18.2 Million Blocked SIMs Still Not Enough: Pakistan Delivers an Ultimatum to PTA, Banks and Investigative Agencies

A figure of 18.2 million might make any telecom regulator smile with satisfaction. But inside the meeting room of Pakistan's National Assembly Standing Committee on Interior and Narcotics Control, that number was nothing more than an admission of failure. The Committee, chaired by Raja Khurram Shahzad Nawaz, just convened with representatives from the Pakistan Telecommunication Authority (PTA), the National Cyber Crime Investigation Agency (NCCIA), cellular operators and banks to review the implementation of previous recommendations. The result: not a word of praise, but a series of hard directives to tighten discipline in the fight against SIM fraud and financial crime. The problem is not about blocking SIMs. The problem is that after blocking 18.2 million SIMs in 2.5 years, fraud continues. If blocking SIMs were the solution, the equation would have been solved long ago. The truth is, fraudsters do not disappear. They adapt. When domestic SIMs are squeezed, they shift to foreign SIMs, VoIP and rented bank accounts. The Committee pointed exactly to this when discussing the use of foreign SIMs and 'rented' accounts – critical links in the modern money-laundering chain. What struck me most in the Committee's report is the acknowledgment of a technological paradox: the national biometric infrastructure (operated by NADRA) is both a tool for identity verification and a vector for fraudulent activity. The Committee's directive to adopt facial and iris recognition (IP11) shows they understand the problem is not a lack of technology, but a lack of data governance. Let us look at the 18.2 million figure with skepticism. How many of those SIMs were actually linked to fraud, and how many were dormant or duplicate registrations? No one provided a specific number. This is the silence between two numbers I have always sought. Another blind spot: the Committee discussed 'difficulties in timely blocking and recovery of fraudulent funds' (IP16). This points to a legal bottleneck – even when fraud is detected, the legal machinery to freeze and repatriate assets is too slow. This is not a technology problem; it is a legal problem. And here is the crux: Pakistan currently lacks a comprehensive data protection law. Expanding biometric verification without a corresponding legal framework for data protection will only increase the attack surface. The Committee can direct PTA, banks and NCCIA to coordinate, but without a data protection statute, all technical efforts risk becoming a double-edged sword. I have followed many telecom markets in Asia over the past 50 years. I recall the SIM verification campaigns in India with its Aadhaar system, or Nigeria with its NIN-SIM linkage. Pakistan is walking the familiar path, but with one difference: inter-agency coordination is being questioned right at a parliamentary hearing. The Committee's directive for immediate alerts when new SIMs are issued (IP12) is a low-cost, high-impact measure. This is a quick win that I believe will be implemented within the next 6 months. But this is only a band-aid. The real battle lies in institutional restructuring. The appearance of NCCIA – a new agency – at the meeting shows Pakistan is consolidating cybercrime investigation capacity, but the agency's infancy is also a short-term coordination risk. The biggest question the Committee left open: 18.2 million SIMs have been blocked, but how much money has been recovered? How many fraudsters have been arrested? Without data on financial losses, how do we know if this campaign is effective or merely a performance? I do not trust published numbers. I trust the silence between them. And the silence here is saying: Pakistan may be blocking the wrong SIMs, while the real fraudsters are still using rented bank accounts to launder money. The Committee has tasked PTA, NADRA, banks, NCCIA and operators to coordinate more closely. But what I care about is whether these directives will be enacted into law. Parliamentary committee directives are only advisory until institutionalized. And Pakistan's legislative process, as we have seen, is not swift. One final point: the Committee's directive to monitor social media platforms to curb illegal promotion of foreign SIMs (IP20) may extend beyond fraud prevention. Without clear judicial oversight, this directive could become a tool for content control, raising concerns about freedom of expression. Pakistan stands at a crossroads. One path leads to comprehensive reform with a data protection law and faster asset-freezing mechanisms. The other path is to continue blocking SIMs and hope that is enough. History has already given us the answer to the second path. The question is not whether the Committee has enough power to force agencies to act, but whether the legal system can keep pace with technology. Because, as I have said many times: rumors never die, they just change owners to survive. And so do fraudsters. This trial of rumors – or rather, this trial of truth – will be decided not by the number of blocked SIMs, but by Pakistan's ability to build a capability-based fraud prevention system, not an asset-based one. This summer, as Pakistani operators begin rolling out new SIM alert systems, I will be watching one specific number: the fraud fund recovery rate. If that number does not improve, then 18.2 million blocked SIMs are just a decorative figure. Contracts have signatures, but darkness has its own signatures. And in that darkness, fraudsters are signing new transactions every day.