In July 2026, Pakistan’s telecom regulator fined every mobile operator in the country over the identity controls that sit behind SIM owner details. The Pakistan Telecommunication Authority, known as PTA, imposed about Rs 740 million in cumulative penalties, roughly US$2.7 million, across the cellular licensees named in its enforcement orders. The offense was not a data breach.
Read the orders, and one pattern repeats. Connections were switched on against identity cards whose holders had never walked into a shop, never agreed to anything, and in many cases never learned of the SIM at all. Supervision of franchise and retail networks was weak.
The two controls meant to keep biometric hardware honest were not properly enforced either. Liveness detection is supposed to tell a living finger from a copy. Geofencing is supposed to stop a device from being used away from the outlet it is registered to. The findings were set out by Pakistani outlets that reviewed the orders in July 2026, and each finding describes a failure in how SIM owner details were created rather than in how they were stored.
PTA’s legal reasoning matters more than the number. The regulator refused two defenses licensees commonly reach for. The first is that a clean fingerprint match settles the question. It does not, because a match proves that a finger touched a scanner, not that the finger’s owner asked for a connection. The second is that a franchise is somebody else’s business. It is not, because responsibility for a SIM follows the license rather than the shopfront.
For anyone building identity or payments products, the lesson fits in one line. The weak point in a national SIM registry is rarely the cryptography. It is the shop counter, where SIM owner details are actually created.
What SIM Owner Details Actually Are in Pakistan
“SIM owner details” is the local shorthand for the subscriber record attached to a mobile number. In Pakistan, that record is anchored to a national identity document called the CNIC, the Computerized National Identity Card issued by NADRA, the National Database and Registration Authority.
The binding is not a form field. SIM sale, duplicate SIM, ownership change, number portability, re-verification, and disowning — the formal process for repudiating a connection registered in your name — each require a biometric check against NADRA at an authorized outlet. PTA sets out those six transaction types on its biometric verification page, with a narrow documented fallback for subscribers whose fingerprints cannot be captured.
Since December 2022, the device layer has been the Multi-Finger Biometric Verification System, or MFBVS. The system, not the retailer, chooses which fingers are scanned, and PTA puts the requirement at a maximum of two successful impressions. The system replaced the single-thumb hardware that operators had used since 2014.
So SIM owner details in Pakistan are the output of a verified identity transaction rather than a self-declaration. That design is stronger than most markets manage. The July 2026 penalties show how it fails anyway.
How Many Active SIMs Does Pakistan Have, and How Many Can One CNIC Hold?
Pakistan recorded 204.771 million active SIMs at the end of February 2026, the most recent figure PTA has published, with mobile tele density — connections per 100 people — at about 82 percent. Few national registries tie that many live connections to a single identity database.
At that scale, the integrity of SIM owner details becomes an infrastructure question rather than a customer-service one. The regulatory basis is the Subscribers Antecedents Verification Regulations, first issued in 2015 under the Pakistan Telecommunication (Re-organization) Act, 1996, and amended since.
There are hard limits inside the system. A single CNIC may hold at most eight SIMs, five voice and three data, counted across every operator rather than per operator. The five-voice limit came first; the Supreme Court of Pakistan allowed three data SIMs on top of it on 5 November 2015, producing the eight-SIM ceiling still in force.
The cap is applied when a SIM is sold and biometrically verified, so a ninth connection is refused at the counter — although PTA’s own enforcement record shows that this control can be bypassed.
Two more rules have tightened the edges since. Under a PTA advisory dated 24 May 2026, a newly activated SIM cannot be transferred or disowned for 365 days from activation. And since 24 January 2024, the buffer between new-SIM sale sessions on the same CNIC has been seven days rather than eight hours, so a customer who buys one new SIM waits a week before NADRA’s system will verify another.
Why Fintech Should Care About SIM Owner Details
Three linkages turn a telecom control problem into a financial one.
