A phone that loses signal for hours, with no outage announced, can mean a thief has had a copy of your SIM issued and is already in your bank app. Two members of the National Assembly found this out the hard way, and a news investigation now lays out how it was done.
MQM’s Farhan Chishti had Rs. 1.5 million moved out of his account, and Shaharyar Mahar lost Rs. 2 million in a separate case. According to the investigation, the telecom regulator fined the operator Rs. 77.8 million over the SIM in Chishti’s case, and the same amount in a third case involving a Karachi businessman.
The account comes from an investigation by The News. Chishti’s phone was dead when he landed in Islamabad on 12 January. A service centre told him a duplicate SIM, issued in Karachi’s Malir area, had replaced his own. Only the operator’s head office could cancel it, and that office had shut until the next morning.
How the thumbprint was obtained
The shop that issued the SIM in Khokhrapar said a man had asked for the fingerprint scanner to be brought to a car, saying his frail mother needed a replacement SIM. How Chishti’s own print was captured remains unexplained. Investigators think criminals gather prints in large batches from leaked databases and from places where fingerprints are not compulsory, then feed them into software.
Meanwhile the thief switched on online banking in Chishti’s name, which he had never used, lifted his withdrawal limit and sent Rs. 1.5 million to accounts held in women’s names across South Punjab and Sindh. Chishti reported it to the NCCIA, the cybercrime agency, which we have covered in an earlier report on refund delays.
A bank insider in Mardan
Sunny Kumar, a Karachi businessman, lost Rs. 8.5 million after a duplicate SIM was issued against his number on 29 September 2025 at a shop in Dhabeji, Thatta. His bank later refunded him. Before the SIM was issued, an officer at a Mardan branch had looked at his account, and had looked into roughly 30 others, where suspected fraud totals about Rs. 25 million. The officer first claimed he was helping a friend, then said he had handed customer details over under pressure.
The operator argued that a third party had fooled its retailer. The regulator did not accept that. Under Regulation 4(4) of the Subscribers Regulations, the operator is solely answerable for any SIM sold through any channel, and the regulator found weak monitoring that later fixes did not undo. The banks were only told to return the money. The Chishti and Mahar cases did not go further because both men mainly wanted their funds back.
If your phone loses signal for hours and nobody else nearby has the same problem, ring your operator and your bank at once; waiting for office hours is what gave the thief time here.
