LAHORE – A sophisticated cyber fraud targeting UBL customers was reported, showing how stolen banking data and fraudulent duplicate SIMs were allegedly used to bypass security safeguards and transfer more than Rs10 crore from six bank accounts.
Advocate Rizwan Abid told Daily Pakistan that the case came before Lahore High Court as two accused sought post-arrest bail in an NCCIA case involving alleged SIM swapping digital banking fraud and the unauthorized use of confidential customer information.
As per the court’s written order, two victims initially reported losing hundreds of thousands of rupees after their original SIMs were allegedly blocked and duplicate SIMs were issued against their identities.
One victim, Sultan Masood Malik, reportedly lost half million after a duplicate SIM was issued on November 9 2025. Another victim Shabbir Hussain allegedly had over Rs4Lac transferred from his account after a duplicate SIM was issued three days earlier. According to the PTA complaint cited by the court both duplicate SIMs were linked to Jazz Franchise ID 6561 operating as Fine Telecom in Bahawalpur Road Yazman.
NCCIA, PTA raided Fine Telecom in November 2025 after getting search warrant. Investigators seized two SIM scanners one BVS device one CPU one laptop and around 150 suspicious SIM cards along with mobile phones.
The investigation subsequently identified four more affected account holders taking the total number of victims to six. Authorities alleged that a combined Rs10,458,500 was fraudulently transferred from their UBL accounts.
The prosecution’s case describes organized chain in which customer information was allegedly obtained from inside the banking system before the victims’ mobile connections were targeted. Investigators alleged that confidential customer information including registered mobile numbers and banking details was accessed by insiders and passed to other members of the network.
The victims’ original SIMs were then allegedly blocked before duplicate SIMs were activated through the biometric verification system. PTA’s counsel told the court that safeguards designed to prevent fraudulent SIM issuance were allegedly circumvented through manipulation of a BVS device including claims that it was operated at reduced frequency or used with paper fingerprints through a VPN.
Once the duplicate SIM became active the alleged fraudsters could place it in another phone install or activate the bank’s mobile banking application and gain access to the victim’s account. Funds were then allegedly transferred to beneficiary accounts controlled by the perpetrators.
UBL employee accused of leaking data
The investigation also moved inside UBL. Bank’s Fraud Risk Management Division conducted its own inquiry and produced reports dated December 30 2025 and May 29 2026. The inquiry identified three bank employees in connection with suspicious access to customer accounts.
One of the accused was Muhammad Atif a Branch Services Supervisor at UBL’s District Courts Jhang Branch. According to the court record customer information linked to the affected accounts had been accessed through the CRS system using a user ID associated with Atif. Atif’s lawyer argued that simply accessing customer accounts did not prove that he leaked information participated in SIM swapping or benefited financially from the fraud.
The defence maintained that Atif got account information only to verify contact numbers at the request of a UBL Omni employee and that investigators had failed to establish a direct connection between him and those who allegedly issued the duplicate SIMs or received the stolen funds. The prosecution however argued that the evidence had to be viewed cumulatively and alleged that Atif’s access to confidential customer information formed part of the wider fraud scheme.
Justice Tariq Saleem Sheikh of LHC turned down Atif’s bail application and made an important legal finding about the status of customer information. The court held that under Section 27(2) of PECA references to property in laws dealing with property offences include information systems and data.
This means customer banking data can qualify as “property” for the purposes of Sections 405 to 409 of the Pakistan Penal Code. The court further held that where a bank employee is entrusted with customer data or has dominion over it because of his banking functions and dishonestly discloses or uses that information in a fraudulent scheme the conduct may amount to criminal breach of trust.
The court found that Section 409 PPC was prima facie attracted in Atif’s case. Section 409 carries punishment of up to 10 years imprisonment or life imprisonment in circumstances covered by the provision. The court said Atif’s position and functions were important because he was not merely a bank employee with incidental access. His supervisory responsibilities included branch operations compliance customer due diligence and supervision of financial and non-financial transactions.
After considering the UBL reports access records and investigation material the court concluded that there was sufficient incriminating material against him at the bail stage. His post-arrest bail application was therefore dismissed.
The court reached different conclusion regarding Muhammad Usman who was arrested during the raid on Fine Telecom. The franchise was registered in the name of Usman’s father Dilawar Hussain. The prosecution alleged that Usman was actually operating the franchise and had a role in the SIM-swap operation.
His defence denied this and argued that the duplicate SIMs were issued through other retailers and that the BVS device allegedly used in the fraudulent activations had not been recovered from him.
The court noted WhatsApp Business communications and technical evidence connecting Usman with the franchise and the disputed BVS device but found that the available material did not sufficiently establish his direct involvement in manipulating the device or assisting the alleged banking fraud.
Judge noted that equipment recovered from the franchise could have legitimate business uses and that there was no forensic report establishing that the seized SIM cards had been illegally activated or used in the fraud. The court therefore held that the allegation of Section 409 PPC read with Section 109 PPC against Usman required further inquiry.
Since the investigation had been completed and the prosecution report submitted the Lahore High Court granted him bail against Rs1 million bail bonds with one surety in the same amount.
The case shows why a sudden loss of mobile connectivity should not automatically be ruled out as a technical problem. A blocked or unexpectedly inactive SIM can potentially be the first warning sign that someone is attempting to take control of the mobile number linked to a bank account. Customers should immediately contact their mobile operator and bank if their SIM suddenly stops working or a duplicate SIM is issued without their knowledge.
MCB ordered to return Rs1.5 Million in Online Banking Fraud Case