- The SIM is the KYC rail. Pakistan’s branchless banking and mobile wallet layer is built on the mobile number. December 2021le Account scheme, launched jointly by the State Bank of Pakistan and PTA in December 2021, lets a customer open and operate an account over USSD from any handset, with no smartphone and no internet. If the identity binding on the SIM is weak, so is the account’s KYC.
- The SIM is the authentication rail. Bank apps and wallets lean heavily on SMS one-time passwords. A SIM issued or swapped without genuine consent becomes a ready-made tool for account takeover. For scale, the FBI’s Internet Crime Complaint Center logged 982 SIM-swap complaints in 2024, with about US$26 million in reported losses — in a market with no mandatory biometric enrolment at all.
- The SIM is the inclusion rail. Identity-linked SIMs are often what allow an unbanked adult to hold a regulated account. The World Bank’s Global Findex 2025 puts account ownership at 79 percent of adults worldwide in 2024. The 1.3 billion adults still outside are not spread evenly: roughly 650 million of them live in just eight economies, Pakistan among them.
Taken together, those three linkages mean that the integrity of SIM owner details in Pakistan is not a telecom housekeeping issue. That integrity is the foundation of a payments system used by tens of millions of people, and the reason a franchise counter in a small town is a systemic-risk question rather than a retail one.
For product teams, the practical response is not to distrust the registry. It is to stop treating the subscriber record as a single point of truth. Three controls do most of the work.
- Read the SIM-change signal where your agreements allow it. A connection that changed hands or changed SIM in the previous 48 hours is among the strongest pre-transaction fraud signals a bank can hold. It is not a public lookup. It reaches a bank only through an operator agreement, under contract and with the customer’s consent, and in markets without that plumbing, the first job is to build it.
- Put a cooling-off window on beneficiary changes. Account-takeover fraud needs two things to complete: control of the one-time password, and a new destination for the funds. Delaying the second removes most of the value of capturing the first.
- Treat sudden loss of signal as a security event, not a support ticket. From the customer’s side, a hijacked number looks exactly like a dead SIM. The support queue is usually where the first evidence of a swap arrives, and usually where it is discarded.
What Does Pakistan’s Enforcement Record Actually Show?
It shows that the leak is rarely in the database that holds SIM owner details. Every major Pakistani action of the past two years points to people and premises: about Rs 740 million in operator penalties in July 2026, more than a thousand data-selling platforms blocked, and arrests in which the seized equipment was biometric.
| Enforcement action | Figure | Date |
| Penalties on the cellular licensees for SIM issuance violations | about Rs 740 million | July 2026 |
| Sites, apps, and social pages blocked over the sale or sharing of personal data | 1,372 | by September 2025 |
| Platforms identified in a sweep led by the National Cyber Crime Investigation Agency (NCCIA) | 139 | October 2025 |
| Citizens’ records compromised in the national identity database, per a joint investigation led by the Federal Investigation Agency (FIA) | 2.7 million, 2019 to 2023 | March 2024 |
The July 2026 arrests make the pattern explicit. Acting on a complaint from PTA, cybercrime investigators in Lahore detained three suspects over an organized network trading call records, SIM registration data, and location data, as the Pakistani press reported on 11 July 2026. Alongside phones and SIMs, investigators seized eight biometric verification devices.
Biometric devices in the wrong hands point to the same failure PTA fined the operators for. The registration chain and the resale market in stolen SIM owner details are not separate problems.
What “Pak SIM Data” and “Fresh SIM Data” Actually Mean
“Pak SIM data” and “fresh SIM data” are marketing phrases used by websites claiming to sell bulk Pakistani subscriber records. No data set of that kind can exist lawfully. Demand for those data sets is easiest to read from the outside in: Pakistanis type variants of “pak sim data,” “sim owner details pakistan,” and “sim owner details by number” into search engines hundreds of thousands of times a month, according to third-party keyword data.
Sellers advertise “fresh sim data” and “fresh sim owner details,” and the adjective repays attention. “Fresh” is a recency guarantee on a stolen good, a claim that this copy of a lifted subscriber database is newer than a rival’s.
