When a citizen hands over sensitive data like biometrics to obtain a SIM, open a bank account, or get their ID card renewed, there is an implicit agreement that those collecting the data have a duty to keep it safe and secure. Sadly, cracks appear to be emerging in this unwritten contract in Pakistan and hackers, fraudsters and other criminals hungry for the sensitive data of citizens seem to be sneaking in. The National Cyber Crime Investigation Agency (NCCIA) has revealed to the Standing Committee of the National Assembly on Interior and Narcotics that fingerprints and biometric data of around 600,000 citizens were recovered during a single raid, while a suspect arrested in Faisalabad was found in possession of 195 active mobile SIMs, 16 smartphones and 81 ATM cards belonging to different banks. The PTA also informed the committee that approximately 18.2 million SIMs had been blocked during the preceding two and a half years and that fines of Rs4.5 billion were imposed on cellular operators for regulatory violations. This stolen data and the illegally obtained SIMs are being used to commit widespread financial fraud and there is also a problem of bank accounts being rented out to criminals.
However, in some ways, the loss of money is the least bad thing that can happen if one’s data is compromised in this way. Officials told the committee of a case where a woman’s thumb impression was obtained in Rajanpur on the pretext of providing ration, but the biometric information was subsequently used to obtain a SIM that was later used in terrorism. As such, this deluge of stolen data is a serious security problem and officials have admitted that the biometric system is ‘outdated’ and has failed to prevent data theft. Yet one of the solutions authorities appear to be offering is collecting even more data, including facial and iris recognition. It will likely not matter how much data citizens have to give up in order to obtain SIMS or open bank accounts, tasks which are already quite cumbersome in Pakistan, if those involved in collecting the data are not able to keep it safe. And if insiders leak sensitive data, as the authorities have alleged, the problem becomes even more complicated.
Pakistan has made a strong push in recent years to build an inclusive digital ecosystem and help more people obtain SIMs and bank accounts. An estimated 64 per cent of adults had a bank account in 2023, up from just 16 per cent in 2015, while the total cellular subscriber base reached over 200 million by the end of last year, jumping by around four million between November and December 2025. Part of the problem may be how much more data the institutions involved actually have to secure. With such a massive change in the data landscape, monitoring and coordination among the authorities, banks, and cellular operators must also be strengthened, and officials have called for stronger monitoring mechanisms and coordination. Calls for immediate customer alerts upon the issuance of new SIMs and limiting each SIM to a single IMEI number also seem reasonable. In fact, one wonders why the former is not already the standard; how can a new SIM be taken out in your name without your knowledge? However, before the state asks citizens to hand over more data in the name of security, it must make sure it can keep that data safe and not let it become yet another source of insecurity.
