THIRTEEN DIGITS FOR SALE: PAKISTAN’S IDENTITY BAZAAR
Focus= Your CNIC, For Sale
A dispatch from the Digital Intelligence Bureau
Thirteen digits. That is you. Your name, your father, your address, your SIMs, your family tree. In Pakistan those thirteen digits have a market price, and it is lower than a pizza.
The vault had doors
In March 2024 a Joint Investigation Team led by the FIA reported that the personal data of about 2.7 million citizens was compromised between 2019 and 2023. It found that NADRA offices in Karachi, Multan and Peshawar were allegedly involved, and that there was evidence of the data surfacing in Argentina and Romania (Dawn; Geo).
NADRA’s response, in October 2024: technology upgrades, and officers found responsible for the breach “dismissed and removed” after the first phase of disciplinary proceedings (NADRA press release).
The bazaar on Telegram
In September 2025, after a TV report showed citizens’ data, including that of senior officials, on sale online, the Interior Minister ordered an inquiry. An NCCIA special team identified 139 platforms: 75 Facebook accounts, 18 apps, 17 websites, 12 Telegram channels, 10 TikTok accounts, two YouTube channels and a WhatsApp group. On offer: CNIC numbers, family details, addresses, SIM registrations, call and SMS logs, location histories and travel records (Digital Rights Monitor; Express Tribune). One report listed location data at around Rs500 and detailed call records at Rs2,000 (Minute Mirror). Investigators also found some sellers simply scammed their buyers with fake data.
The PTA said it does not hold subscriber data, that its audits found no breach in the licensed telecom sector, that the datasets looked aggregated from multiple outside sources, and that it had blocked 1,372 sites, apps and pages selling personal data (Geo). Blocking a channel is not deleting a file. The data simply moves house.
Your name, someone else’s SIM
Leaked identity is not a privacy problem. It is raw material. A CNIC copy plus a family tree is enough to impersonate you on a call, to open accounts, and to talk your relatives out of money. The NCCIA says fake calls and OTP scams caused the public the greatest losses in 2025, with fraudsters posing as bank or courier staff to drain bank, JazzCash and Easypaisa accounts; it says it blocked more than 46,000 fake bank accounts during the year (APP via UrduPoint).
The law that keeps not arriving
Pakistan still has no comprehensive personal data protection law. The 2023 draft cleared the federal cabinet but was not passed, and reports in 2025 described further delays as the IT ministry reworked it (The Nation; Legal 500). Until it lands, a leak is an embarrassment, not a liability.
Guard your thirteen digits
- Check every SIM issued on your CNIC: SMS your CNIC number (no dashes) to 668, and block any number you don’t recognise with your operator.
- Don’t hand out CNIC photocopies freely. When you must, write the purpose and date across the copy.
- Never share OTPs, PINs or CNIC details on a call, however official it sounds. Hang up and call the bank’s published number.
- Set a PIN and lower transaction limits on wallets and banking apps; turn on alerts for every transaction.
- Agree a family code word for “emergency” money requests.
- Report data sellers to the NCCIA and the PTA’s complaint portal.
Your identity was never lost. It was copied, priced and resold, and you were the last to know.
— Illuminati Pakistan
The Eye is Watching