That claim is the red flag, not the reassurance. A lawful holder of subscriber records would have no reason to advertise recency, because a lawful holder could not sell the records at all. One Pakistani consumer guide sets out what a Pak SIM data set can and cannot legally contain, and it starts from a simple question: who holds what.
Three custodians, and no public lookup between them.
In practice those sites run one of three plays. They resell an old leak. They compose, on the spot, a record that nothing in the system will contradict. Or they run no lookup at all, and the only data that changes hands is what the visitor typed into the search box. None of the three produces genuine SIM owner details.
Pakistani press reporting in September 2025 gave a sense of the price points. Arab News described mobile location information offered for Rs 500 (about US$1.80), detailed mobile records for Rs 2,000 (about US$7), and international travel details for Rs 5,000. No lawful service sets those prices, because no lawful service sells the product. They are the going rates in a criminal trade.
Why “SIM Owner Details by Number” Does Not Lawfully Exist
No lawful route in Pakistan returns a stranger’s SIM owner details from a mobile number. Four established facts close the argument at every step.
1. Identity and biometric records sit with NADRA. Subscriber records sit with the licensed operators. PTA has stated publicly that it does not hold or manage subscriber data.
2. License conditions put subscriber records behind a confidentiality duty that applies even between companies inside the same corporate group. The carve-outs are narrow: debt recovery, service provisioning between operators, a legal obligation, and disclosure with the customer’s prior informed consent.
3. Every consumer-facing channel is scoped to the identity document or the SIM already in your own hand. None of them accepts another person’s number and returns that person’s name or address.
4. Obtaining another person’s identity information without authorization is a criminal act. Section 16 of PECA 2016, Pakistan’s Prevention of Electronic Crimes Act, covers obtaining, selling, possessing, transmitting, or using it.
There is no third possibility besides fabrication and trafficking. Any service claiming to return a stranger’s SIM owner details by number is doing one or the other.
How Do You Check SIM Owner Details on Your Own CNIC?
Four lawful channels exist, they are free or near-free, and each is scoped to something already in your possession. The same guide walks through how to check SIM owner details on your own CNIC, channel by channel, and what each one actually returns.
The complete lawful surface. Everything else is fabrication or trafficking.
- cnic.sims.pk is PTA’s free SIM Information System portal. It returns the number of SIMs registered per network against your own CNIC.
- 668 is PTA’s official SMS short code. Send your 13-digit CNIC without dashes, at a cost of about Rs 2, for the same per-network count.
- 667 works only on the SIM in your own phone. Used as the first step of the number-portability process, it returns that connection’s own registration record, including the name and identity number that connection is registered to, which is how a subscriber confirms that a SIM in their hand is genuinely theirs.
- 76367 returns only which network a given number currently sits on. It carries no identity information at all.
- Disowning a SIM carries a charge capped at Rs 200 — about US$0.70 — and PTA grants a one-time waiver where the SIM was issued illegally without the consumer’s knowledge or consent. Where a crime is involved, report it to Pakistan’s cybercrime helpline, 1799, which is run by the National Cyber Crime Investigation Agency.
That is the whole of it. Note what none of these channels does: take a number belonging to somebody else and return their identity. Anything beyond these four channels is not a better tool. It is a different category of activity.
Why Does Pakistan Require Biometric SIM Registration but Have No Data Protection Law?
Pakistan pairs a mandatory biometric SIM regime with no enacted data protection statute, and that pairing, not the biometric requirement itself, is what makes the country worth studying. The Personal Data Protection Bill was approved by the federal cabinet in July 2023 and has still not passed either house of Parliament.
The result is heavy statutory control over how the data is collected and almost none over how it is stored, shared, or destroyed afterward. SIM owner details are gathered under a legal mandate, then governed by a criminal code rather than a privacy regime. PECA 2016 is a cybercrime statute, so redress runs through prosecution rather than through rights.
