Identity Theft in Pakistan: What to Do When Your CNIC Is Misused

A CNIC number plus a photocopy is enough, in practice, to open a mobile connection, apply for services or attempt account opening in someone's name. Most victims discover it accidentally - a tax notice for income they never earned, a debt collector calling about an account they never opened. The checks that reveal it take minutes and almost nobody runs them.

How CNIC misuse happens

• Photocopies handed over routinely - to landlords, employers, shopkeepers, service providers - and never destroyed.
• Documents shared over WhatsApp and stored indefinitely on other people's phones.
• Data breaches at organisations holding customer records.
• Fake job applications and forms collecting identity documents.
• Complicit or careless retailers registering SIMs against a customer's biometrics for someone else.
• Family members using a relative's CNIC without permission - more common than reported.
• Lost or stolen wallets containing the card.

The most preventable is the casual photocopy. Where you must provide one, write across it what it is for and the date - "for tenancy verification only, 12 March" - which makes reuse harder and demonstrates the limited purpose if misuse follows.

Checks that reveal misuse

Run the SIM check first. It is quick, free and the most common form of misuse - and an unauthorised SIM in your name can be used for anything from fraud to harassment, with the trail leading back to you.

What to do when you find misuse

1. Document what you found - screenshots with dates, reference numbers, statements.
2. Report to the relevant operator or institution - the telecom company for a SIM, the bank for an account.
3. Report to NADRA where your record has been altered or your identity used to obtain documents.
4. File with the FIA on 1991 or through the portal - unauthorised use of identity information is an offence under PECA 2016.
5. Get written acknowledgements at every stage.
6. Notify anyone affected - for instance if a fraudulent account has been used to approach your contacts.
7. Keep a single file of the whole episode with dates.

The FIA route matters because it creates an official record. If a fraudulent account or SIM in your name is later used for an offence, being able to point to a complaint you filed beforehand is significant.

What misuse can lead to

• Fraudulent SIMs used for scams, harassment or worse, traced back to you.
• Bank accounts opened in your name and used to receive fraud proceeds.
• Tax liability for income you never earned, arriving as an FBR notice.
• Loans or credit taken in your name.
• Company directorships registered without your knowledge, carrying real liability.
• Property transactions purportedly authorised by you.
• Criminal investigation where your identity was used in an offence.

The company directorship risk is underappreciated. A person registered as a director carries duties and potential liability for that company's affairs. If you find a directorship you never accepted, treat it as urgent and take advice - see checking the SECP register.

If a tax notice arrives for income you never earned

A common way misuse surfaces. Do not ignore it - the notice is real even if the income is not.

1. Respond within the deadline, stating that the registration or filing was not made by you.
2. Attach your evidence - the FIA complaint, NADRA report, and anything showing you were not involved.
3. Ask what was filed and by whom, so you understand the position.
4. Check your own IRIS account and secure it.
5. Take advice where sums are significant.

Ignoring the notice leads to a best-judgement assessment against you personally - see responding to FBR notices.

Reducing the risk

• Annotate every photocopy with its purpose and date.
• Do not send CNIC images over messaging apps where avoidable; if you must, delete afterwards from both sides.
• Run the SIM check periodically - twice a year is sensible.
• Check the SECP register occasionally for directorships in your name.
• Report a lost CNIC immediately and obtain a replacement.
• Be sceptical of forms collecting identity documents for jobs or prizes.
• Never share OTPs, which convert a copied CNIC into an operational account.

The single highest-value habit is the periodic SIM check. It takes two minutes, it is free, and unauthorised connections are both the most common misuse and the gateway to most of the others.

If your details were taken by an employer or agent

A frequent Pakistani pattern: identity documents handed over for a job application, visa agent or loan, then used for something else.

• Recruitment fraud. Documents collected for a job that does not exist, then used to open accounts or SIMs.
• Visa and overseas employment agents. Documents retained and reused, sometimes for other applicants.
• Employers registering staff for tax or company roles without telling them - see the directorship risk above.
• Loan and instalment schemes where documents are taken as security and misused.

Practical protections: annotate copies with purpose and date, ask why the copy is needed and what will happen to it, avoid handing over originals, and keep a note of who holds a copy of your CNIC and when they took it. If misuse occurs, that note becomes the starting point for identifying the source.

Frequently asked questions