Biometric identity theft: Pakistan blocks 18.2M SIM cards

Full Episode Transcript

A woman in Rajanpur was told she'd get help buying food. All she had to do was press her thumb on a scanner. Officials say that thumbprint was later used to open a phone line, and that phone line was linked to terrorist activity.

Trusted by Investigators Worldwide

Run Forensic-Grade Comparisons in Seconds

Detailed facial comparison reports. Results in seconds.

Get Started

7-day refund guarantee**

Most of us will never lose a fingerprint at a

Now, most of us will never lose a fingerprint at a ration line in Pakistan. But if you've ever unlocked your phone with your face, or scanned your thumb to board a flight, this story is about the thing you can't change. You can reset a password. You cannot reset your fingerprint. Pakistani authorities say they blocked more than eighteen million illegal SIM cards over roughly two and a half years. In just the first seven months of this year, they blocked nearly two million more. And yet the scammers kept working. So here's the question that runs under all of it, if the fingerprints were supposed to stop the fraud, why didn't they?

The answer starts with a single police raid. Investigators with Pakistan's National Cyber Crime agency say they recovered the biometric records of around six hundred thousand people, in one operation. Six hundred thousand people's fingerprints. Sitting in a criminal's hands, ready to register phone lines in their names. That's the part regulators got wrong. They treated the fingerprint scan as the lock on the door. But once those prints were stored in a database, the database became the door. For the rest of us, that means the very system built to protect your identity became the biggest place to steal it.

And where were these prints coming from? Officials point to airports, driving license centers, passport offices, the everyday government counters where you hand over a thumbprint without thinking twice. The same infrastructure that collected the data leaked the data. It's not a hacking-genius story. It's a filing-cabinet-left-open story.

Here's a number that reframes the whole thing. Security researchers found that the vast majority of SIM swap attacks, around ninety-six out of a hundred, don't involve clever code at all. They rely on social engineering. Someone lies. Someone on the inside gets paid. So this was never only a technology problem. It's a people problem wearing a technology costume. For anyone who's ever gotten a two-factor code by text, that matters. If a scammer controls your phone number, they can walk right into your bank.

The Bottom Line

So Pakistan's proposed fix is to add iris scans, the pattern in your eye, on top of fingerprints. Layer the defenses. And iris data is genuinely harder to fake.

But adding a second biometric doesn't fix the crack in the wall. If the fingerprints leaked from weak databases, the iris scans will leak the same way. You'd just be handing criminals a bigger, more valuable target.

So here's the whole thing, simply. Pakistan tried to stop phone fraud by requiring fingerprints. Criminals stole the fingerprints straight from government files and kept committing fraud anyway. Adding an eye scan on top only works if you finally lock the room where all that data lives. The real lesson isn't that one biometric beats another. It's that no scan protects you if the place storing it leaks. Whether you're building a fraud case or just tapping your thumb to check your bank balance, the thing that identifies you is only as safe as the vault it sits in. The full breakdown's in the show notes if you want to go deeper.

Biometric identity theft: Pakistan blocks 18.2M SIM cards