Pakistan is not an outlier in requiring registration. By Privacy International’s count, 155 countries had mandatory SIM registration laws as of January 2020, and barely three in five of the countries mandating registration had a privacy or data protection framework in place. The same source cites a 2016 GSMA finding of no empirical evidence that mandatory registration directly reduces crime, and notes that in 2012 Mexico repealed the registration law it had enacted in 2009.
The contrast with India is sharper still. Electronic KYC through the Aadhaar identity system is voluntary there for a mobile connection, following judicial limits on mandatory linkage. Nigeria is the closer structural analogue: it requires every SIM to be linked to a National Identification Number, and it enforced that requirement by barring unlinked lines. But Nigeria enacted a Data Protection Act in 2023, so its collection mandate sits inside a statutory privacy regime. Pakistan’s does not.
What Other Markets Should Copy, and What They Should Not
Pakistan’s experience offers a short list for any regulator moving toward identity-linked connectivity.
- Copy the enrollment audit. Penalizing an operator for how a SIM was issued, rather than only for losing data later, moves the incentive to the counter where SIM owner details are actually created.
- Copy the free self-check. A cheap, universally available way for a citizen to see what is registered in their name turns millions of people into auditors of the operators’ records, a check that matters most in a system where the regulator itself holds none of that data.
- Do not copy the sequencing. Pakistan built the collection mandate first and left the data protection statute unfinished. That order of operations is what created the market this article describes.
Frequently Asked Questions About SIM Owner Details
These are the questions that come up most often about SIM owner details in Pakistan, answered using PTA’s own published channels and the text of PECA 2016.
Can anyone look up SIM owner details by number in Pakistan?
No. No lawful channel in Pakistan returns a stranger’s name, identity number, or address from a mobile number. Section 16 of PECA 2016 makes obtaining another person’s identity information without authorization a criminal offense.
Law enforcement reaches subscriber data through documented legal process tied to a registered case, and courts reach it through orders. Any website offering anything beyond that is fabricating results, trafficking stolen records, or both.
Why does the official channel return so little?
Because the narrowness is the design rather than a limitation. The self-check exists so a citizen can audit their own exposure, meaning how many connections carry their identity, without creating a lookup that would hand a stranger’s SIM owner details to a stalker or a fraudster just as readily. A channel that returned a name for any number would defeat the registry it is meant to protect.
How many SIMs can one CNIC hold in Pakistan?
Eight in total: five voice and three data, counted across every operator rather than per operator. The three data SIMs were added on top of the existing five-voice limit when the Supreme Court of Pakistan ruled on 5 November 2015. The cap is applied at the point of sale and biometric verification.
What should I do if a SIM is registered on my CNIC without my consent?
Check the count first through 668 or the PTA portal, and then take the unrecognized connection to that operator’s service center and disown it with a biometric verification. Expect a charge capped at Rs 200, waived once where the SIM was issued illegally without your knowledge. If money has already moved, report the incident to the cybercrime helpline at 1799 rather than to the operator alone.
What does Pakistan’s enforcement record tell a regulator elsewhere?
That supervision costs more than technology. Across the operator penalties, the blocked selling platforms, and the arrests, the recurring exhibit is a biometric device in the wrong hands or an insider with access, not a compromised central registry. Any market planning identity-linked SIMs should budget for the counter where SIM owner details are created, not just the database that stores them.
The Takeaway for Identity and Payments Teams
Pakistan’s regulator did something unusual in July 2026. It fined an entire market for failures in the integrity of the process that creates SIM owner details, not for losing data afterward.
That is the right target. Where SIM owner details underpin bank onboarding and one-time passwords, the control that matters sits at the counter: who held the device, who supervised the franchisee, and whether a living finger was actually present.
Every market moving toward identity-linked connectivity will meet the same question. Enrollment is where trust in SIM owner details is created, and it is also where that trust is quietly sold.
Author Bio
Muhammad Hamza writes about digital identity, telecom regulation, and consumer data rights in Pakistan. He runs CnicSimInfo (https://cnicsiminfo.pk/), a public-interest resource that explains Pakistan’s official SIM verification channels in plain language and maintains a verified-sources policy for every published figure.
