator. They tell her a replacement SIM was issued for her number that morning.

Rabia blocks the SIM, calls her bank while still on the line, and then logs into her banking app over office Wi-Fi to find a transfer she didn't make. Because she acted within the hour, the bank is able to hold most of the money. She then files complaints with the operator, PTA and NCCIA, and checks her CNIC with 668 to see nothing else has been registered. Rabia is invented, but the pattern of a dead signal, a delayed realisation and a race against the clock is the one to remember.

Making Yourself a Harder Target

You can't control what happens inside a franchise, but you can make yourself a much less attractive victim.

• Protect your fingerprints like a PIN you can't change. PTA's consumer guidance says to give fingerprints only on machines, only to trusted parties, and never on paper. Roadside offers and "government scheme" forms are traps.
• Treat CNIC copies as sensitive. Share them only with authorised entities, and consider writing the purpose and date across any photocopy.
• Check what's registered in your name. Text your CNIC to 668 or use the portal every few months. Our 668 SMS code guide and portal guide show how, and our CNIC SIM check guide explains how to read the total. Extra SIMs are a warning sign in their own right, and our guide to the 8-SIM cap explains what should be there.
• Read your SIM's record. Text MNP to 667 from your SIM, as our MNP 667 code guide explains, and keep a dated screenshot to compare with later.
• Use stronger authentication where you can. If your bank offers app-based approvals, use them in place of SMS codes alone. Turn on transaction alerts, and consider sensible limits on wallets and accounts.
• Never share an OTP or PIN. Genuine banks and operators don't ask for them. Our guide to Truecaller vs official PTA verification explains why a name on your caller ID isn't proof of who's calling.
• Keep your CNIC valid. Expired and cancelled cards are a risk for SIM blocking, as our guide to expired CNICs explains, and scammers copy the wording of those advisories.

Watch out for the phishing that feeds this crime. Messages saying "your SIM will be blocked, click here" harvest the very data criminals need, and our guide to fake SIM data offers shows how those traps work.

A Two-Minute Family Briefing

Fraudsters rarely start with the most careful person in the family. They start with whoever is easiest to rush, and that's often a parent or grandparent who isn't comfortable with banking apps. A short conversation can help a lot.

• Explain the OTP rule in one line: a code is a key, so nobody genuine ever asks for it.
• Teach the "no signal" reflex: if the phone loses signal and doesn't recover, tell someone and call the operator from another phone.
• Agree who to call: write the operator's helpline and the bank's number on paper, kept somewhere safe.
• Check together, with consent, how many SIMs are on their CNIC, so nobody is checked behind their back.
• Tell them about fingerprints: only on scanners, only at authorised outlets, never on paper.

After the Emergency

Once the immediate danger has passed, there's still a clean-up to do. Work through it while the details are fresh.

1. Get a fresh SIM at an authorised franchise with your original CNIC, and confirm the fraudulent one is blocked.
2. Reset everything tied to the number: banking, wallets, email, social media and messaging apps.
3. Check your email settings for forwarding rules or recovery addresses you didn't set.
4. Ask your bank about new cards and security options, and confirm your contact details are correct.
5. Re-check your CNIC with 668, and keep a dated screenshot. If unfamiliar SIMs appear, follow the reporting steps in our guide to the 365-day SIM disowning rule, which explains why a SIM you never activated is reported as unauthorised.
6. Keep every record for as long as any complaint is open.

Questions for Your Operator and Bank

You can learn a great deal about your exposure with a few calls. Ask, and note the answers.

• To your operator: "Will you notify me when a duplicate SIM or ownership change is requested for my number? How?"
• To your operator: "What do you require to issue a replacement SIM, and can extra checks be added to my account?"
• To your bank: "Do you offer app-based approvals instead of SMS codes? What alerts can I turn on?"
• To your bank: "What happens if my phone number changes suddenly? Is there a cooling-off period for large transfers?"
• To both: "What is your process and timeline if I report fraud, and what reference will I be given?"

I couldn't find a published, industry-wide rule on these points, so answers will vary. What matters is that you know them before you need them.

What Operators and Regulators Are Doing

• Two random fingers. Since December 2022, PTA's multi-finger system has the system choose two different fingers, not the seller, to defeat fake silicon fingerprints.
• Live finger detection. In July 2026, reports said PTA directed operators to use devices with Live Finger Detection and to extend NADRA biometric verification to key SIM services. The formal text isn't public.
• Raids and blocking. PTA and NCCIA joint operations, described above, have blocked illegal SIMs and made arrests. In July 2026 NCCIA Lahore also arrested three suspects over an alleged network selling telecom data.
• Face and Pak ID. PTA has asked NADRA about facial verification through the Pak ID app for people whose fingerprints fail, but in August 2026 the two disagreed publicly over how it should work.
• Extra friction in some processes. Jazz's FAQ says it entertains a change-of-ownership request only if the number hasn't used a duplicate SIM in the last 30 days. That pause isn't advertised as an anti-fraud measure, but it does slow one follow-up step for anyone who gets a duplicate SIM.

The honest summary is that the system is being tightened, and gaps remain, as officials themselves admitted. That's why your own habits matter.

Claims I Couldn't Verify

If a page gives you a dramatic statistic without a source, it's telling you how it wants you to feel, not what's true.

SIM Swap Fraud: FAQs

What is SIM swap fraud?

It's when criminals get a working SIM carrying your number, so your OTPs and account-recovery messages go to them. They use that control to take over bank, wallet and other accounts.

How does SIM swap fraud work in Pakistan?

Reports describe criminals using stolen identity data and fingerprints, sometimes with an illegal multi-fingerprint setup, to issue fake or duplicate SIMs. Some guides also describe impersonating customers to obtain a replacement.

What are the signs of a SIM swap?

A sudden, lasting loss of signal, calls and SMS that stop while Wi-Fi works, messages about a SIM change you didn't request, and unexpected login codes or bank alerts.

What should I do first if I suspect a SIM swap?

Use another phone to call your operator and ask to block the SIM, then call your bank and wallet providers to freeze access. Don't wait for the signal to return.

Who do I report SIM swap fraud to?

Your operator and bank first, then PTA on 0800-55055 or its complaint portal, and NCCIA on 1799 or its complaint portal for cybercrime. File an FIR if money was taken.

How can I check whether extra SIMs were registered in my name?

Text your 13-digit CNIC without dashes to 668, or use cnic.sims.pk. Both show a count of SIMs per mobile company.

Does PTA's two-finger verification stop SIM swaps?

It makes fake fingerprints harder to use, but officials have acknowledged that fingerprint data has been obtained from other sources. Your own precautions still matter.

How do I protect my fingerprints?

Give them only on scanners at authorised outlets, to trusted parties, and never on paper, as PTA's consumer guidance advises.

Should I stop using SMS codes for banking?

If your bank offers app-based approvals, they're generally a stronger option than SMS codes alone. Ask your bank what it offers, and turn on transaction alerts.

Will the bank refund the money?

I can't promise that, and I found no official rule that guarantees it. Report within the first hour, keep records, and follow your bank's dispute process.

Related guides: SIM Owner Details (main guide) · Biometric Verification (BVS) · PECA 2016 Explained · Fresh SIM Data · 668 SMS Code.
Note: this is general information, not legal or banking advice. Contact your operator and bank first, and confirm reporting channels on pta.gov.pk and nccia.gov.pk. This site is independent and is not a government service.