Pakistan's rapid shift towards digital payments has transformed how millions of people send, receive and manage money through their smartphones.
DIGITAL FRAUD
Pakistan's rapid shift towards digital payments has transformed how millions of people send, receive and manage money through their smartphones.
Digital/branchless banking has played a major role in this transformation, extending financial services to people who previously had limited access to conventional banking. From paying utility bills and receiving salaries to transferring money and shopping online, digital payments are becoming part of everyday economic life.
This expansion is an important achievement for financial inclusion, but it has also created opportunities for financial fraud. Victims of online shopping scams, impersonation, fake investment schemes, fraudulent job offers and social media fraud are frequently asked to transfer money through mobile wallets. Some major digital/branchless banking service providers often appear in such cases because of their enormous reach and the speed with which money can be transferred.
It is important to distinguish between misuse of a payment platform and wrongdoing by the service provider. No doubt these digital banks provide legitimate financial services to millions of Pakistanis. The concern is how criminals exploit mobile accounts, SIM cards, stolen identities and weaknesses in customer awareness to receive and rapidly move fraudulently obtained funds.
The scale of Pakistan's digital financial ecosystem makes the issue increasingly important. State Bank of Pakistan data show that branchless banking and digital payments have expanded dramatically. These mobile wallets have customer bases running into tens of millions, while Pakistan's branchless banking system processes billions of transactions worth trillions of rupees. This represents significant progress towards financial inclusion, but even a small percentage of fraudulent transactions can affect thousands of households.
Pakistan’s two largest mobile financial platforms are reported to have a combined registered account base of more than 100 million, although this does not represent 100 million unique or active users. With such a vast network, a key concern is the misuse of accounts to receive and quickly move fraudulent payments. In some cases, suspected fraud accounts may be operated through misused identity credentials, SIMs registered to other individuals, or third-party ‘mule accounts’, making it difficult to identify the actual person controlling or benefiting from the transaction. Even when the registered account holder is traced, that person may not necessarily be the fraudster. This gap calls for stronger biometric and identity verification, periodic re-verification of high-risk accounts, real-time monitoring of suspicious transaction patterns, rapid restriction of repeatedly reported accounts, and closer coordination among mobile wallet operators, SBP, PTA, NADRA and cybercrime authorities.
Many digital financial scams do not involve sophisticated hacking. Criminals frequently target people rather than technology. A customer may receive a call from someone pretending to represent a bank, digital/branchless bank, a government department, a law-enforcement agency, or a hacked WhatsApp number. The caller creates urgency and persuades the victim to disclose an OTP, PIN or other sensitive information, or to request urgent loan/cash help.
Online commerce provides another opportunity. Fraudsters advertise mobile phones, vehicles, property and other products through Facebook, WhatsApp, Instagram and online marketplaces. Buyers are asked to make advance payments through mobile wallets, after which the seller disappears.
Fake investment and online earning schemes can cause even greater losses. Victims may initially receive small returns to gain their confidence before being encouraged to transfer larger amounts. Similar techniques are used for fake loans, prizes, overseas employment and impersonation of relatives or officials.
Many digital financial scams do not involve sophisticated hacking. Criminals frequently target people rather than technology.A customer may receive a call from someone pretending to represent a bank, digital/branchless bank, a government department, a law-enforcement agency, or a hacked WhatsApp number. The caller creates urgency and persuades the victim to disclose an OTP, PIN or other sensitive information,or to request urgent loan/cash help
An important part of this fraud ecosystem is the ‘mule account’. Such accounts are used to receive and withdraw illegally obtained money. In some cases, some individuals knowingly provide their wallets, SIMs or identity information to criminals in return for payment. Others may provide biometric verification or identification documents without understanding how they will be used later.
Once money reaches a mule account, it can rapidly be transferred elsewhere or withdrawn. By the time the victim realises the fraud and reports it, the funds may already have moved through several accounts. This makes recovery extremely difficult.
The State Bank of Pakistan should consider establishing a national rapid fraud response mechanism that connects banks, microfinance banks and digital wallet operators. When a customer reports a fraudulent transfer, a traceable complaint should be generated immediately. Where predefined risk indicators are present, the receiving institution should be able to temporarily restrict movement of the disputed funds while the case is examined.
Appropriate safeguards would be necessary to prevent false complaints from blocking legitimate payments. Nevertheless, speed is critical. Although these service providers immediately block accounts on call, fraudulent people transfer/withdraw money very quickly. A financial system that can transfer money within seconds cannot rely on fraud reporting and investigation processes that take several days. The first step is to report these transactions to the relevant banks without delay.
Greater attention should also be given to identifying mule accounts. Know Your Customer requirements at the time an account is opened are no longer enough. Banks and wallet providers should continuously monitor account behaviour. A newly opened account that suddenly receives unexpected transfers from unrelated people and immediately withdraws or transfers those funds should trigger additional scrutiny. To do so, banks should adopt an AI-based monitoring system. Multiple suspicious accounts linked through common devices, SIM ownership, identity information or transaction destinations should similarly generate alerts.
Artificial intelligence and advanced transaction analytics can help identify such patterns in real time. The State Bank of Pakistan should also improve the centralised fraud intelligence platform through which regulated institutions can securely share information on accounts and transaction patterns associated with confirmed fraud, subject to privacy and due process safeguards.
Graduated transaction limits for newly opened wallets could provide another layer of protection. A new account should not necessarily receive the same transaction privileges as an account with several years of legitimate activity. Limits could gradually increase as customers establish a verified transaction history or complete additional verification. This could make disposable mule accounts less attractive to criminal networks.
Institutional coordination is equally important. Fraud may begin with a mobile phone call and continue across different social media platforms, especially WhatsApp. The State Bank, Pakistan Telecommunication Authority, National Cyber Crime Investigation Agency, telecom companies, banks and digital wallet operators therefore need an integrated, rapid and user-friendly response mechanism.
Pakistan also needs better public data on digital financial fraud. Regulators should regularly publish aggregated information on the number of complaints, channels used, amounts reported stolen, amounts recovered, accounts blocked and average response times. Without reliable statistics, policymakers cannot properly assess the scale of the problem or determine whether existing measures are working.
Consumers must also remain cautious. PINs and OTPs should never be shared. Recipient names should always be verified before confirming transfers, while screenshots should never be accepted as proof of payment. Unexpected calls involving prizes, government assistance, account suspension or requests for emergency payments should be independently verified.
Pakistan should not respond to fraud by discouraging digital payments. All digital financial service providers have reduced transaction costs and brought millions of people closer to the formal financial system through their smartphones. The goal should be to make these services safe and secure.
Customer services and digital finance operate in seconds, and fraud prevention must increasingly operate at the same speed. Stronger verification, intelligent monitoring, rapid restriction of suspicious funds, action against mule accounts, institutional coordination and consumer awareness can protect citizens while allowing Pakistan's digital economy to continue growing. Ultimately, digital finance depends on trust and protecting that trust must become a national financial and cybersecurity priority.
The writer is affiliated with the Sustainable Development Policy Institute (SDPI). The views expressed are solely his own and do not necessarily reflect the official position of SDPI.
